CVE-2014-3772 (PHP, published 2014-08-07T11:13Z)
Description: value: TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/nilsteampassnet/TeamPass
Files changed:
admin.php
admin.settings.php
admin.settings_categories.php
changelog.md
datatable.logs.php
error.php
find.php
folders.php
home.php
includes/include.php
includes/language/english.php
includes/libraries/Authentication/GoogleAuthenticator/GoogleAuthenticator.php
includes/libraries/Database/Core/DbCore.php
includes/settings.php
index.php
items.load.php
items.php
kb.php
load.php
roles.php
sources/admin.queries.php
sources/categories.queries.php
sources/checks.php
sources/core.php
sources/datatable/datatable.item_edition.php
sources/datatable/datatable.kb.php
sources/datatable/datatable.logs.php
sources/datatable/datatable.users_logged.php
sources/export.queries.php
sources/favourites.queries.php
sources/find.queries.php
sources/folders.queries.php
sources/import.queries.php
sources/items.queries.php
sources/kb.queries.php
sources/logs.queries.php
sources/main.functions.php
sources/main.queries.php
sources/roles.queries.php
sources/upload/upload.attachments.php
sources/upload/upload.files.php
sources/users.queries.php
sources/views.queries.php
users.load.php
users.php
views.php
views_database.php
views_logs.php
Commit message: 2.1.20


Vulnerable code:
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."'");
            $data_time = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."_time'");
$nb_emails = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."emails WHERE status = 'not_sent' OR status = ''");
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE personal_folder=0 AND id = ".$folder->id);
 * @file          datatable.users_logged.php
 * @author        Nils Laumaill�
 * @copyright     (c) 2009-2014 Nils Laumaill�
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
        $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
                $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
                        ".mysql_real_escape_string($_GET['sSortDir_'.$i]) .", ";
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
        $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$t->parent_id);
        $node_data = $db->fetchRow(
        echo '<tr class="ligne0" id="row_'.$t->id.'">
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">'.$t->id.'</td>
                        <td width="50%" onclick="open_edit_folder_dialog('.$t->id.')">
                            '.$ident.'<span id="title_'.$t->id.'">'.$t->title.'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="complexite_'.$t->id.'">'.@$pwComplexity[$node_data[0]][1].'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="parent_'.$t->id.'">'.$data[0].'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            '.$t->nlevel.'
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="renewal_'.$t->id.'">'.$node_data[1].'</span>
                        </td>
                        <td align="center">
                            <img src="includes/images/folder--minus.png" onclick="supprimer_groupe(\''.$t->id.'\')" style="cursor:pointer;" />
                        </td>';
        $data3 = $db->fetchRow("SELECT bloquer_creation,bloquer_modification FROM ".$pre."nested_tree WHERE id = ".$t->id);
                        <td align="center">
                            <input type="checkbox" id="cb_droit_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'creation\')"', isset($data3[0]) && $data3[0] == 1 ? 'checked' : '', ' />
                        </td>
                        <td align="center">
                            <input type="checkbox" id="cb_droit_modif_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'modification\')"', isset($data3[1]) && $data3[1] == 1 ? 'checked' : '', ' />
                        </td>
                        <td>
                            <input type="hidden"  id="parent_id_'.$t->id.'" value="'.$t->parent_id.'" />
                            <input type="hidden"  id="renewal_id_'.$t->id.'" value="'.$node_data[0].'" />
                        </td>
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$record['id']."' AND action = 'at_delete'");
$k['copyright'] = "&nbsp;&copy;&nbsp;copyright 2009-2014";
$txt['user_ga_code'] = "Send GoogleAuthenticator to user by email";
$txt['send_ga_code'] = "Google Authenticator for user";
$txt['error_no_email'] = "This user has no email set!";
$txt['error_no_user'] = "No user found!";
$txt['email_ga_subject'] = "Your Google Authenticator flash code for Teampass";
$txt['email_ga_text'] = "Hello,<br><br>Please click this <a href='#link#'>LINK</a> and flash it with GoogleAuthenticator application to get your OTP credentials for Teampass.<br /><br />Cheers";

$txt['purge_done'] = "Purge done! Number of elements deleted: ";
    public function checkCode($secret, $code, $discrepancy = 3)
        /*
       $time = floor(time() / 30);
   		*/
    	$currentTimeSlice = floor(time() / 30);

    	for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
    		$calculatedCode = $this->getCode($secret, $currentTimeSlice + $i);
    		if ($calculatedCode == $code ) {
    			return true;
    		}
    	}
    }#-#fetchArray()
        
        
        } else {            
$database = "tp";
@define('SECUREPATH', 'E:/xampp/security');
require_once "E:/xampp/security/sk.php";
    $dataLanguage =
        );
            <button title="'.$txt['login_copy'].'" style="margin-bottom:5px;" id="menu_button_copy_login" class="copy_clipboard"><img src="includes/images/ui-text-field.png" id="div_copy_login" alt="" /></button>
        "sources/items.queries.php",
            type    : "pw_generate",
        	data = prepareExchangedData(data, "decode");
            $("#"+elem+"pw1").val(data.key).focus();
			$("#visible_pw").text(data.key);
        $("#menu_button_edit_item, #menu_button_del_item, #menu_button_copy_item, #menu_button_add_fav, #menu_button_del_fav, #menu_button_show_pw, #menu_button_copy_pw, #menu_button_copy_login, #menu_button_copy_link").attr("disabled","disabled");
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['login'])) {
    break;
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$node);
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$folder->id);
</div>';
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1
        || $_SESSION['settings']['enable_kb'] != 1
) {
                login:    login,
                key :    key
                type    : "change_user_language",
                lang    : lang
<?php
session_start();

include './includes/settings.php';
include './sources/main.functions.php';

require_once './sources/SplClassLoader.php';

// connect to the server
$db = new SplClassLoader('Database\Core', './includes/libraries');
$db->register();
$db = new Database\Core\DbCore($server, $user, $pass, $database, $pre);
$db->connect();

$rows = $db->fetchAllArray("SELECT id, pw FROM ".$pre."items WHERE perso = '0'");
foreach ($rows as $reccord) {
	$pw = decrypt($reccord['pw']);
	if (!empty($pw) && strlen($pw) > 30 && isutf8($pw)) {

		$key = substr($pw, 0, 15);
		$pw = substr($pw,30);

		$pw = $key . $pw;

		$pw = encrypt($pw);

		$db->queryUpdate(
			'items',
			array(
			    'pw' => $pw
			),
			"id='".$reccord['id']."'"
		);
	}
}

?>
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$record['id']."' AND parent_id = 0");
            $row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = @$db->fetchRow("SELECT COUNT(*) FROM ".$pre."keys WHERE `id`='".$reccord['id']."' AND `table` = 'items'");
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
                    $row = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id=".$folder);
    $dataSession = $db->fetchRow("SELECT key_tempo FROM ".$pre."users WHERE id=".$_SESSION['user_id']);
    $row = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type = 'admin' AND intitule = 'cpassman_version'");
    $sql="SELECT * FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'";
    $row = $db->query($sql);
    $data = $db->fetchArray($row);
$queryCount = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."users WHERE timestamp >= '".(time() - 600)."'");
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
        $sWhere .= $aColumns[$i]." LIKE '%".mysql_real_escape_string($_GET['sSearch'])."%' OR ";
    $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
    $ret_cat = $db->fetchRow("SELECT category FROM ".$pre."kb_categories WHERE id = ".$reccord['category_id']);
    $ret_author = $db->fetchRow("SELECT login FROM ".$pre."users WHERE id = ".$reccord['author_id']);
        $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
                $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
    $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
			<td align="center"><span class="span_pw" id="span_'.$elem['id'].'"><a href="#" onclick="decryptme('.$elem['id'].', \''.$encPw.'\')">Decrypt </a></span><input type="hidden" id="hide_'.$elem['id'].'" value="'.$encPw.'" /></td>
            $data = $db->fetchRow("SELECT favourites FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'");
$row = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = ".$_SESSION['user_id']);
$rows = $db->fetchAllArray(
    "SELECT id FROM ".$pre."nested_tree WHERE personal_folder=1 AND NOT parent_id = ".$row[0].
    " AND NOT title = ".$_SESSION['user_id']
);
foreach ($rows as $reccord) {
    if (!in_array($reccord['id'], $arrayPf)) {
        //build an array of personal folders ids
        array_push($arrayPf, $reccord['id']);
        //build also a string with those ids
        if (empty($listPf)) {
            $listPf = $reccord['id'];
        } else {
            $listPf .= ', '.$reccord['id'];
        }
    }
    $sLimit = "LIMIT ". intval($_GET['iDisplayStart']) .", ". intval($_GET['iDisplayLength']);
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
            ".$_GET['sSortDir_'.$i] .", ";

        "SELECT role_id FROM ".$pre."restriction_to_roles WHERE item_id = ".$reccord['id']
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
    $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$_POST['newparent_id']);
    $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type = 'complex' AND intitule = '".$id[1]."'");
                $data = $db->fetchRow(
                    "SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'"
                $data = $db->fetchRow("SELECT personal_folder FROM ".$pre."nested_tree WHERE id = '".$parentId."'");
                $data = $db->fetchRow(
            $data = $db->fetchRow("SELECT authorized FROM ".$pre."rights WHERE tree_id = '".$val[0]."' AND fonction_id= '".$val[1]."'");
        $data_fld = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$_POST['folder']."'");
                    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE nlevel = ".($folderLevel+$startPathLevel)." AND title = \"".$fold."\" AND parent_id = ".$parent_id);
                        $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE nlevel = '".($folderLevel+$startPathLevel)."' AND title = '".$fold."' AND parent_id = '".$parent_id."'");
                    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE id_tree = '".$foldersArray[$item[1]]['id']."' AND label = \"".$item[2]."\"");

                        $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$folderId."'");
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE label = '".addslashes($label)."' AND inactif=0");
                                    WHERE i.field_id = '".$field_data[0]."'
                                    AND i.item_id=".$dataReceived['id']
                        $dataTmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."automatic_del WHERE item_id = '".$dataReceived['id']."'");
            $dataDeleted = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_delete'");
            $dataRestored = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_restored'");
        	"SELECT *
            /*
        * CASE
        * Generate a password
        */
        case "pw_generate":
            $pwgen = new SplClassLoader('Encryption\PwGen', '../includes/libraries');
            $pwgen->register();
            $pwgen = new Encryption\PwGen\pwgen();
            // Set pw size
            $pwgen->setLength($_POST['size']);
            // Include at least one number in the password
            $pwgen->setNumerals(($_POST['num'] == "true")? true : false);
            // Include at least one capital letter in the password
            $pwgen->setCapitalize(($_POST['maj'] == "true")? true : false);
            // Include at least one symbol in the password
            $pwgen->setSymbols(($_POST['symb'] == "true")? true : false);
            // Complete random, hard to memorize password
            if (isset($_POST['secure']) && $_POST['secure'] == "true") {
                $pwgen->setSecure(true);
                $pwgen->setSymbols(true);
                $pwgen->setCapitalize(true);
                $pwgen->setNumerals(true);
            } else {
                $pwgen->setSecure(false);
            }
            echo prepareExchangedData(array("key" => $pwgen->generate()), "encode");
            break;

                $data = $db->fetchRow("SELECT id, title FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'");
            $tmp = $db->fetchRow(
                $data_count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif = 0");
                $whereArg = " AND i.id_tree=".$_POST['id'];
                $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");//echo ">".$dataTmp[0];
                    $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");
            $data = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type='complex' AND intitule = '".$_POST['groupe']."'");
            $data = $db->fetchRow("SELECT name,id_item,file FROM ".$pre."files WHERE id = '".$_POST['file_id']."'");
            $data = $db->fetchRow("SELECT date FROM ".$pre."log_items WHERE action = 'at_modification' AND id_item = '".$_POST['item_id']."' ORDER BY date DESC");
    $data = $db->fetchRow("SELECT bloquer_creation,bloquer_modification,personal_folder FROM ".$pre."nested_tree WHERE id = '".$groupe."'");
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])
        || !isset($_SESSION['settings']['enable_kb']) || $_SESSION['settings']['enable_kb'] != 1
) {
                $row = $db->query("SELECT anyone_can_modify, author_id FROM ".$pre."kb WHERE id = ".$id);
                $ret = $db->fetchArray($row);
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."kb_categories WHERE category = '".mysql_real_escape_string($category)."'");
            $row = $db->query(
                "SELECT k.id as id, k.label as label, k.description as description, k.category_id as category_id, k.author_id as author_id, k.anyone_can_modify as anyone_can_modify,
                u.login as login, c.category as category
                FROM ".$pre."kb as k
                INNER JOIN ".$pre."kb_categories as c ON (c.id = k.category_id)
                INNER JOIN ".$pre."users as u ON (u.id = k.author_id)
                WHERE k.id = '".$_POST['id']."'"
            $ret = $db->fetchArray($row);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
        $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
            $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $sql = "SELECT label, description, id_tree, perso, restricted_to, login
        $data = $db->fetchArray($row);
        $itemTags = $db->fetchAllArray("SELECT tag FROM ".$pre."tags WHERE item_id=".$id);
            "id='".$id."'"
        $sql = "SELECT i.label, i.description, i.id_tree as id_tree, i.perso, i.restricted_to, i.id, i.login
        $data = $db->fetchArray($row);
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé
            $row = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id=".$dataReceived['user_id']);
        $data = $db->fetchRow(
            "SELECT COUNT(*) FROM ".$pre."users WHERE email = '".
            mysql_real_escape_string(stripslashes(($_POST['email'])))."'"
            "&login=".$_POST['login']."\">".$_SESSION['settings']['cpassman_url'].
            "/index.php?action=password_recovery&key=".$key."&login=".$_POST['login']."</a>.<br><br>".$txt['thku'];
        $textMailAlt = $txt['forgot_pw_email_altbody_1']." ".$txt['at_login']." : ".$data['login']." - ".
                mysql_real_escape_string(stripslashes(($_POST['email'])))."'"
            $data = $db->fetchRow(
                "SELECT COUNT(*) FROM ".$pre."misc WHERE intitule = '".
                $_POST['login']."' AND type = 'password_recovery'"
                            'intitule' => $_POST['login']
                            'intitule' => $_POST['login'],
        $data = $db->fetchRow(
            $_POST['login']."' AND type = 'password_recovery'"
        if ($_POST['key'] == $data[0]) {
                "login = '".$_POST['login']."'"
                    'intitule' => $_POST['login'],
            $dataUser = $db->queryFirst("SELECT email FROM ".$pre."users WHERE login = '".$_POST['login']."'");
                    'user_language' => $_POST['lang']
            $_SESSION['user_language'] = $_POST['lang'];
            $_SESSION['user_language'] = $_POST['lang'];
        //Generate
        $pwgen->setLength($_POST['length']);
        $pwgen->setSecure($_POST['secure']);
        $pwgen->setSymbols($_POST['symbols']);
        $pwgen->setCapitalize($_POST['capitalize']);
        $pwgen->setNumerals($_POST['numerals']);
        echo Encryption\Crypt\aesctr::encrypt($pwgen->generate(), $_SESSION['key'], 256);
        $sql = "SELECT * FROM ".$pre."users WHERE login = '".addslashes($_POST['userId'])."'";
        $data = $db->fetchArray($row);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".mysql_real_escape_string(stripslashes($_POST['name']))."'");
            $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE id != '".$_POST['id']."' AND title = '".mysql_real_escape_string(stripslashes($_POST['title']))."'");
                        $count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_values WHERE folder_id = ".$node->id." AND role_id = ".$role);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
 * @link          http://www.teampass.net
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $data = $db->fetchRow("SELECT ".$_POST['type']." FROM ".$pre."users WHERE id = ".$val[0]);
            $data = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = $val[0]");
                $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_POST['id']."' AND personal_folder = 1");    // Get personal folder ID
            $data = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id = '".$_POST['id']."'");
            $data_user = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->fetchRow("SELECT groupes_visibles FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->fetchRow("SELECT groupes_interdits FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$_POST['domain']."' AND parent_id = 0");
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".$_POST['domain']."'");
                    WHERE l.id_user = ".$_POST['id'].$sql_filter
                    WHERE l.id_user = ".$_POST['id'].$sql_filter."
                    LIMIT $start,".$_POST['nb_items_by_page']
                $data = $db->fetchRow(
                    "SELECT COUNT(*)
                    FROM ".$pre."log_system
                    WHERE type = 'user_mngt' AND field_1=".$_POST['id']
                $admin_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".$_SESSION['user_id']."' AND personal_folder = 1");
                $user_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".$user_id."' AND personal_folder = 1");
                        WHERE l.action = 'at_creation' AND i.perso=1 AND i.id_tree=".$folder->id
                    "id = ".$_POST['user_id']
                    "id = ".$reccord['id']
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            WHERE l.action = 'at_shown'".$sqlFilter
            WHERE l.action = 'at_copy'".$sqlFilter
            WHERE i.label LIKE '%".$_POST['filter']."%'"
            WHERE l.type = 'admin_action'".$sqlFilter
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                            numerals   : true,
                            var pw = htmlspecialchars_decode(aes_decrypt(data));
                        	$("#change_user_pw_newpw_confirm, #change_user_pw_newpw").val(pw);
                    		$("#change_user_pw_newpw").focus();
        "sources/items.queries.php",
            type    : "pw_generate",
            data = $.parseJSON(data);
            $("#"+elem).val(data.key).focus();
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé

if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
include $_SESSION['settings']['cpassman_dir'].'/includes/include.php';
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {

Fixed code:
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "users.php")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."'");
    $data = $db->queryCount(
        "misc",
        array(
            "type" => $type,
            "intitule" => $setting
        )
    );
            //$data_time = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."_time'");
            $data_time = $db->queryCount(
                "misc",
                array(
                    "type" => $type,
                    "intitule" => $setting."_time"
                )
            );
//$nb_emails = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."emails WHERE status = 'not_sent' OR status = ''");
$nb_emails = $db->queryCount(
    "emails",
    "status = 'not_sent' OR status = ''"
);
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE personal_folder=0 AND id = ".$folder->id);
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "personal_folder" => 0,
                    "id" => $folder->id
                )
            );
 #xxx - Off-line mode, link make the page scroll up
 * @file          datatable.logs.php
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key']))
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", ". mysql_real_escape_string($_GET['iDisplayLength']) ."" ;
                $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
                        '".mysql_real_escape_string($_GET['sSortDir_'.$i]) ."', ";
    } elseif (@$_SESSION['error']['code'] == ERR_VALID_SESSION) {
        echo '
        <div class="ui-state-error ui-corner-all error" style="text-align:center;" >'.$txt['error_not_authorized'].'<br /><br /><a href="index.php" />'.$txt['home'] .'</a></div>';
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        //$data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$t->parent_id);
        $data = $db->queryGetRow(
            "nested_tree",
            array(
                "title"
            ),
            array(
                "id" => intval($t->parent_id)
            )
        );
        /*$node_data = $db->fetchRow(
        );*/
        $node_data = $db->queryGetRow(
            array(
                "misc" => "m",
                "nested_tree" => "n"
            ),
            array(
                "m.valeur" => "valeur",
                "n.renewal_period" => "renewal_period"
            ),
            array(
                "m.type" => "complex",
                "m.intitule" => intval(n.id),
                "m.intitule" => intval($t->id)
            )
        echo '
                <tr class="ligne0" id="row_'.$t->id.'">
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">'.$t->id.'</td>
                    <td width="50%" onclick="open_edit_folder_dialog('.$t->id.')">
                        '.$ident.'<span id="title_'.$t->id.'">'.$t->title.'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="complexite_'.$t->id.'">'.@$pwComplexity[$node_data[0]][1].'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="parent_'.$t->id.'">'.$data[0].'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        '.$t->nlevel.'
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="renewal_'.$t->id.'">'.$node_data[1].'</span>
                    </td>
                    <td align="center">
                        <img src="includes/images/folder--minus.png" onclick="supprimer_groupe(\''.$t->id.'\')" style="cursor:pointer;" />
                    </td>';
        //$data3 = $db->fetchRow("SELECT bloquer_creation,bloquer_modification FROM ".$pre."nested_tree WHERE id = ".$t->id);
        $data3 = $db->queryGetRow(
            array(
                "bloquer_creation",
                "bloquer_modification"
            ),
            "nested_tree",
            array(
                "id" => intval($t->id)
            )
        );
                    <td align="center">
                        <input type="checkbox" id="cb_droit_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'creation\')"', isset($data3[0]) && $data3[0] == 1 ? 'checked' : '', ' />
                    </td>
                    <td align="center">
                        <input type="checkbox" id="cb_droit_modif_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'modification\')"', isset($data3[1]) && $data3[1] == 1 ? 'checked' : '', ' />
                    </td>
                    <td>
                        <input type="hidden"  id="parent_id_'.$t->id.'" value="'.$t->parent_id.'" />
                        <input type="hidden"  id="renewal_id_'.$t->id.'" value="'.$node_data[0].'" />
                    </td>
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$record['id']."' AND action = 'at_delete'");
            $data = $db->queryCount(
                "log_items",
                array(
                    "id_item" => intval($record['id']),
                    "action" => "at_delete"
                )
            );
$txt['purge_done'] = "The purge has been performed!<br />Number of elements deleted: ";
    public function checkCode($secret, $code)
        $time = floor(time() / 30);
    }#-#fetchRow()

    #-#############################################
    # desc: builds the sql query
    # param: tables, inputs, conditions, extras
    # return: string SQL query
    public function prepareData($table, $data, $where, $extra = "", $inner = "")
    {
        $q = "SELECT ";

        // data
        $d = "";
        if (is_array($data)) {
            foreach ($data as $key => $val) {
                if (is_int($key)) {
                    $d .= "`".$this->escape($val)."`, ";
                } else {
                    if (strpos($key,'.') === false) {
                        $d .= "`$key` AS $val, ";
                    } else {
                        $d .= "$key AS $val, ";
                    }
                }
            }
            $q .= substr_replace($d, "", -2);
        } else {
            $d = $data." ";
        }

        // table
        if (is_array($table)) {
            $t = "";
            $q .= " FROM ";
            foreach ($table as $key => $val) {
                $t .= "`".$this->pre.$key."` AS ".$this->escape($val).", ";
            }
            $q .= substr_replace($t, "", -2)." ";
        } else {
            $q .= " FROM `".$this->pre.$table."` ";
        }

        // inner join conditions
        if (!empty($inner)) {
            $i = "";
            foreach ($inner as $key => $val) {
                $i .= "INNER JOIN ".$this->pre.$key." ON ".$val." ";
            }
            $q .= $i;
        }

        // where
        $w = "";
        foreach ($where as $key => $val) {
            if (strtolower($val) == 'null') {
                $w .= "`$key` = NULL, ";
            } elseif (strtolower($val)=='now()') {
                $w .= "`$key` = NOW(), ";
            } else {
                if (strpos($key,'.') === false) {
                    $w .= "`$key` = '".$this->escape($val)."' AND ";
                } else {
                    $w .= "$key = '".$this->escape($val)."' AND ";
                }
            }
        }

        // compile
        return rtrim($q, ', ').' WHERE '. rtrim($w, ' AND ') . $extra .';';
    }#-#prepareData()

    #-#############################################
    # desc: fetches and return result of one line
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryGetRow($table, $data, $where, $extra = "", $inner = "")
    {
        $q =  $this->prepareData($table, $data, $where, $extra, $inner);

        $query_id = $this->query($q);

        if (isset($this->query_id)) {
            $record = mysql_fetch_row($this->query_id);
        } else {
            $this->oops("Invalid query_id: <b>$this->query_id</b>. Records could not be fetched.");
        }

        $this->freeResult($query_id);

        return $record;
    }#-#queryGetRow()

    #-#############################################
    # desc: fetches and return result of one line
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryGetArray($table, $data, $where, $extra = "", $inner = "")
    {
        $q =  $this->prepareData($table, $data, $where, $extra, $inner);

        $query_id = $this->query($q);

        if (isset($this->query_id)) {
            $record = mysql_fetch_assoc($this->query_id) or die(mysql_error()." | ".$q);
        } else {
            $this->oops("Invalid query_id: <b>$this->query_id</b>. Records could not be fetched.");
        }

        $this->freeResult($query_id);

        return $record;
    }#-#queryGetRow()

    #-#############################################
    # desc: fetches and return the number of lines
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryCount($table, $where)
    {
        $q = "SELECT COUNT(*) FROM `".$this->pre.$table."` ";

        if (is_array($where)) {
            $w = "";
            foreach ($where as $key => $val) {
                if (strtolower($val) == 'null') {
                    $w .= "`$key` = NULL, ";
                } elseif (strtolower($val)=='now()') {
                    $w .= "`$key` = NOW(), ";
                } else {
                    $w .= "`$key`='".$this->escape($val)."' AND ";
                }
            }
        } else {
            $w = $where;
        }
        $q = rtrim($q, ', ').' WHERE '. rtrim($w, ' AND ') .';';

        $query_id = $this->query($q);
        $out = mysql_fetch_row($query_id);
        $this->freeResult($query_id);

        return $out;
    }


        } else {
$database = "tpssl";
@define('SECUREPATH', 'C:/nils.laumaille/utils/xamppssl/security');
require_once "C:/nils.laumaille/utils/xamppssl/security/sk.php";

    /*$dataLanguage =
        );*/
    $dataLanguage = $db->queryGetRow(
        "misc",
        array(
            "valeur"
        ),
        array(
            "type" => "admin",
            "intitule" => "default_language"
        )
    );
            <button title="'.$txt['login_copy'].'" id="menu_button_copy_login" class="copy_clipboard"><img src="includes/images/ui-text-field.png" id="div_copy_login" alt="" /></button>
            <br />
            <button title="'.$txt['url_copy'].'" style="margin-bottom:5px;" id="menu_button_copy_url" class="copy_clipboard"><img src="includes/images/ui-toolbar-bookmark.png" id="div_copy_url" alt="" /></button>
} elseif ((!isset($_SESSION['validite_pw']) || empty($_SESSION['validite_pw']) || empty($_SESSION['user_id'])) && isset($_GET['otv']) && $_GET['otv'] == "true") {
    // case where one-shot viewer
    if (isset($_GET['session']) && !empty($_GET['session'])) {
        include 'otv.php?session='.$_GET['session'];
    } else {
        $_SESSION['error']['code'] = ERR_VALID_SESSION;
        $_SESSION['initial_url'] = substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "index.php?"));
        include 'error.php';
    }    
        "sources/main.queries.php",
            type    : "generate_a_password",
			data = prepareExchangedData(data, "decode");
           	if (data.error == "true") {
           		$("#div_dialog_message_text").html(data.error_msg);
           		$("#div_dialog_message").dialog("open");
           	} else {
           		$("#"+elem+"pw1").val(data.key).focus();
				$("#visible_pw").text(data.key);
           	}
        $("#menu_button_edit_item, #menu_button_del_item, #menu_button_copy_item, #menu_button_add_fav, #menu_button_del_fav, #menu_button_show_pw, #menu_button_copy_pw, #menu_button_copy_login, menu_button_copy_url, #menu_button_copy_link").attr("disabled","disabled");
                        // #XXX
                        if (data.url != "") {
                            var clip = new ZeroClipboard.Client();
                            clip.setText(data.url);
                            clip.addEventListener('complete', function(client, text) {
                                    $("#message_box").html("<?php echo addslashes($txt['url_copied_clipboard']);?>").show().fadeOut(1000);
                            });
                            clip.glue('menu_button_copy_url');
                        }
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    //include 'error.php';
    exit();
                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$node);
                $data = $db->queryCount(
                    "items",
                    array(
                        "inactif" => 0,
                        "id_tree" => intval($node)
                    )
                );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$folder->id);
            $data = $db->queryCount(
                "items",
                array(
                    "inactif" => 0,
                    "id_tree" => intval($folder->id)
                )
            );
</div><br />';
if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
        || $_SESSION['settings']['enable_kb'] != 1)
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        // prepare data
        data = \'{"login":"\'+sanitizeString(login)+\'" ,\'+
            \'"key":"\'+sanitizeString(key)+\'"}\';
    		    data : prepareExchangedData(data, "encode")
        data = \'{"lang":"\'+sanitizeString(lang)+\'"}\';    		        
                type : "change_user_language",
                data : prepareExchangedData(data, "encode")
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])
){
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_settings")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$record['id']."' AND parent_id = 0");
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "title" => $record['id'],
                    "parent_id" => 0
                )
            );
            //$row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $item['id'],
                    "action" => "at_creation"
                )
            );
            //$row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $item['id'],
                    "action" => "at_creation"
                )
            );
            //$row = @$db->fetchRow("SELECT COUNT(*) FROM ".$pre."keys WHERE `id`='".$reccord['id']."' AND `table` = 'items'");
            $row = $db->queryCount(
                "keys",
                array(
                    "id" => $reccord['id'],
                    "table" => "items"
                )
            );
require_once('sessions.php');
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_settings")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

                    //$row = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id=".$folder);
                    $row = $db->queryGetRow(
                        "nested_tree",
                        array(
                            "title"
                        ),
                        array(
                            "id" => intval($folder)
                        )
                    );
<?php
/**
 *
 * @file          checks.php
 * @author        Nils Laumaillé
 * @version       2.1.20
 * @copyright     (c) 2009-2014 Nils Laumaillé
 * @licensing     GNU AFFERO GPL 3.0
 * @link		  http://www.teampass.net
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

$pagesRights = array(
    "user" => array(
        "home", "items", "find", "kb", "favourites"
    ),
    "manager" => array(
        "home", "items", "find", "kb", "favourites", "manage_roles", "manage_folders", "manage_views", "manage_users"
    ),
    "admin" => array(
        "home", "items", "find", "kb", "favourites", "manage_roles", "manage_folders", "manage_views", "manage_users", "manage_settings", "manage_main"
    )
);

function curPage()
{
    parse_str(substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "?")+1), $result);
    return $result['page'];
}

function checkUser($userId, $userKey, $pageVisited)
{
    global $pagesRights;

    if (empty($userId) || empty($pageVisited) || empty($userKey)) {
        return false;
    }

    include $_SESSION['settings']['cpassman_dir'].'/includes/settings.php';
    require_once $_SESSION['settings']['cpassman_dir'].'/includes/language/'.$_SESSION['user_language'].'.php';
    require_once $_SESSION['settings']['cpassman_dir'].'/sources/SplClassLoader.php';

    // Connect to mysql server
    $db = new SplClassLoader('Database\Core', $_SESSION['settings']['cpassman_dir'].'/includes/libraries');
    $db->register();
    $db = new Database\Core\DbCore($server, $user, $pass, $database, $pre);
    $db->connect();

    // load user's data
    /*$sql = "SELECT * FROM ".$pre."users WHERE id = '$userId'";
    $row = $db->query($sql);
    $data = $db->fetchArray($row);*/
    $data = $db->queryGetArray(
        "users",
        array(
            "login",
            "key_tempo",
            "admin",
            "gestionnaire"
        ),
        array(
            "id" => intval($userId)
        )
    );

    // check if user exists and tempo key is coherant
    if (empty($data['login']) || empty($data['key_tempo']) || $data['key_tempo'] != $userKey) {
        return false;
    }

    // check if user is allowed to see this page
    if (empty($data['admin']) && empty($data['gestionnaire']) && !in_array($pageVisited, $pagesRights['user'])) {
        return false;
    } else if (empty($data['admin']) && !empty($data['gestionnaire']) && !in_array($pageVisited, $pagesRights['manager'])) {
        return false;
    } else if (!empty($data['admin']) && !in_array($pageVisited, $pagesRights['admin'])) {
        return false;
    }

    return true;
}
    //$dataSession = $db->fetchRow("SELECT key_tempo FROM ".$pre."users WHERE id=".$_SESSION['user_id']);
    $dataSession = $db->queryGetRow(
        "users",
        array(
            "key_tempo"
        ),
        array(
            "id" => intval($_SESSION['user_id'])
        )
    );
    //$row = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type = 'admin' AND intitule = 'cpassman_version'");
    $row = $db->queryGetRow(
        "misc",
        array(
            "valeur"
        ),
        array(
            "type" => "admin",
            "intitule" => "cpassman_version"
        )
    );
    $data = $db->queryGetArray(
        "users",
        array(
            "admin",
            "gestionnaire",
            "groupes_visibles",
            "groupes_interdits",
            "fonction_id"
        ),
        array(
            "id" => intval($_SESSION['user_id'])
        )
    );
$queryCount = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."users WHERE timestamp >= '".intval((time() - 600))."'");
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
            . mysql_real_escape_string($_GET['iDisplayLength']) ;
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    //$ret_cat = $db->fetchRow("SELECT category FROM ".$pre."kb_categories WHERE id = ".$reccord['category_id']);
    $ret_cat = $db->queryGetRow(
        "kb_categories",
        array(
            "category"
        ),
        array(
            "id" => intval($reccord['category_id'])
        )
    );
    //$ret_author = $db->fetchRow("SELECT login FROM ".$pre."users WHERE id = ".$reccord['author_id']);
    $ret_author = $db->queryGetRow(
        "users",
        array(
            "login"
        ),
        array(
            "id" => intval($reccord['author_id'])
        )
    );
        $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
                . mysql_real_escape_string($_GET['iDisplayLength']) ;
                $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
            . mysql_real_escape_string($_GET['iDisplayLength']);
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
			<td align="center"><span class="span_pw" id="span_'.$elem['id'].'"><a href="#" onclick="decryptme('.$elem['id'].', \''.$encPw.'\');return false;">Decrypt </a></span><input type="hidden" id="hide_'.$elem['id'].'" value="'.$encPw.'" /></td>
            //$data = $db->fetchRow("SELECT favourites FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'");
            $data = $db->queryGetRow(
                "users",
                array(
                    "favourites"
                ),
                array(
                    "id" => intval($_SESSION['user_id'])
                )
            );
// $row = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".intval($_SESSION['user_id'])."'");
$row = $db->queryGetRow(
    "nested_tree",
    array(
        "id"
    ),
    array(
        "title" => intval($_SESSION['user_id'])
    )
);
if (empty($row[0])) {
	$rows = $db->fetchAllArray(
	    "SELECT id FROM ".$pre."nested_tree WHERE personal_folder=1 AND NOT parent_id = '".intval($row[0]).
	    "' AND NOT title = '".intval($_SESSION['user_id'])."'"
	);
	foreach ($rows as $reccord) {
		if (!in_array($reccord['id'], $arrayPf)) {
			//build an array of personal folders ids
			array_push($arrayPf, $reccord['id']);
			//build also a string with those ids
			if (empty($listPf)) {
				$listPf = $reccord['id'];
			} else {
				$listPf .= ', '.$reccord['id'];
			}
		}
	}

    $sLimit = "LIMIT ". intval($_GET['iDisplayStart']) .", ". intval($_GET['iDisplayLength'])."";
            $sOrder .= "".$aColumns[ intval($_GET['iSortCol_'.$i]) ]." "
            .mysql_real_escape_string($_GET['sSortDir_'.$i]) .", ";
//echo $sOrder;
        "SELECT role_id FROM ".$pre."restriction_to_roles WHERE item_id = '".$reccord['id']."'"
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_folders")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

    // $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$_POST['newparent_id']);
    $row = $db->queryGetRow(
        "nested_tree",
        array(
            "title"
        ),
        array(
            "id" => $_POST['newparent_id']
        )
    );
    //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type = 'complex' AND intitule = '".$id[1]."'");
    $tmp = $db->queryCount(
        "misc",
        array(
            "intitule" => $id[1],
            "type" => "complex"
        )
    );
                //$data = $db->fetchRow(
                //    "SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'"
                //);
                $data = $db->queryCount(
                    "nested_tree",
                    array(
                        "title" => addslashes($title)
                    )
                // $data = $db->fetchRow("SELECT personal_folder FROM ".$pre."nested_tree WHERE id = '".$parentId."'");
                $row = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "personal_folder"
                    ),
                    array(
                        "id" => intval($parentId)
                    )
                );
                /*$data = $db->fetchRow(
                );*/
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "id",
                        "title"
                    ),
                    array(
                        "title" => addslashes($title)
                    )
            // $data = $db->fetchRow("SELECT authorized FROM ".$pre."rights WHERE tree_id = '".$val[0]."' AND fonction_id= '".$val[1]."'");
            $data = $db->queryGetRow(
                "rights",
                array(
                    "authorized"
                ),
                array(
                    "tree_id" => intval($val[0]),
                    "fonction_id" => intval($val[1])
                )
            );
        // $data_fld = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$_POST['folder']."'");
        $data_fld = $db->queryGetRow(
            "nested_tree",
            array(
                "title"
            ),
            array(
                "id" => intval($_POST['folder'])
            )
        );
                    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE nlevel = ".($folderLevel+$startPathLevel)." AND title = \"".$fold."\" AND parent_id = ".$parent_id);
                    $data = $db->queryCount(
                        "nested_tree",
                        array(
                            "nlevel" => intval($folderLevel+$startPathLevel),
                            "title" => $fold,
                            "parent_id" => intval(parent_id)
                        )
                    );
                        // $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE nlevel = '".($folderLevel+$startPathLevel)."' AND title = '".$fold."' AND parent_id = '".$parent_id."'");
                        $row = $db->queryGetRow(
                            "nested_tree",
                            array(
                                "id"
                            ),
                            array(
                                "nlevel" => intval($folderLevel+$startPathLevel),
                                "title" => $fold,
                                "parent_id" => intval($parent_id)
                            )
                        );
                    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE id_tree = '".$foldersArray[$item[1]]['id']."' AND label = \"".$item[2]."\"");
                    $data = $db->queryCount(
                        "items",
                        array(
                            "id_tree" => intval($foldersArray[$item[1]]['id']),
                            "label" => $item[2]
                        )
                    );
                        // $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$folderId."'");
                        $data = $db->queryGetRow(
                            "nested_tree",
                            array(
                                "title"
                            ),
                            array(
                                "id" => intval($folderId)
                            )
                        );
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "home")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    //include 'error.php';
    exit();
}

                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE label = '".addslashes($label)."' AND inactif=0");
                $data = $db->queryCount(
                    "items",
                    array(
                        "label" => addslashes($label),
                        "inactif" => "0"
                    )
                );
                                    WHERE i.field_id = '".intval($field_data[0])."'
                                    AND i.item_id=".intval($dataReceived['id'])
                        //$dataTmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."automatic_del WHERE item_id = '".$dataReceived['id']."'");
                        $dataTmp = $db->queryCount(
                            "automatic_del",
                            array(
                                "item_id" => $dataReceived['id']
                            )
                        );
            //$dataDeleted = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_delete'");
            //$dataRestored = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_restored'");
            $dataDeleted = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $_POST['id'],
                     "action" => "at_delete"
                )
            );
            $dataRestored = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $_POST['id'],
                     "action" => "at_restored"
                )
            );
        	    "SELECT *
                // $data = $db->fetchRow("SELECT id, title FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'");
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "title",
                        "id"
                    ),
                    array(
                        "title" => addslashes($title)
                    )
                );
            /*$tmp = $db->fetchRow(
            );*/
            $tmp = $db->queryGetRow(
                "nested_tree",
                array(
                    "title",
                    "parent_id",
                    "personal_folder"
                ),
                array(
                    "id" => intval($dataReceived['folder'])
                )
                //$data_count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif = 0");
                $data_count = $db->queryCount(
                    "items",
                    array(
                        "inactif" => "0"
                    )
                );
                $whereArg = " AND i.id_tree=".intval($_POST['id']);
                // $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");//echo ">".$dataTmp[0];
                $dataTmp = $db->queryGetRow(
                    "items_edition",
                    array(
                        "timestamp",
                        "user_id"
                    ),
                    array(
                        "item_id" => intval($_POST['item_id'])
                    )
                );
                    // $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");
                    $dataTmp = $db->queryGetRow(
                        "items_edition",
                        array(
                            "timestamp",
                            "user_id"
                        ),
                        array(
                            "item_id" => intval($_POST['item_id'])
                        )
                    );
            // $data = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type='complex' AND intitule = '".$_POST['groupe']."'");
            $data = $db->queryGetRow(
                "misc",
                array(
                    "valeur"
                ),
                array(
                    "intitule" => $_POST['groupe'],
                    "type" => "complex"
                )
            );
            // $data = $db->fetchRow("SELECT name,id_item,file FROM ".$pre."files WHERE id = '".$_POST['file_id']."'");
            $data = $db->queryGetRow(
                "files",
                array(
                    "name",
                    "id_item",
                    "file"
                ),
                array(
                    "id" => intval($_POST['file_id'])
                )
            );
            // $data = $db->fetchRow("SELECT date FROM ".$pre."log_items WHERE action = 'at_modification' AND id_item = '".$_POST['item_id']."' ORDER BY date DESC");
            $data = $db->queryGetRow(
                "log_items",
                array(
                    "date"
                ),
                array(
                    "action" => "at_modification",
                    "id_item" => intval($_POST['item_id'])
                ),
                " ORDER BY date DESC"
            );
    // $data = $db->fetchRow("SELECT bloquer_creation,bloquer_modification,personal_folder FROM ".$pre."nested_tree WHERE id = '".$groupe."'");
    $data = $db->queryGetRow(
        "nested_tree",
        array(
            "bloquer_creation",
            "bloquer_modification",
            "personal_folder"
        ),
        array(
            "id" => intval($groupe)
        )
    );
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
        || !isset($_SESSION['settings']['enable_kb'])
        || $_SESSION['settings']['enable_kb'] != 1)
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "kb")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

                $ret = $db->queryGetArray(
                    "kb",
                    array(
                        "anyone_can_modify",
                        "author_id"
                    ),
                    array(
                        "id" => intval($id)
                    )
                );
                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."kb_categories WHERE category = '".mysql_real_escape_string($category)."'");
                $data = $db->queryCount(
                    "kb_categories",
                    array(
                        "category" => $category
                    )
                );
            $ret = $db->queryGetArray(
                array(
                    "kb" => "k"
                ),
                array(
                    "k.id" => "id",
                    "k.label" => "label",
                    "k.description" => "description",
                    "k.category_id" => "category_id",
                    "k.author_id" => "author_id",
                    "k.anyone_can_modify" => "anyone_can_modify",
                    "u.login" => "login",
                    "c.category" => "category"
                ),
                array(
                    "k.id" => intval($_POST['id'])
                ),
                "",
                array(
                    "kb_categories AS c" => "(c.id = k.category_id)",
                    "users AS u" => "(u.id = k.author_id)"
                )
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}


        // $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $pf = $db->queryGetRow(
            "nested_tree",
            array(
                "id"
            ),
            array(
                "title" => $_SESSION['user_id']
            )
        );
        // $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $pf = $db->queryGetRow(
            "nested_tree",
            array(
                "id"
            ),
            array(
                "title" => intval($_SESSION['user_id'])
            )
        );
        /*$sql = "SELECT label, description, id_tree, perso, restricted_to, login
        $data = $db->fetchArray($row);*/
        $ret = $db->queryGetArray(
            "items",
            array(
                "label",
                "description",
                "id_tree",
                "perso",
                "restricted_to",
                "login"
            ),
            array(
                "id" => intval($id)
            )
        );
        $itemTags = $db->fetchAllArray("SELECT tag FROM ".$pre."tags WHERE item_id=".intval($id));
            "id='".intval($id)."'"
        /*$sql = "SELECT i.label, i.description, i.id_tree as id_tree, i.perso, i.restricted_to, i.id, i.login
        $data = $db->fetchArray($row);*/
        $data = $db->queryGetArray(
            array(
                "items" => "i"
            ),
            array(
                "i.label" => "label",
                "i.description" => "description",
                "i.id_tree" => id_tree,
                "i.perso" => "perso",
                "i.restricted_to" => "restricted_to",
                "i.login" => "login",
                "i.id" => "id"
            ),
            array(
                "i.id" => intval($id),
                "l.action" => "at_creation"
            ),
            "",
            array(
                "log_items as l" => "(l.id_item = i.id)"
            )
        );
 * @author        Nils LaumaillÃ©
 * @copyright     (c) 2009-2014 Nils LaumaillÃ©
            // $row = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id=".$dataReceived['user_id']);
            $row = $db->queryGetRow(
                "users",
                array(
                    "email"
                ),
                array(
                    "id" => intval($dataReceived['user_id'])
                )
            );
        $data = $db->queryCount(
            "users",
            array(
                "email" => mysql_real_escape_string(stripslashes($_POST['email']))
            )
            "&login=".mysql_real_escape_string($_POST['login'])."\">".$_SESSION['settings']['cpassman_url'].
            "/index.php?action=password_recovery&key=".$key."&login=".mysql_real_escape_string($_POST['login'])."</a>.<br><br>".$txt['thku'];
        $textMailAlt = $txt['forgot_pw_email_altbody_1']." ".$txt['at_login']." : ".mysql_real_escape_string($_POST['login'])." - ".
                mysql_real_escape_string(stripslashes($_POST['email']))."'"
            //$data = $db->fetchRow(
            //    "SELECT COUNT(*) FROM ".$pre."misc WHERE intitule = '".
            //    mysql_real_escape_string($_POST['login'])."' AND type = 'password_recovery'"
            //);
            $data = $db->queryCount(
                "misc",
                array(
                    "intitule" => $_POST['login'],
                    "type" => "password_recovery"
                )
                            'intitule' => mysql_real_escape_string($_POST['login'])
                            'intitule' => mysql_real_escape_string($_POST['login']),
        // decrypt and retreive data in JSON format
        $dataReceived = prepareExchangedData($_POST['data'], "decode");
        // Prepare variables
        $login = htmlspecialchars_decode($dataReceived['login']);
        $key = htmlspecialchars_decode($dataReceived['key']);
        /*$data = $db->fetchRow(
            mysql_real_escape_string($login)."' AND type = 'password_recovery'"
        );*/
        $data = $db->queryGetRow(
            "misc",
            array(
                "valeur"
            ),
            array(
                "type" => "password_recovery",
                "intitule" => $login
            )
        if ($key == $data[0]) {
                "login = '".mysql_real_escape_string($login)."'"
                    'intitule' => mysql_real_escape_string($login),
            $dataUser = $db->queryFirst("SELECT email FROM ".$pre."users WHERE login = '".mysql_real_escape_string($login)."'");
            // decrypt and retreive data in JSON format
            $dataReceived = prepareExchangedData($_POST['data'], "decode");
            // Prepare variables
            $language = $dataReceived['lang'];
                    'user_language' => $language
            $_SESSION['user_language'] = $language;
            $_SESSION['user_language'] = $language;
    	if ($_POST['size'] > $_SESSION['settings']['pwd_maximum_length']) {
    		echo prepareExchangedData(
	    		array(
		    		"error_msg" => "Password length is too long!",
		    		"error" => "true"
	    		),
	    		"encode"
    		);
    		break;
    	}

    	$pwgen->setLength($_POST['size']);
    	if (isset($_POST['secure']) && $_POST['secure'] == "true") {
    		$pwgen->setSecure(true);
    		$pwgen->setSymbols(true);
    		$pwgen->setCapitalize(true);
    		$pwgen->setNumerals(true);
    	} else {
    		$pwgen->setSecure(($_POST['secure'] == "true")? true : false);
    		$pwgen->setNumerals(($_POST['numerals'] == "true")? true : false);
    		$pwgen->setCapitalize(($_POST['capitalize'] == "true")? true : false);
    		$pwgen->setSymbols(($_POST['symbols'] == "true")? true : false);
    	}

        echo prepareExchangedData(
        	array(
	        	"key" => $pwgen->generate(),
	        	"error" => ""
        	),
        	"encode"
        );
        /*$sql = "SELECT * FROM ".$pre."users WHERE login = '".addslashes($_POST['userId'])."'";
        $data = $db->fetchArray($row);*/
        $data = $db->queryGetArray(
            "users",
            array(
                "login",
                "psk"
            ),
            array(
                "login" => $_POST['userId']
            )
        );
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_roles")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".mysql_real_escape_string(stripslashes($_POST['name']))."'");
            $tmp = $db->queryCount(
                "roles_title",
                array(
                    "title" => stripslashes($_POST['name'])
                )
            );
            //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE id != '".$_POST['id']."' AND title = '".mysql_real_escape_string(stripslashes($_POST['title']))."'");
            $tmp = $db->queryCount(
                "roles_title",
                array(
                    "title" => stripslashes($_POST['title']),
                    "id" => intval($_POST['id'])
                )
            );
                        //$count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_values WHERE folder_id = ".$node->id." AND role_id = ".$role);
                        $count = $db->queryCount(
                            "roles_values",
                            array(
                                "folder_id" => intval($node->id),
                                "role_id" => intval($role)
                            )
                        );
if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
) {
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "items")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    handleError('Not allowed to ...', 110);
    exit();
}

if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
) {
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "items")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    handleError('Not allowed to ...', 110);
    exit();
}

 * @link		http://www.teampass.net
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_users")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            // $data = $db->fetchRow("SELECT ".$_POST['type']." FROM ".$pre."users WHERE id = ".$val[0]);
            $data = $db->queryGetRow(
                "users",
                array(
                    $_POST['type']
                ),
                array(
                    "id" => intval($val[0])
                )
            );
            // $data = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = $val[0]");
            $data = $db->queryGetRow(
                "users",
                array(
                    "fonction_id"
                ),
                array(
                    "id" => intval($val[0])
                )
            );
                // $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_POST['id']."' AND personal_folder = 1");    // Get personal folder ID
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "id"
                    ),
                    array(
                        "title" => intval($_POST['id']),
                        "personal_folder" => "1"
                    )
                );
            // $data = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id = '".$_POST['id']."'");
            $data = $db->queryGetRow(
                "users",
                array(
                    "email"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data = $db->queryGetRow(
                "users",
                array(
                    "fonction_id"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT groupes_visibles FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->queryGetRow(
                "users",
                array(
                    "groupes_visibles"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT groupes_interdits FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->queryGetRow(
                "users",
                array(
                    "groupes_interdits"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$_POST['domain']."' AND parent_id = 0");
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "title" => $_POST['domain'],
                    "parent_id" => "0"
                )
            );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".$_POST['domain']."'");
            $data = $db->queryCount(
                "roles_title",
                array(
                    "title" => $_POST['domain']
                )
            );
                    WHERE l.id_user = ".intval($_POST['id'].$sql_filter)
                    WHERE l.id_user = ".intval($_POST['id'].$sql_filter)."
                    LIMIT ".intval($start).",".intval($_POST['nb_items_by_page'])
                //$data = $db->fetchRow(
                //    "SELECT COUNT(*)
                //    FROM ".$pre."log_system
                //    WHERE type = 'user_mngt' AND field_1=".$_POST['id']
                //);
                $data = $db->queryCount(
                    "log_system",
                    array(
                        "type" => "user_mngt",
                        "field_1" => $_POST['id']
                    )
                $admin_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".intval($_SESSION['user_id'])."' AND personal_folder = 1");
                $user_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".intval($user_id)."' AND personal_folder = 1");
                        WHERE l.action = 'at_creation' AND i.perso=1 AND i.id_tree=".intval($folder->id)
                    "id = ".intval($_POST['user_id'])
                    "id = ".intval($reccord['id'])
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            WHERE l.action = 'at_shown'".mysql_real_escape_string($sqlFilter)
            WHERE l.action = 'at_copy'".mysql_real_escape_string($sqlFilter)
            WHERE i.label LIKE '%".mysql_real_escape_string($_POST['filter'])."%'"
            WHERE l.type = 'admin_action'".mysql_real_escape_string($sqlFilter)
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                            numerals   : true
                        	data = prepareExchangedData(data, "decode");
                        	if (data.error == "true") {
                        		$("#div_dialog_message_text").html(data.error_msg);
                        		$("#div_dialog_message").dialog("open");
                        	} else {
                        		$("#change_user_pw_newpw_confirm, #change_user_pw_newpw").val(pw);
                        		$("#change_user_pw_newpw").focus();
                        	}
        "sources/main.queries.php",
            type    : "generate_a_password",
        	data = prepareExchangedData(data, "decode");
        	if (data.error == "true") {
        		$("#div_dialog_message_text").html(data.error_msg);
        		$("#div_dialog_message").dialog("open");
        	} else {
        		$("#"+elem).val(data.key).focus();
        	}
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

 * @author        Nils LaumaillÃ©
 * @copyright     (c) 2009-2014 Nils LaumaillÃ©
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
    !isset($_SESSION['key']) || empty($_SESSION['key']))
{
/* do checks */
include $_SESSION['settings']['cpassman_dir'].'/includes/include.php';
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}