mazay / pure-ftpd-webui Goto Github PK

Greetings!

index.php, which resembles the "users activity monitor" page uses "sudo /etc/init.d/pure-ftpd-mysql status" shell_exec to get array of uesrs. It's not only bad idea to use sudo, but this also returns only status of service, not an active connections list. Is it me or this is underwritten?

            $result = shell_exec("sudo $pureftpd_init_script_path status");
            $array = explode("\n", $result);
            foreach ($array as $users) {
            if (($users != "") and (substr($users, 0, 3) != "+--") and (substr($users, 2, 3) != "PID")) {
            list ($tmp, $pid, $user, $speed, $stat, $file) = explode("|", $users);

            echo("          <tr>
                                            <td class='center'>$user</td>
                                            <td class='center'>$speed</td>
                                            <td class='center'>$stat</td>
                                            <td>$file</td>
                                    </tr>");}}

in the current (2013/12) version of debian wheezy, pure-ftpd uses the "users" as the default table for the selecting the credentials. Also default it awaits a crypt encoded password and not md5.

Its worth mentioning in your README.

thx for your effort in writing this.
Thomas

Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead

Hi,

I found some coding problems from pure-ftpd-webuis code.

• Don't use russian as comment language, for rest of us it's impossible to understand comments, if they are not written in english.
• Don't use shorthand PHP-tags. Your code won't work on all platforms if eg. "<?", use just "<?php".
• Also, don't ever use variables directly inside translations! Use tokens that are replaced before printing. Using variables causes a punch of "Notice: Undefined index" warnings and you can't change values after translation is included (otherwise than including it again)!
• And do "isset($variable)" checks for all $_POST / etc., eg. in edit-user.php line 73 should be "isset($_POST['add_user'])" not just "$_POST['add_user']".
• And as last not, use "$_SERVER['PHP_SELF']" instead of "$PHPSELF".