From 1b238bce967bb0c5e6bb94e840f8d20bb23decbf Mon Sep 17 00:00:00 2001
From: kkalev <kkalev>
Date: Mon, 20 Oct 2003 16:39:38 +0000
Subject: [PATCH] * Add a captions.conf file with a few configurable captions
 for now * Move the nas list to a separate file called naslist.conf * Add the
 ability to include configuration files in admin.conf * Add a page for
 clearing open sessions from the database called clear_opensessions.php3. Add
 it in the   user toolbar * Move the userinfo page of user_admin to a separate
 file so that it can be easily changed to   fit per installation needs * Add a
 conf/accounting.attrs allowing the customization of the attributes in the
 user_accounting,   user_finger and failed_logins pages * Add a directive to
 determine if the administrator will be able to change the user password from 
  the user edit page * Call mysql_escape_string before running the sql query *
 Use the sql_connect_timeout for the mysql driver * Add a help page for the
 badusers table * Also take the Session-Timeout in consideration when
 calcualting the remaining time in user_admin.php3 * Add regex matching in
 log_badlogins and don't expect the callerid to always be in numeric format

With these changes dialupadmin can probably be used for administrating other radius based services
apart from dialup
Hope everything works
---
 Changelog                            |  17 ++++
 bin/log_badlogins                    |  13 ++-
 conf/accounting.attrs                |  20 +++++
 conf/admin.conf                      |  34 +++-----
 conf/captions.conf                   |   1 +
 conf/config.php3                     |  24 +++++-
 conf/naslist.conf                    |  25 ++++++
 htdocs/accounting.php3               |   2 +
 htdocs/clear_opensessions.php3       | 120 +++++++++++++++++++++++++++
 htdocs/failed_logins.php3            |  19 +++--
 htdocs/help/badusers_help.html       |  36 ++++++++
 htdocs/help/expiration_help.html     |   4 +-
 htdocs/user_accounting.php3          |  55 +++++++-----
 htdocs/user_admin.php3               |   6 ++
 htdocs/user_edit.php3                |   6 +-
 htdocs/user_finger.php3              |  17 +++-
 html/user_admin.html.php3            |  69 ++-------------
 html/user_admin_userinfo.html.php3   |  29 +++++++
 html/user_toolbar.html.php3          |   6 ++
 lib/attrshow.php3                    |  23 +++++
 lib/sql/drivers/mysql/functions.php3 |   5 ++
 21 files changed, 409 insertions(+), 122 deletions(-)
 create mode 100644 conf/accounting.attrs
 create mode 100644 conf/captions.conf
 create mode 100644 conf/naslist.conf
 create mode 100644 htdocs/clear_opensessions.php3
 create mode 100644 htdocs/help/badusers_help.html
 create mode 100644 html/user_admin_userinfo.html.php3

diff --git a/Changelog b/Changelog
index 923b032..a098107 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,20 @@
+Ver 1.65:
+* Add a captions.conf file with a few configurable captions for now
+* Move the nas list to a separate file called naslist.conf
+* Add the ability to include configuration files in admin.conf
+* Add a page for clearing open sessions from the database called clear_opensessions.php3. Add it in the
+  user toolbar
+* Move the userinfo page of user_admin to a separate file so that it can be easily changed to
+  fit per installation needs
+* Add a conf/accounting.attrs allowing the customization of the attributes in the user_accounting,
+  user_finger and failed_logins pages
+* Add a directive to determine if the administrator will be able to change the user password from
+  the user edit page
+* Call mysql_escape_string before running the sql query
+* Use the sql_connect_timeout for the mysql driver
+* Add a help page for the badusers table
+* Also take the Session-Timeout in consideration when calcualting the remaining time in user_admin.php3
+* Add regex matching in log_badlogins and don't expect the callerid to always be in numeric format
 Ver 1.63:
 * Do an eval on the attribute description strings in the user_edit page. That will allow the login-time creation
   page to work properly.
diff --git a/bin/log_badlogins b/bin/log_badlogins
index d733acb..0b2cec3 100755
--- a/bin/log_badlogins
+++ b/bin/log_badlogins
@@ -23,6 +23,7 @@ $all_file=shift||'no';
 #
 # CHANGE THESE TO MATCH YOUR SETUP
 #
+#$regexp = 'from client localhost port 135|from client blabla ';
 $domain='company.com';
 $mysql='/usr/local/mysql/bin/mysql';
 $tmpfile='/var/tmp/mysql.input';
@@ -63,6 +64,7 @@ for(;;){
 	while(<LOG>){
 		$do=0;	
 		chomp;
+		next if ($regexp ne '' && !/$regexp/);
 		if ($_ ne ''){
 			$user = $nas = $port = $caller = '-';
 			if (/Login incorrect/){
@@ -98,11 +100,17 @@ for(;;){
 				$time = "$year-$mon-$mday $hour:$min:$sec";
 				if (/\[([\w\-\.\!\@\s]+?)\]\s+\(from (.+?)\)/){
 					$user = $1;
-					($nas,$port,$caller) = (split /\s+/,$2)[1,3,5];
+					($nas,$port) = (split /\s+/,$2)[1,3];
+					if ($2 =~ /cli (.+?)$/){
+						$caller = $1;
+					}
 				}
 				elsif (/\[([\w\-\.\!\@\s]+?)\/.+?\]\s+\(from (.+?)\)/){
 					$user = $1;
-					($nas,$port,$caller) = (split /\s+/,$2)[1,3,5];
+					($nas,$port) = (split /\s+/,$2)[1,3];
+					if ($2 =~ /cli (.+?)$/){
+						$caller = $1;
+					}
 				}
 				$caller='' if (!defined($caller));
 				$user =~s/[^\w\-\.\d\!\@\s]//g;
@@ -111,7 +119,6 @@ for(;;){
 					$nas .= ".$domain";
 				}
 				$port =~s/[^\d]//g;
-				$caller =~s/[^\d]//g;
 				$addr = gethostbyname $nas;
 				($a,$b,$c,$d)=unpack('C4',$addr);
 				$addr = "$a.$b.$c.$d";
diff --git a/conf/accounting.attrs b/conf/accounting.attrs
new file mode 100644
index 0000000..2ef30e3
--- /dev/null
+++ b/conf/accounting.attrs
@@ -0,0 +1,20 @@
+# Used by the User Accounting, the User finger and the Failed Logins page
+#
+# For the user finger page only callerid(9) and 
+# ip address(4) are applicable
+#
+# For the Failed Logins page only looged in(2), server(7), 
+# terminate cause(8) and callerid(9) are applicable
+#
+# attribute number		Description		Show in		Show in		Show in
+#							User Accounting	User Finger	Failed Logins
+#
+1				type			no		no		no
+2				logged in		yes		no		yes
+3				session time		yes		no		no
+4				ip address		no		yes		no
+5				upload			yes		no		no
+6				download		yes		no		no
+7				server			yes		no		yes
+8				terminate cause		yes		no		yes
+9				callerid		yes		yes		yes
diff --git a/conf/admin.conf b/conf/admin.conf
index c636265..831f160 100644
--- a/conf/admin.conf
+++ b/conf/admin.conf
@@ -58,9 +58,15 @@ general_realm_delimiter: @
 general_realm_format: suffix
 #
 
+#
+# Determines if the administrator will be able to change the user password through
+# the user edit page
+general_show_user_password: yes
+
 
 general_ldap_attrmap: %{general_radiusd_base_dir}/etc/raddb/ldap.attrmap
 general_sql_attrmap: %{general_base_dir}/conf/sql.attrmap
+general_accounting_attrs_file: %{general_base_dir}/conf/accounting.attrs
 general_extra_ldap_attrmap: %{general_base_dir}/conf/extra.ldap-attrmap
 #
 # it can be either ldap or sql
@@ -124,28 +130,9 @@ general_accounting_info_order: desc
 #
 general_stats_use_totacct: no
 
-nas1_name: nas1.%{general_domain}
-nas1_model: Cisco 2511 access server
-nas1_ip: 147.122.122.121
-nas1_port_num: 16
-nas1_community: public
-nas2_name: nas2.%{general_domain}
-nas2_model: Cisco 2511 access server
-nas2_ip: 147.122.122.123
-nas2_port_num: 16
-nas2_community: public
-#
-# finger type can also be set per NAS
-# snmp: Use snmp to query the NAS
-# database: Only query the sql database
-#
-# If it is not set, general_finger_type is assumed
-nas2_finger_type: database
-nas3_name: nas3.%{general_domain}
-nas3_model: Cisco 5300 access server
-nas3_ip: 147.122.122.124
-nas3_port_num: 210
-nas3_community: public
+INCLUDE: %{general_base_dir}/conf/naslist.conf
+
+INCLUDE: %{general_base_dir}/conf/captions.conf
 
 #
 # The ldap server to connect to.
@@ -255,7 +242,8 @@ sql_full_date_format: Y-m-d H:i:s
 #
 sql_row_limit: 40
 #
-# These options are used by the log_badlogins script
+# These options are used by the log_badlogins script and by the
+# mysql driver
 #
 # Set the sql connect timeout (secs)
 sql_connect_timeout: 3
diff --git a/conf/captions.conf b/conf/captions.conf
new file mode 100644
index 0000000..ea34571
--- /dev/null
+++ b/conf/captions.conf
@@ -0,0 +1 @@
+general_caption_finger_free_lines: free lines
diff --git a/conf/config.php3 b/conf/config.php3
index dd6a885..eb8ccce 100644
--- a/conf/config.php3
+++ b/conf/config.php3
@@ -15,6 +15,7 @@ if ($use_session){
 }
 if (!isset($config)){
 	$ARR=file("../conf/admin.conf");
+	$EXTRA_ARR = array();
 	foreach($ARR as $val) {
 		$val=chop($val);
 		if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val))
@@ -24,7 +25,28 @@ if (!isset($config)){
 			$val=$config[$matches[1]];
 			$v=preg_replace("/%\{$matches[1]\}/",$val,$v);
 		}
-		$config["$key"]="$v";
+		if ($key == 'INCLUDE'){
+			if (is_readable($v))
+				array_push($EXTRA_ARR,file($v));
+			else
+				echo "<b>Error: File '$v' does not exist or is not readable</b><br>\n";
+		}
+		else
+			$config["$key"]="$v";
+	}
+	foreach($EXTRA_ARR as $val1) {
+		foreach($val1 as $val){
+			$val=chop($val);
+			if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val))
+				continue;
+			list($key,$v)=split(":[[:space:]]*",$val,2);
+			if (preg_match("/%\{(.+)\}/",$v,$matches)){
+				$val=$config[$matches[1]];
+				$v=preg_replace("/%\{$matches[1]\}/",$val,$v);
+			}
+			else
+				$config["$key"]="$v";
+		}
 	}
 	if ($use_session)
 		session_register('config');
diff --git a/conf/naslist.conf b/conf/naslist.conf
new file mode 100644
index 0000000..93d4f59
--- /dev/null
+++ b/conf/naslist.conf
@@ -0,0 +1,25 @@
+#
+# This file contains the NAS list
+#
+nas1_name: nas1.%{general_domain}
+nas1_model: Cisco 2511 access server
+nas1_ip: 147.122.122.121
+nas1_port_num: 16
+nas1_community: public
+nas2_name: nas2.%{general_domain}
+nas2_model: Cisco 2511 access server
+nas2_ip: 147.122.122.123
+nas2_port_num: 16
+nas2_community: public
+#
+# finger type can also be set per NAS
+# snmp: Use snmp to query the NAS
+# database: Only query the sql database
+#
+# If it is not set, general_finger_type is assumed
+nas2_finger_type: database
+nas3_name: nas3.%{general_domain}
+nas3_model: Cisco 5300 access server
+nas3_ip: 147.122.122.124
+nas3_port_num: 210
+nas3_community: public
diff --git a/htdocs/accounting.php3 b/htdocs/accounting.php3
index 33f2cd0..49c43a2 100644
--- a/htdocs/accounting.php3
+++ b/htdocs/accounting.php3
@@ -32,6 +32,8 @@ $no_fields = @da_sql_num_fields($fields,$config);
 for($i=0;$i<$no_fields;$i++){
 	$key = @da_sql_field_name($fields,$i,$config);
 	$val = $sql_attrs[$key][desc];
+	if ($val == '')
+		continue;
 	$show = $sql_attrs[$key][show];
 	$selected[$key] = ($show == 'yes') ? 'selected' : '';
 	$items[$key] = "$val";
diff --git a/htdocs/clear_opensessions.php3 b/htdocs/clear_opensessions.php3
new file mode 100644
index 0000000..79d3958
--- /dev/null
+++ b/htdocs/clear_opensessions.php3
@@ -0,0 +1,120 @@
+<?php
+require('../conf/config.php3');
+if (is_file("../lib/sql/drivers/$config[sql_type]/functions.php3"))
+	include_once("../lib/sql/drivers/$config[sql_type]/functions.php3");
+else{
+	echo <<<EOM
+<title>Clear Open User Sessions for $login</title>
+<meta http-equiv="Content-Type" content="text/html; charset=$config[general_charset]">
+<link rel="stylesheet" href="style.css">
+</head>
+<body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black">
+<center>
+<b>Could not include SQL library functions. Aborting</b>
+</body>
+</html>
+EOM;
+        exit();
+}
+
+echo <<<EOM
+<html>
+<head>
+<title>Clear Open User Sessions for $login</title>
+<meta http-equiv="Content-Type" content="text/html; charset=$config[general_charset]">
+<link rel="stylesheet" href="style.css">
+</head>
+<body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black">
+<center>
+<table border=0 width=550 cellpadding=0 cellspacing=0>
+<tr valign=top>
+<td align=center><img src="images/title2.gif"></td>
+</tr>
+</table>
+
+<table border=0 width=400 cellpadding=0 cellspacing=2>
+EOM;
+
+include("../html/user_toolbar.html.php3");
+
+$open_sessions = 0;
+
+print <<<EOM
+</table>
+
+<br>
+<table border=0 width=540 cellpadding=1 cellspacing=1>
+<tr valign=top>
+<td width=340></td>
+<td bgcolor="black" width=200>
+	<table border=0 width=100% cellpadding=2 cellspacing=0>
+	<tr bgcolor="#907030" align=right valign=top><th>
+	<font color="white">Clear open sessions for $login</font>&nbsp;
+	</th></tr>
+	</table>
+</td></tr>
+<tr bgcolor="black" valign=top><td colspan=2>
+	<table border=0 width=100% cellpadding=12 cellspacing=0 bgcolor="#ffffd0" valign=top>
+	<tr><td>
+EOM;
+   
+if ($clear_sessions == 1){
+	$link = @da_sql_pconnect($config);
+	if ($link){
+		$res = @da_sql_query($link,$config,
+		"DELETE FROM $config[sql_accounting_table]
+		WHERE UserName='$login' AND AcctStopTime = 0;");
+		if ($res)
+			echo "<b>Deleted open sessions from accounting table</b><br>\n";
+		else
+			echo "<b>Error deleting open sessions for user" . da_sql_error($link,$config) . "</b><br>\n";
+        }
+	else
+		echo "<b>Could not connect to SQL database</b><br>\n";
+	echo <<<EOM
+</td></tr>
+</table>
+</tr>
+</table>
+</body>
+</html>
+EOM;
+	exit();
+}
+else{
+	$link = @da_sql_pconnect($config);
+	if ($link){
+		$search = @da_sql_query($link,$config,
+		"SELECT COUNT(*) FROM $config[sql_accounting_table]
+		WHERE UserName = '$login' AND AcctStopTime IS NULL;");
+		if ($search){
+			if ($row = @da_sql_fetch_array($search,$config))
+				$open_sessions = $row['COUNT(*)'];
+		}
+		else
+			echo "<b>Database query failed: " . da_sql_error($link,$config) . "</b><br>\n";
+        }
+	else
+		echo "<b>Could not connect to SQL database</b><br>\n";
+}
+?>
+   <form method=post>
+      <input type=hidden name=login value=<?php print $login ?>>
+      <input type=hidden name=clear_sessions value="0">
+	<table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top>
+<tr>
+<td align=center>
+User <?php echo $login; ?> has <i><?php echo $open_sessions; ?></i> open sessions<br><br>
+Are you sure you want to clear all open user sessions?
+</td>
+</tr>
+	</table>
+<br>
+<input type=submit class=button value="Yes Clear" OnClick="this.form.clear_sessions.value=1">
+</form>
+</td></tr>
+</table>
+</tr>
+</table>
+</body>
+</html>
diff --git a/htdocs/failed_logins.php3 b/htdocs/failed_logins.php3
index 1e6f8e2..b3cfc1e 100644
--- a/htdocs/failed_logins.php3
+++ b/htdocs/failed_logins.php3
@@ -1,5 +1,6 @@
 <?php
 require('../conf/config.php3');
+require('../lib/attrshow.php3');
 ?>
 <html>
 <?php
@@ -78,7 +79,13 @@ EOM;
 <p>
 	<table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top>
 	<tr bgcolor="#d0ddb0">
-	<th>#</th><th>login</th><th>time</th><th>server</th><th>terminate cause</th><th>callerid</th>
+	<th>#</th><th>login</th>
+<?php
+if ($acct_attrs['fl'][2] != '') echo "<th>" . $acct_attrs['fl'][2] . "</th>\n";
+if ($acct_attrs['fl'][7] != '') echo "<th>" . $acct_attrs['fl'][7] . "</th>\n";
+if ($acct_attrs['fl'][8] != '') echo "<th>" . $acct_attrs['fl'][8] . "</th>\n";
+if ($acct_attrs['fl'][9] != '') echo "<th>" . $acct_attrs['fl'][9] . "</th>\n";
+?>
 	</tr>
 
 <?php
@@ -128,12 +135,12 @@ if ($link){
 			<tr align=center bgcolor="white">
 				<td>$num</td>
 				<td>$acct_login</td>
-				<td>$acct_time</td>
-				<td>$acct_server</td>
-				<td>$acct_terminate_cause</td>
-				<td>$acct_callerid</td>
-			</tr>
 EOM;
+				if ($acct_attrs['fl'][2] != '') echo "<td>$acct_time</td>\n";
+				if ($acct_attrs['fl'][2] != '') echo "<td>$acct_server</td>\n";
+				if ($acct_attrs['fl'][2] != '') echo "<td>$acct_terminate_cause</td>\n";
+				if ($acct_attrs['fl'][2] != '') echo "<td>$acct_callerid</td>\n";
+				echo "</tr>\n";
 		}
 	}
 	else
diff --git a/htdocs/help/badusers_help.html b/htdocs/help/badusers_help.html
new file mode 100644
index 0000000..eb64ebe
--- /dev/null
+++ b/htdocs/help/badusers_help.html
@@ -0,0 +1,36 @@
+<html>
+<head>
+<title>BADUSERS Help Page</title>
+<link rel="stylesheet" href="../style.css">
+</head>
+<body bgcolor="#80a040" background="../images/greenlines1.gif" link="black" alink="black">
+<center>
+<table border=0 width=540 cellpadding=1 cellspacing=1>
+<tr valign=top>
+<td width=340></td>
+<td bgcolor="black" width=400>
+	<table border=0 width=100% cellpadding=2 cellspacing=0>
+	<tr bgcolor="#907030" align=right valign=top><th><font color="white">Expiration Help Page</font>&nbsp;</th></tr>
+	</table>
+</td></tr>
+<tr bgcolor="black" valign=top><td colspan=2>
+	<table border=0 width=100% cellpadding=12 cellspacing=0 bgcolor="#ffffd0" valign=top>
+	<tr><td>
+<br>
+<center>
+<pre>
+The badusers table can be used to keep a history of unauthorized actions by
+certain users.
+To add a user to the badusers table you first have to insert a descriptive text
+in the 'Lock Message' attribute
+</pre>
+</td></tr>
+<tr><td align=center>
+<a href="javascript:window.close();"><b>Close Window</b></a>
+</td></tr>
+</center>
+</table>
+</tr>
+</table>
+</body>
+</html>
diff --git a/htdocs/help/expiration_help.html b/htdocs/help/expiration_help.html
index 7c033a4..2dfe030 100644
--- a/htdocs/help/expiration_help.html
+++ b/htdocs/help/expiration_help.html
@@ -20,8 +20,8 @@
 <center>
 <pre>
   This attribute can be used to set the user expiration date. It
-  should be in the format '$month_day $month_name $year' like:
-  '20 May 2002'
+  should be in the format "$month_day $month_name $year" like:
+  "20 May 2002"
 </pre>
 </td></tr>
 <tr><td align=center>
diff --git a/htdocs/user_accounting.php3 b/htdocs/user_accounting.php3
index 7fab2a1..43ff092 100644
--- a/htdocs/user_accounting.php3
+++ b/htdocs/user_accounting.php3
@@ -4,6 +4,7 @@ require('../conf/config.php3');
 <html>
 <?php
 require('../lib/functions.php3');
+require('../lib/attrshow.php3');
 
 if (is_file("../lib/sql/drivers/$config[sql_type]/functions.php3"))
 	include_once("../lib/sql/drivers/$config[sql_type]/functions.php3");
@@ -76,8 +77,13 @@ EOM;
 <p>
 	<table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top>
 	<tr bgcolor="#d0ddb0">
-	<th>#</th><th>type</th><th>logged in</th><th>session time</th><th>ip address</th>
-	<th>upload</th><th>download</th><th>server</th><th>terminate cause</th><th>callerid</th>
+	<th>#</th>
+<?php
+for($i=1;$i<=9;$i++){
+	if ($acct_attrs['ua']["$i"] != '')
+		echo "<th>" . $acct_attrs['ua']["$i"] . "</th>\n";
+}
+?>
 	</tr>
 
 <?php
@@ -135,17 +141,17 @@ if ($link){
 			echo <<<EOM
 			<tr align=center bgcolor="$tr_color">
 				<td>$num</td>
-				<td>$acct_type</td>
-				<td>$acct_logedin</td>
-				<td>$acct_sessiontime</td>
-				<td>$acct_ip</td>
-				<td>$acct_upload</td>
-				<td>$acct_download</td>
-				<td>$acct_server</td>
-				<td>$acct_terminate_cause</td>
-				<td>$acct_callerid</td>
-			</tr>
 EOM;
+				if ($acct_attrs[ua][1] != '') echo "<td>$acct_type</td>\n";
+				if ($acct_attrs[ua][2] != '') echo "<td>$acct_logedin</td>\n";
+				if ($acct_attrs[ua][3] != '') echo "<td>$acct_sessiontime</td>\n";
+				if ($acct_attrs[ua][4] != '') echo "<td>$acct_ip</td>\n";
+				if ($acct_attrs[ua][5] != '') echo "<td>$acct_upload</td>\n";
+				if ($acct_attrs[ua][6] != '') echo "<td>$acct_download</td>\n";
+				if ($acct_attrs[ua][7] != '') echo "<td>$acct_server</td>\n";
+				if ($acct_attrs[ua][8] != '') echo "<td>$acct_terminate_cause</td>\n";
+				if ($acct_attrs[ua][9] != '') echo "<td>$acct_callerid</td>\n";
+			echo "</tr>\n";
 		}
 		$acct_sessiontime_sum = time2str($acct_sessiontime_sum);
 		$acct_upload_sum = bytes2str($acct_upload_sum);
@@ -156,16 +162,23 @@ EOM;
 }
 else
 	echo "<b>Could not connect to SQL database</b><br>\n";
+$colspan = 3;
+if ($acct_attrs[ua][1] == '')
+	$colspan--;
+if ($acct_attrs[ua][2] == '')
+	$colspan--;
 echo <<<EOM
 			<tr bgcolor="lightyellow">
-			<td colspan=3 align="right">Page Total</td>
-				<td align="center"><b>$acct_sessiontime_sum</td>
-				<td>&nbsp;</td>
-				<td align="right" nowrap><b>$acct_upload_sum</td>
-				<td align="right" nowrap><b>$acct_download_sum</td>
-				<td>&nbsp;</td>
-				<td>&nbsp;</td>
-				<td>&nbsp;</td>
+			<td colspan=$colspan align="right">Page Total</td>
+EOM;
+				if ($acct_attrs[ua][3] != '') echo "<td align=\"center\"><b>$acct_sessiontime_sum</td>\n";
+				if ($acct_attrs[ua][4] != '') echo "<td>&nbsp;</td>\n";
+				if ($acct_attrs[ua][5] != '') echo "<td align=\"right\" nowrap><b>$acct_upload_sum</td>\n";
+				if ($acct_attrs[ua][6] != '') echo "<td align=\"right\" nowrap><b>$acct_download_sum</td>\n";
+				if ($acct_attrs[ua][7] != '') echo "<td>&nbsp;</td>\n";
+				if ($acct_attrs[ua][8] != '') echo "<td>&nbsp;</td>\n";
+				if ($acct_attrs[ua][9] != '') echo "<td>&nbsp;</td>\n";
+?>
 				</tr>
 	</table>
 <tr><td>
@@ -184,6 +197,8 @@ echo <<<EOM
 		<tr valign="bottom">
 			<td><small><b>user</td><td><small><b>from date</td><td><small><b>to date</td><td><small><b>pagesize</td><td><b>order</td>
 	<tr valign="middle"><td>
+<?php
+	echo <<<EOM
 <input type="text" name="login" size="11" value="$login"></td>
 <td><input type="text" name="prev_str" size="11" value="$prev_str"></td>
 <td><input type="text" name="now_str" size="11" value="$now_str"></td>
diff --git a/htdocs/user_admin.php3 b/htdocs/user_admin.php3
index 11e17c3..9fb972d 100644
--- a/htdocs/user_admin.php3
+++ b/htdocs/user_admin.php3
@@ -201,6 +201,12 @@ if ($link){
 		if ($monthly_limit != 'none' && !$tmp)
 			$monthly_used = "<font color=red>$monthly_used</font>";
 	}
+	if ($session_limit != 'none'){
+		if (!is_numeric($remaining))
+			$remaining = $session_limit;
+		if ($remaining > $session_limit)
+			$remaining = $session_limit;
+	}
 
 	$search = @da_sql_query($link,$config,
 	"SELECT * FROM $config[sql_accounting_table]
diff --git a/htdocs/user_edit.php3 b/htdocs/user_edit.php3
index 7f0253d..9f3bde3 100644
--- a/htdocs/user_edit.php3
+++ b/htdocs/user_edit.php3
@@ -77,7 +77,8 @@ if ($change == 1){
 	if (is_file("../lib/$config[general_lib_type]/change_attrs.php3"))
 		include("../lib/$config[general_lib_type]/change_attrs.php3");
 	if ($user_type != 'group'){
-		if ($passwd != '' && is_file("../lib/$config[general_lib_type]/change_passwd.php3"))
+		if ($config[general_show_user_password] != 'no' && $passwd != '' 
+			&& is_file("../lib/$config[general_lib_type]/change_passwd.php3"))
 			include("../lib/$config[general_lib_type]/change_passwd.php3");
 		if (is_file("../lib/$config[general_lib_type]/user_info.php3"))
 			include("../lib/$config[general_lib_type]/user_info.php3");
@@ -109,7 +110,7 @@ Please take that into consideration when adding attributes in the group<br>
 and selecting operators.
 <br>
 EOM;
-if ($user_type != 'group'){
+if ($user_type != 'group' && $config[general_show_user_password] != 'no'){
 	echo <<<EOM
 <tr>
 <td align=right colspan=$colspan bgcolor="#d0ddb0">
@@ -267,6 +268,7 @@ if ($user_type != 'group'){
 	echo <<<EOM
 <br><br>
 <input type=submit class=button value="Add to Badusers" OnClick="this.form.badusers.value=1">
+<a href="help/badusers_help.html" target=bu_help onclick=window.open("help/badusers_help.html","bu_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="BADUSERS Help Page"><font color="blue">&lt;--Help</font></a>
 EOM;
 }
 ?>
diff --git a/htdocs/user_finger.php3 b/htdocs/user_finger.php3
index 5ddfbfb..e1a64f4 100644
--- a/htdocs/user_finger.php3
+++ b/htdocs/user_finger.php3
@@ -1,5 +1,6 @@
 <?php
 require('../conf/config.php3');
+require('../lib/attrshow.php3');
 if (!isset($usage_summary)){
 	echo <<<EOM
 <html>
@@ -152,13 +153,18 @@ EOM;
 		echo <<<EOM
 <p>
 	<table width=100% cellpadding=0 height=30><tr>
-	<th align=left>$server_name[$j]<br><font color="green">$server_model[$j]</font></th><th align=right><font color="red">$server_loggedin[$j] users connected</font></th><th><font color="green">$server_rem[$j] free lines</font></th>
+	<th align=left>$server_name[$j]<br><font color="green">$server_model[$j]</font></th><th align=right><font color="red">$server_loggedin[$j] users connected</font></th><th><font color="green">$server_rem[$j] $config[general_caption_finger_free_lines]</font></th>
 	</tr>
 	</table>
 	<div height="$height[$j]" style="height:$height[$j]">
 	<table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top>
 	<tr bgcolor="#d0ddb0">
-	<th>#</th><th>user</th><th>ip address</th><th>caller id</th><th>name</th><th>duration</th>
+	<th>#</th><th>user</th>
+EOM;
+	if ($acct_attrs['uf'][4] != '')	echo "<th>" . $acct_attrs[uf][4] . "</th>\n";
+	if ($acct_attrs['uf'][9] != '') echo "<th>" . $acct_attrs[uf][9] . "</th>\n";
+echo <<<EOM
+	<th>name</th><th>duration</th>
 	</tr>
 EOM;
 	for( $k = 1; $k <= $server_loggedin[$j]; $k++){
@@ -171,7 +177,12 @@ EOM;
 		$inf = $user_info[$user];
 		echo <<<EOM
 	<tr align=center>
-	<td>$k</td><td><a href="user_admin.php3?login=$user" title="Edit User $user">$user</a></td><td>$ip</td><td>$cid</td><td>$inf</td><td>$time</td>
+	<td>$k</td><td><a href="user_admin.php3?login=$user" title="Edit User $user">$user</a></td>
+EOM;
+if ($acct_attrs['uf'][4] != '') echo "<td>$ip</td>\n";
+if ($acct_attrs['uf'][9] != '') echo "<td>$cid</td>\n";
+echo <<<EOM
+<td>$inf</td><td>$time</td>
 	</tr>
 EOM;
 	}
diff --git a/html/user_admin.html.php3 b/html/user_admin.html.php3
index a3f9e5a..2f1f85b 100644
--- a/html/user_admin.html.php3
+++ b/html/user_admin.html.php3
@@ -94,46 +94,19 @@ if ($logged_now){
 	Connection Duration
 	</td><td>	
 	<input type="text" name="status" size=10 value="$lastlog_session_time">
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	User IP Address
-	</td><td>
-	<font color=darkblue><b>$lastlog_client_name</b></font> ($lastlog_client_ip)
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	NAS Server
-	</td><td>	
-	<b>$lastlog_server_name</b> ($lastlog_server_ip)
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	NAS Port
-	</td><td>
-	$lastlog_server_port
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Caller Id
-	</td><td>
-	$lastlog_callerid
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Upload
-	</td><td>
-	$lastlog_input
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Download
-	</td><td>
-	$lastlog_output
-	</td></tr>
 	</form>
+	</td></tr>
 EOM;
+	require('../html/user_admin_userinfo.html.php3');
+
 }else if ($not_known)  print <<<EOM
 	<tr><td align=center bgcolor="#d0ddb0">
 	This user has <b>never</b> connected
 	</td><td>-
 	</td></tr>
 EOM;
-else print <<<EOM
+else{
+	print <<<EOM
 	<tr><td align=center bgcolor="#d0ddb0">
 	User is <b>not online</b> now<br>
 	</td><td>-
@@ -144,41 +117,13 @@ else print <<<EOM
 	$lastlog_time
 	</td></tr>
 	<tr><td align=center bgcolor="#d0ddb0">
-	IP Address
-	</td><td>	
-	<font color=darkblue><b>$lastlog_client_name</b></font> ($lastlog_client_ip)
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
 	Online Time
 	</td><td>
 	$lastlog_session_time
 	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	NAS Server
-	</td><td>
-	<b>$lastlog_server_name</b> ($lastlog_server_ip)
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	NAS Port
-	</td><td>
-	$lastlog_server_port
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Caller Id
-	</td><td>
-	$lastlog_callerid
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Upload
-	</td><td>
-	$lastlog_input
-	</td></tr>
-	<tr><td align=center bgcolor="#d0ddb0">
-	Download
-	</td><td>
-	$lastlog_output
-	</td></tr>
 EOM;
+	require('../html/user_admin_userinfo.html.php3');
+}
 
 print <<<EOM
 	<tr><td align=center bgcolor="#d0ddb0">
diff --git a/html/user_admin_userinfo.html.php3 b/html/user_admin_userinfo.html.php3
new file mode 100644
index 0000000..c2a533b
--- /dev/null
+++ b/html/user_admin_userinfo.html.php3
@@ -0,0 +1,29 @@
+<?php
+echo <<<EOM
+	<tr><td align=center bgcolor="#d0ddb0">
+	Server
+	</td><td>	
+	<b>$lastlog_server_name</b> ($lastlog_server_ip)
+	</td></tr>
+	<tr><td align=center bgcolor="#d0ddb0">
+	Server Port
+	</td><td>
+	$lastlog_server_port
+	</td></tr>
+	<tr><td align=center bgcolor="#d0ddb0">
+	Workstation
+	</td><td>
+	$lastlog_callerid
+	</td></tr>
+	<tr><td align=center bgcolor="#d0ddb0">
+	Upload
+	</td><td>
+	$lastlog_input
+	</td></tr>
+	<tr><td align=center bgcolor="#d0ddb0">
+	Download
+	</td><td>
+	$lastlog_output
+	</td></tr>
+EOM;
+?>
diff --git a/html/user_toolbar.html.php3 b/html/user_toolbar.html.php3
index e8aa909..0b0fc6d 100644
--- a/html/user_toolbar.html.php3
+++ b/html/user_toolbar.html.php3
@@ -18,5 +18,11 @@ print <<<EOM
 <td align=center bgcolor="black" width=100>
 <a href="user_test.php3?login=$login" title="Test User"><font color="white"><b>TEST</b></font></a></td>
 </tr>
+<tr valign=top>
+<td align=center width=100></td>
+<td align=center bgcolor="black" width=200>
+<a href="clear_opensessions.php3?login=$login" title="Clear Open User Sessions"><font size=-2 color="white"><b>OPEN SESSIONS</b></font></a></td>
+<td align=center width=100></td>
+</tr>
 EOM;
 ?>
diff --git a/lib/attrshow.php3 b/lib/attrshow.php3
index a14b9ef..e837b60 100644
--- a/lib/attrshow.php3
+++ b/lib/attrshow.php3
@@ -12,4 +12,27 @@ if (!isset($show_attrs)){
 	if ($config[general_use_session] == 'yes')
 		session_register('show_attrs');
 }
+if (!isset($acct_attrs) && isset($config[general_accounting_attrs_file])){
+	$ARR = file($config[general_accounting_attrs_file]);
+	foreach ($ARR as $val){
+		$val=chop($val);
+		if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val))
+			continue;
+		list($num,$desc,$showua,$showuf,$showfl)=split("\t+",$val);
+		if ($showua == 'yes'){
+			$acct_attrs["ua"]["num"]++;
+			$acct_attrs["ua"]["$num"]=$desc;
+		}
+		if ($showuf == 'yes'){
+			$acct_attrs["uf"]["num"]++;
+			$acct_attrs["uf"]["$num"]=$desc;
+		}
+		if ($showfl == 'yes'){
+			$acct_attrs["fl"]["num"]++;
+			$acct_attrs["fl"]["$num"]=$desc;
+		}
+	}
+	if ($config[general_use_session] == 'yes')
+		session_register('acct_attrs');
+}
 ?>
diff --git a/lib/sql/drivers/mysql/functions.php3 b/lib/sql/drivers/mysql/functions.php3
index 2cc539d..1731f27 100644
--- a/lib/sql/drivers/mysql/functions.php3
+++ b/lib/sql/drivers/mysql/functions.php3
@@ -26,6 +26,8 @@ function da_sql_connect($config)
 		$SQL_passwd = $config[sql_password];
 	}
 
+	if ($config[sql_connect_timeout] != 0)
+		@ini_set('mysql.connect_timeout',$config[sql_connect_timeout]);
 	return @mysql_connect("$config[sql_server]:$config[sql_port]",$SQL_user,$SQL_passwd);
 }
 
@@ -41,6 +43,8 @@ function da_sql_pconnect($config)
 		$SQL_passwd = $config[sql_password];
 	}
 
+	if ($config[sql_connect_timeout] != 0)
+		@ini_set('mysql.connect_timeout',$config[sql_connect_timeout]);
 	return @mysql_pconnect("$config[sql_server]:$config[sql_port]",$SQL_user,$SQL_passwd);
 }
 
@@ -51,6 +55,7 @@ function da_sql_close($link,$config)
 
 function da_sql_query($link,$config,$query)
 {
+	@mysql_escape_string($query);
 	if ($config[sql_debug] == 'true')
 		print "<b>DEBUG(SQL,MYSQL DRIVER): Query: <i>$query</i></b><br>\n";
 	return @mysql_db_query($config[sql_database],$query,$link);
-- 
2.39.5