<?php
 $pathDB = "../dbcenter/"; $pathAuth = "./"; $pathRSA = "../../slibrary/_rsa/"; $pathZklib = "../../slibrary/zklib/"; if (isset($_REQUEST['sds'])) { if ($_REQUEST['sds'] == 1) { $pathRSA = "../../slibrary_desk/_rsa"; $pathZklib = "../../slibrary_desk/zklib/"; } } $folderDB = "swkey/srh/"; $folderRSA = "swkey/_rsa/"; $serverList = array("silicaweb.ao", "www.silicaweb.ao", "sepasza.ao", "www.sepasza.ao", "cefac-huambo.ao", "www.cefac-huambo.ao", "itps-am.ao", "www.itps-am.ao", "cefac.ao", "www.cefac.ao", "suniv.ao", "www.suniv.ao", "silicaschool.com", "www.silicaschool.com", "silicaerp.com", "www.silicaerp.com"); $host = preg_replace('/^www\./i', '', $_SERVER['HTTP_HOST']); if (($host == "gme.ao") || ($host == "www.gme.ao")) { $pathDB = "../../../../" . $folderDB; $pathAuth = $pathDB; $pathRSA = "../../../../" . $folderRSA; } elseif (in_array($host, $serverList)) { $pathDB = "../../../" . $folderDB; $pathAuth = $pathDB; $pathRSA = "../../../" . $folderRSA; } $fList = array(); $fList[0] = "login_x"; $fList[1] = "menu_x"; $fList[2] = "initialPage_x"; $fList[3] = "systemuser_x"; $fList[4] = "company_x"; $fList[5] = "crud_x"; $fList[6] = "department_x"; $fList[7] = "employee_x"; $fList[8] = "workschedule_x"; $fList[9] = "pointcontrol_x"; $fList[10] = "upload_temp_file"; $fList[11] = "vacation_x"; $fList[12] = "payroll_x"; $fList[13] = "activityextra_x"; $fList[14] = "reviewdb_x"; $location = "./"; $dbList = array(); $dbList[0] = "_dblogin"; $dbList[3] = "_dbsystemuser"; $dbList[4] = "_dbcompany"; $dbList[5] = "_dbcrud"; $dbList[6] = "_dbdepartment"; $dbList[7] = "_dbemployee"; $dbList[8] = "_dbworkschedule"; $dbList[9] = "_dbpointcontrol"; $dbList[11] = "_dbvacation"; $dbList[12] = "_dbpayroll"; $dbList[13] = "_dbactivityextra"; $dbList[14] = "_dbreviewdb"; setTimeZoneToLuanda(); if ($_SERVER["REQUEST_METHOD"] == "POST") { if (isset($_REQUEST['f'])) { if (isset($_REQUEST['sdcompvers'])) { $pathDB = "../dbcenter_" . $_REQUEST['sdcompvers'] . "/"; $pathRSA .= "_" . $_REQUEST['sdcompvers'] . "/"; } $rsaGenFile = $pathRSA . '_rsaCryptGeneral.php'; $common = './_commonFunctions.php'; $mailing = './mailing.php'; $authFile = $pathAuth . '_authentication_common.php'; $db0File = $pathDB . $dbList[0] . ".php"; $dbFile = $pathDB . $dbList[$_REQUEST['f']] . ".php"; $reqFile = $pathDB . $fList[$_REQUEST['f']] . ".php"; $dbSchemFile = $pathDB . "_dbschem_srh.php"; $permFile = $pathDB . "_userPermission_srh.php"; $data = file_get_contents("php://input"); $arData = json_decode($data, true); include_once $pathZklib . "ZKLib.php"; if (isset($_REQUEST['sds'])) { if ($_REQUEST['sds'] == 1) { if (isset($arData["sdk"])) { $key = base64_decode(str_replace(" ", "+", $arData['sdk'])); $content = safeDecrypt(file_get_contents($rsaGenFile), $key); $content .= safeDecrypt(file_get_contents($common), $key); $content .= safeDecrypt(file_get_contents($mailing), $key); $content .= safeDecrypt(file_get_contents($authFile), $key); $content .= safeDecrypt(file_get_contents($db0File), $key); if ($_REQUEST['f'] > 0) { $content .= safeDecrypt(file_get_contents($dbFile), $key); if ($_REQUEST['f'] == 14) { $content .= safeDecrypt(file_get_contents($dbSchemFile), $key); $content .= safeDecrypt(file_get_contents($permFile), $key); } } $content .= safeDecrypt(file_get_contents($reqFile), $key); $content = str_replace("?>", "", str_replace("<?php", "", $content)); eval($content); exit(); } } } include_once $rsaGenFile; include_once $common; include_once $mailing; include_once $authFile; include_once $db0File; if ($_REQUEST['f'] > 0) { include_once $dbFile; if ($_REQUEST['f'] == 14) { include_once $dbSchemFile; include_once $permFile; } } include_once $reqFile; } } function safeDecrypt($encrypted, $key) { $decoded = base64_decode($encrypted); if ($decoded === false) { throw new Exception('Scream bloody murder, the encoding failed'); } if (mb_strlen($decoded, '8bit') < (SODIUM_CRYPTO_SECRETBOX_NONCEBYTES + SODIUM_CRYPTO_SECRETBOX_MACBYTES)) { throw new Exception('Scream bloody murder, the message was truncated'); } $nonce = mb_substr($decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '8bit'); $ciphertext = mb_substr($decoded, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, null, '8bit'); $plain = sodium_crypto_secretbox_open( $ciphertext, $nonce, $key ); if ($plain === false) { throw new Exception('the message was tampered with in transit'); } sodium_memzero($ciphertext); sodium_memzero($key); return $plain; } function setTimeZoneToLuanda() { $luandaTZ = "Africa/Luanda"; $currTZ = date_default_timezone_get(); if ($currTZ != $luandaTZ) { $currH = date("H"); $timeZone = new DateTimeZone($luandaTZ); $dateTime = new DateTime('now'); $dateTime->setTimezone($timeZone); $luandaH = $dateTime->format('H'); if ($currH != $luandaH) { date_default_timezone_set($luandaTZ); } } } 