@@ -1,5 +1,5 @@ discard block  | 
                                                    ||
| 1 | 1 | <?php  | 
                                                        
| 2 | -function getIP($header,$mxserver,$msa) { | 
                                                        |
| 2 | +function getIP($header, $mxserver, $msa) { | 
                                                        |
| 3 | 3 | /* Get submission server's IP from header's mail */  | 
                                                        
| 4 | 4 | /* Each line must end with /r/n */  | 
                                                        
| 5 | 5 | /* IP is the first one written by your mxserver */  | 
                                                        
@@ -7,10 +7,10 @@ discard block  | 
                                                    ||
| 7 | 7 | $ip = FALSE;  | 
                                                        
| 8 | 8 | $host = FALSE;  | 
                                                        
| 9 | 9 | $dateR = FALSE;  | 
                                                        
| 10 | -	if ( preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m',$header,$received) ) { | 
                                                        |
| 11 | -		for ($i = count($received[0])-1;$i>=0;$i--) { | 
                                                        |
| 10 | +	if (preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m', $header, $received)) { | 
                                                        |
| 11 | +		for ($i = count($received[0])-1; $i>=0; $i--) { | 
                                                        |
| 12 | 12 | # print "Examine ".$received[0][$i]."\n";  | 
                                                        
| 13 | - if ( preg_match($msa,$received['host'][$i]) )  | 
                                                        |
| 13 | + if (preg_match($msa, $received['host'][$i]))  | 
                                                        |
| 14 | 14 | $dateR = $received['date'][$i];  | 
                                                        
| 15 | 15 |          		foreach ($mxserver as $mx) { | 
                                                        
| 16 | 16 | if (!$ip)  | 
                                                        
@@ -21,38 +21,38 @@ discard block  | 
                                                    ||
| 21 | 21 | }  | 
                                                        
| 22 | 22 | }  | 
                                                        
| 23 | 23 | }  | 
                                                        
| 24 | -	if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) | 
                                                        |
| 24 | +	if (preg_match('/\r\nDate:\s(?P<date>.*)\r\n/', $header, $dateC) != 1) | 
                                                        |
| 25 | 25 | $dateC['date'] = 'Not found';  | 
                                                        
| 26 | -	if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) | 
                                                        |
| 26 | +	if (preg_match('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/', $header, $mid) != 1) | 
                                                        |
| 27 | 27 | $mid['mid'] = NULL;  | 
                                                        
| 28 | - return array($ip,$host,$dateR,$dateC['date'],$mid['mid']);  | 
                                                        |
| 28 | + return array($ip, $host, $dateR, $dateC['date'], $mid['mid']);  | 
                                                        |
| 29 | 29 | }  | 
                                                        
| 30 | 30 | |
| 31 | -function updateReport ($ip,$uid,$ipcount,$uidcount,$hostname,$dateC,$msgid,$dateL) { | 
                                                        |
| 31 | +function updateReport($ip, $uid, $ipcount, $uidcount, $hostname, $dateC, $msgid, $dateL) { | 
                                                        |
| 32 | 32 | |
| 33 | -	return sprintf ('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td>%u</td><td>%u</td><td>%s</td><td>%s</td></tr>'."\n",$dateL,$dateC,$uid,$ip,$uidcount,$ipcount,$hostname,htmlentities($msgid) ); | 
                                                        |
| 33 | +	return sprintf('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td>%u</td><td>%u</td><td>%s</td><td>%s</td></tr>'."\n", $dateL, $dateC, $uid, $ip, $uidcount, $ipcount, $hostname, htmlentities($msgid)); | 
                                                        |
| 34 | 34 | }  | 
                                                        
| 35 | 35 | |
| 36 | -function updatebadReport ( $uid,$dateC,$msgid,$dateL,$text ) { | 
                                                        |
| 37 | -	return sprintf ('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td nowrap>%s</td></tr>'."\n",$dateL,$dateC,$uid,htmlentities($msgid),$text ); | 
                                                        |
| 36 | +function updatebadReport($uid, $dateC, $msgid, $dateL, $text) { | 
                                                        |
| 37 | +	return sprintf('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td nowrap>%s</td></tr>'."\n", $dateL, $dateC, $uid, htmlentities($msgid), $text); | 
                                                        |
| 38 | 38 | }  | 
                                                        
| 39 | 39 | |
| 40 | 40 | |
| 41 | -function summaryBadReport ($uidvet) { | 
                                                        |
| 41 | +function summaryBadReport($uidvet) { | 
                                                        |
| 42 | 42 | $nuid = $uidvet['count'];  | 
                                                        
| 43 | - if ( empty($uidvet) ) return NULL;  | 
                                                        |
| 43 | + if (empty($uidvet)) return NULL;  | 
                                                        |
| 44 | 44 | $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n";  | 
                                                        
| 45 | 45 | |
| 46 | 46 | /* Remove count index */  | 
                                                        
| 47 | 47 | $uids = array_keys($uidvet['uid']);  | 
                                                        
| 48 | 48 | $totlearn = 0;  | 
                                                        
| 49 | 49 | |
| 50 | -        foreach ( $uids as $uid ) { | 
                                                        |
| 51 | - $totlearn += $uidvet['uid']["$uid"]['count'];;  | 
                                                        |
| 52 | -		$return .= sprintf ('<tr><td>%s</td><td>%u</td></tr>',$uid,$uidvet['uid']["$uid"]['count']); | 
                                                        |
| 50 | +        foreach ($uids as $uid) { | 
                                                        |
| 51 | + $totlearn += $uidvet['uid']["$uid"]['count']; ;  | 
                                                        |
| 52 | +		$return .= sprintf('<tr><td>%s</td><td>%u</td></tr>', $uid, $uidvet['uid']["$uid"]['count']); | 
                                                        |
| 53 | 53 | }  | 
                                                        
| 54 | -	$return .= sprintf ('<tr><th>%s</th><th>%u</th></tr></table>','TOT',$totlearn); | 
                                                        |
| 55 | -	$return .= sprintf ('<p>%s : %u</p>','Unique UID',$nuid); | 
                                                        |
| 54 | +	$return .= sprintf('<tr><th>%s</th><th>%u</th></tr></table>', 'TOT', $totlearn); | 
                                                        |
| 55 | +	$return .= sprintf('<p>%s : %u</p>', 'Unique UID', $nuid); | 
                                                        |
| 56 | 56 | |
| 57 | 57 | return $return;  | 
                                                        
| 58 | 58 | }  | 
                                                        
@@ -69,12 +69,12 @@ discard block  | 
                                                    ||
| 69 | 69 |      foreach ($cols as $col => $order) { | 
                                                        
| 70 | 70 | $eval .= '$colarr[\''.$col.'\'],'.$order.',';  | 
                                                        
| 71 | 71 | }  | 
                                                        
| 72 | - $eval = substr($eval,0,-1).');';  | 
                                                        |
| 72 | + $eval = substr($eval, 0, -1).');';  | 
                                                        |
| 73 | 73 | eval($eval);  | 
                                                        
| 74 | 74 | $ret = array();  | 
                                                        
| 75 | 75 |      foreach ($colarr as $col => $arr) { | 
                                                        
| 76 | 76 |          foreach ($arr as $k => $v) { | 
                                                        
| 77 | - $k = substr($k,1);  | 
                                                        |
| 77 | + $k = substr($k, 1);  | 
                                                        |
| 78 | 78 | if (!isset($ret[$k])) $ret[$k] = $array[$k];  | 
                                                        
| 79 | 79 | if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col];  | 
                                                        
| 80 | 80 | }  | 
                                                        
@@ -84,33 +84,33 @@ discard block  | 
                                                    ||
| 84 | 84 | }  | 
                                                        
| 85 | 85 | |
| 86 | 86 | |
| 87 | -function summaryReportAndList ($cf,$myconn,$tables,$category,$vet,$key) { | 
                                                        |
| 87 | +function summaryReportAndList($cf, $myconn, $tables, $category, $vet, $key) { | 
                                                        |
| 88 | 88 | $nk = $vet['count'];  | 
                                                        
| 89 | 89 | |
| 90 | - if ( empty($vet) ) return NULL;  | 
                                                        |
| 90 | + if (empty($vet)) return NULL;  | 
                                                        |
| 91 | 91 | |
| 92 | -	$return = sprintf('<h3>Statistics by %s</h3><table><tr><th>%s</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this %s is currently listed, but it says if this %s has listed now!">Listed Now</th></tr>'."\n", strtoupper($key),strtoupper($key),$key,$key); | 
                                                        |
| 92 | +	$return = sprintf('<h3>Statistics by %s</h3><table><tr><th>%s</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this %s is currently listed, but it says if this %s has listed now!">Listed Now</th></tr>'."\n", strtoupper($key), strtoupper($key), $key, $key); | 
                                                        |
| 93 | 93 | |
| 94 | 94 | $values = array_keys($vet["$key"]);  | 
                                                        
| 95 | 95 | |
| 96 | -	foreach ( $values as $value ) { | 
                                                        |
| 97 | - if ( $value == 'count' ) continue;  | 
                                                        |
| 96 | +	foreach ($values as $value) { | 
                                                        |
| 97 | + if ($value == 'count') continue;  | 
                                                        |
| 98 | 98 | $nlearn = $vet["$key"]["$value"]['count'];  | 
                                                        
| 99 | 99 | unset($vet["$key"]["$value"]['count']);  | 
                                                        
| 100 | 100 | $quantity = $cf["listing$key"]['quantity']["$category"]; /* In searchAndList this value is  | 
                                                        
| 101 | 101 | passed by reference and modified */  | 
                                                        
| 102 | 102 | $nuid = count($vet["$key"]["$value"]);  | 
                                                        
| 103 | -		if ( !$cf["listing$key"]['onlyReport']["$category"] ) { | 
                                                        |
| 104 | -			if ( ($nlearn >= $cf["listing$key"]['threshold']["$category"])&&($nuid >= $cf["listing$key"]['thresholduid']["$category"]) ) { | 
                                                        |
| 103 | +		if (!$cf["listing$key"]['onlyReport']["$category"]) { | 
                                                        |
| 104 | +			if (($nlearn>=$cf["listing$key"]['threshold']["$category"]) && ($nuid>=$cf["listing$key"]['thresholduid']["$category"])) { | 
                                                        |
| 105 | 105 | $reason = sprintf(  | 
                                                        
| 106 | 106 | 'The %s <%s> has been listed because was marked %u times as %s by %u different accounts during last %u days.',  | 
                                                        
| 107 | - strtoupper($key),$value,$nlearn,$category,$nuid,$cf['imap']['oldestday']);  | 
                                                        |
| 108 | - $listed = searchAndList ($myconn,$cf['syslog']['user'],$tables,$cf["listing$key"]['list']["$category"],$value,$cf["listing$key"]['unit']["$category"],$quantity,$reason);  | 
                                                        |
| 107 | + strtoupper($key), $value, $nlearn, $category, $nuid, $cf['imap']['oldestday']);  | 
                                                        |
| 108 | + $listed = searchAndList($myconn, $cf['syslog']['user'], $tables, $cf["listing$key"]['list']["$category"], $value, $cf["listing$key"]['unit']["$category"], $quantity, $reason);  | 
                                                        |
| 109 | 109 | }  | 
                                                        
| 110 | 110 | else $listed = FALSE;  | 
                                                        
| 111 | 111 | }  | 
                                                        
| 112 | 112 | else $listed = FALSE;  | 
                                                        
| 113 | - $nowlist = array( TRUE => array(  | 
                                                        |
| 113 | + $nowlist = array(TRUE => array(  | 
                                                        |
| 114 | 114 | 'style' => 'id=\'ipfound\'',  | 
                                                        
| 115 | 115 | 'name' => 'YES',  | 
                                                        
| 116 | 116 | ),  | 
                                                        
@@ -124,46 +124,46 @@ discard block  | 
                                                    ||
| 124 | 124 | )  | 
                                                        
| 125 | 125 | );  | 
                                                        
| 126 | 126 | |
| 127 | - $return .='<tr><td rowspan="'.$nuid.'">'.$value.'</td>';  | 
                                                        |
| 128 | -		$return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$vet["$key"]["$value"][0],$nlearn,$nowlist["$listed"]['name']); | 
                                                        |
| 129 | - $rowuid=NULL;  | 
                                                        |
| 130 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 127 | + $return .= '<tr><td rowspan="'.$nuid.'">'.$value.'</td>';  | 
                                                        |
| 128 | +		$return .= sprintf('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>', $vet["$key"]["$value"][0], $nlearn, $nowlist["$listed"]['name']); | 
                                                        |
| 129 | + $rowuid = NULL;  | 
                                                        |
| 130 | + for ($j = 1; $j<$nuid; $j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 131 | 131 | array_shift($vet["$key"]["$value"]);  | 
                                                        
| 132 | - $return .= vsprintf ($rowuid,$vet["$key"]["$value"]);  | 
                                                        |
| 132 | + $return .= vsprintf($rowuid, $vet["$key"]["$value"]);  | 
                                                        |
| 133 | 133 | |
| 134 | 134 | }  | 
                                                        
| 135 | -	$return .= sprintf ('<tr><th title="unique %s">%u</th><th title="unique uids">%u</th><th>%u</th></table>',$key,$vet["$key"]['count'],$vet['uid']['count'],$nk); | 
                                                        |
| 135 | +	$return .= sprintf('<tr><th title="unique %s">%u</th><th title="unique uids">%u</th><th>%u</th></table>', $key, $vet["$key"]['count'], $vet['uid']['count'], $nk); | 
                                                        |
| 136 | 136 | |
| 137 | 137 | |
| 138 | 138 | /* Statistics by UID */  | 
                                                        
| 139 | 139 | /* Not used for listing purpose, but useful to you! */  | 
                                                        
| 140 | -	$return .= sprintf('<h3>Statistics by UID</h3><table><tr><th>UID</th><th>%s learned</th><th>Learned times</th></tr>'."\n",$key); | 
                                                        |
| 140 | +	$return .= sprintf('<h3>Statistics by UID</h3><table><tr><th>UID</th><th>%s learned</th><th>Learned times</th></tr>'."\n", $key); | 
                                                        |
| 141 | 141 | $uids = array_keys($vet['uid']);  | 
                                                        
| 142 | -        foreach ( $uids as $uid ) { | 
                                                        |
| 143 | - if ( $uid == 'count' ) continue;  | 
                                                        |
| 142 | +        foreach ($uids as $uid) { | 
                                                        |
| 143 | + if ($uid == 'count') continue;  | 
                                                        |
| 144 | 144 | $nlearn = $vet['uid']["$uid"]['count'];  | 
                                                        
| 145 | - unset ( $vet['uid']["$uid"]['count'] );  | 
                                                        |
| 145 | + unset ($vet['uid']["$uid"]['count']);  | 
                                                        |
| 146 | 146 | $nip = count($vet['uid']["$uid"]);  | 
                                                        
| 147 | - $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>';  | 
                                                        |
| 148 | -		$return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$vet['uid']["$uid"][0],$nlearn); | 
                                                        |
| 149 | - $rowuid=NULL;  | 
                                                        |
| 150 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 147 | + $return .= '<tr><td rowspan="'.$nip.'">'.$uid.'</td>';  | 
                                                        |
| 148 | +		$return .= sprintf('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>', $vet['uid']["$uid"][0], $nlearn); | 
                                                        |
| 149 | + $rowuid = NULL;  | 
                                                        |
| 150 | + for ($j = 1; $j<$nip; $j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 151 | 151 | array_shift($vet['uid']["$uid"]);  | 
                                                        
| 152 | - $return .= vsprintf ($rowuid,$vet['uid']["$uid"]);  | 
                                                        |
| 152 | + $return .= vsprintf($rowuid, $vet['uid']["$uid"]);  | 
                                                        |
| 153 | 153 | |
| 154 | 154 | }  | 
                                                        
| 155 | -        $return .= sprintf ('<tr><th title="unique uids">%u</th><th title="unique %s">%u</th><th>%u</th></table>', | 
                                                        |
| 156 | - $vet['uid']['count'],$key,$vet["$key"]['count'],$nk);  | 
                                                        |
| 155 | +        $return .= sprintf('<tr><th title="unique uids">%u</th><th title="unique %s">%u</th><th>%u</th></table>', | 
                                                        |
| 156 | + $vet['uid']['count'], $key, $vet["$key"]['count'], $nk);  | 
                                                        |
| 157 | 157 | |
| 158 | 158 | |
| 159 | 159 | return $return;  | 
                                                        
| 160 | 160 | }  | 
                                                        
| 161 | 161 | |
| 162 | 162 | |
| 163 | -function splunksearch ($service,$message_id,$date) { | 
                                                        |
| 163 | +function splunksearch($service, $message_id, $date) { | 
                                                        |
| 164 | 164 | |
| 165 | 165 | // Run a blocking search  | 
                                                        
| 166 | - $searchQueryBlocking = 'search (message_id="'. addslashes( $message_id ) .  | 
                                                        |
| 166 | + $searchQueryBlocking = 'search (message_id="'.addslashes($message_id).  | 
                                                        |
| 167 | 167 | '" OR sasl_username) | transaction message_id queue_id maxspan=3m maxpause=2m | search sasl_username message_id=* | table sasl_username';  | 
                                                        
| 168 | 168 | |
| 169 | 169 | /* Doesn't work on Splunk 6.6 for HTTP exceptions  | 
                                                        
@@ -182,8 +182,8 @@ discard block  | 
                                                    ||
| 182 | 182 | |
| 183 | 183 | // A one shot search  | 
                                                        
| 184 | 184 | $searchParams = array(  | 
                                                        
| 185 | -                'earliest_time' => date("c",strtotime ($date)-120), | 
                                                        |
| 186 | -                'latest_time' => date("c",strtotime ($date)+60) | 
                                                        |
| 185 | +                'earliest_time' => date("c", strtotime($date)-120), | 
                                                        |
| 186 | +                'latest_time' => date("c", strtotime($date)+60) | 
                                                        |
| 187 | 187 | );  | 
                                                        
| 188 | 188 | |
| 189 | 189 | // Run a oneshot search that returns the job's results  | 
                                                        
@@ -197,7 +197,7 @@ discard block  | 
                                                    ||
| 197 | 197 |  	    { | 
                                                        
| 198 | 198 | // More than one field attribute returned by search  | 
                                                        
| 199 | 199 | // You must redefine the search  | 
                                                        
| 200 | - if ( count($result->getFieldNames()) > 1 ) return FALSE;  | 
                                                        |
| 200 | + if (count($result->getFieldNames())>1) return FALSE;  | 
                                                        |
| 201 | 201 | }  | 
                                                        
| 202 | 202 | else if ($result instanceof Splunk_ResultsMessage)  | 
                                                        
| 203 | 203 |  	    { | 
                                                        
@@ -235,13 +235,13 @@ discard block  | 
                                                    ||
| 235 | 235 | |
| 236 | 236 |  function flattenParts($messageParts, $flattenedParts = array(), $prefix = '', $index = 1, $fullPrefix = true) { | 
                                                        
| 237 | 237 | |
| 238 | -        foreach($messageParts as $part) { | 
                                                        |
| 238 | +        foreach ($messageParts as $part) { | 
                                                        |
| 239 | 239 | $flattenedParts[$prefix.$index] = $part;  | 
                                                        
| 240 | -                if(isset($part->parts)) { | 
                                                        |
| 241 | -                        if($part->type == 2) { | 
                                                        |
| 240 | +                if (isset($part->parts)) { | 
                                                        |
| 241 | +                        if ($part->type == 2) { | 
                                                        |
| 242 | 242 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.', 0, false);  | 
                                                        
| 243 | 243 | }  | 
                                                        
| 244 | -                        elseif($fullPrefix) { | 
                                                        |
| 244 | +                        elseif ($fullPrefix) { | 
                                                        |
| 245 | 245 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.');  | 
                                                        
| 246 | 246 | }  | 
                                                        
| 247 | 247 |                          else { | 
                                                        
@@ -259,7 +259,7 @@ discard block  | 
                                                    ||
| 259 | 259 |  function getPart($connection, $messageNumber, $partNumber, $encoding) { | 
                                                        
| 260 | 260 | |
| 261 | 261 | $data = imap_fetchbody($connection, $messageNumber, $partNumber);  | 
                                                        
| 262 | -        switch($encoding) { | 
                                                        |
| 262 | +        switch ($encoding) { | 
                                                        |
| 263 | 263 | case 0: return $data; // 7BIT  | 
                                                        
| 264 | 264 | case 1: return $data; // 8BIT  | 
                                                        
| 265 | 265 | case 2: return $data; // BINARY  | 
                                                        
@@ -272,30 +272,30 @@ discard block  | 
                                                    ||
| 272 | 272 | }  | 
                                                        
| 273 | 273 | /***********************************/  | 
                                                        
| 274 | 274 | |
| 275 | -function getDomains ($text,$exclude) { | 
                                                        |
| 275 | +function getDomains($text, $exclude) { | 
                                                        |
| 276 | 276 | /* Pattern from https://mathiasbynens.be/demo/url-regex */  | 
                                                        
| 277 | 277 | /* Current choice: @gruber */  | 
                                                        
| 278 | 278 | $pattern = '#\b(([\w-]+://?|www[.])[^\s()<>]+(?:\([\w\d]+\)|([^[:punct:]\s]|/)))#iS';  | 
                                                        
| 279 | 279 | $ret = array();  | 
                                                        
| 280 | 280 | $num_found = preg_match_all($pattern, $text, $out);  | 
                                                        
| 281 | -	if ( ($num_found !== FALSE) && ($num_found>0) ) { | 
                                                        |
| 281 | +	if (($num_found !== FALSE) && ($num_found>0)) { | 
                                                        |
| 282 | 282 |  		foreach ($out[0] as $url) { | 
                                                        
| 283 | - $dom=nsdom(parse_url($url, PHP_URL_HOST));  | 
                                                        |
| 284 | - if (!( empty($dom) || in_array($dom,$exclude) ))  | 
                                                        |
| 283 | + $dom = nsdom(parse_url($url, PHP_URL_HOST));  | 
                                                        |
| 284 | + if (!(empty($dom) || in_array($dom, $exclude)))  | 
                                                        |
| 285 | 285 | $ret[] = $dom;  | 
                                                        
| 286 | 286 | }  | 
                                                        
| 287 | 287 | }  | 
                                                        
| 288 | 288 | return array_values(array_unique($ret));  | 
                                                        
| 289 | 289 | }  | 
                                                        
| 290 | 290 | |
| 291 | -function parseURL ($connection,$messageNumber, $exclusionList) { | 
                                                        |
| 291 | +function parseURL($connection, $messageNumber, $exclusionList) { | 
                                                        |
| 292 | 292 | $message = '';  | 
                                                        
| 293 | 293 | $structure = imap_fetchstructure($connection, $messageNumber);  | 
                                                        
| 294 | 294 |  	if (isset($structure->parts)) { | 
                                                        
| 295 | 295 | $flattenedParts = flattenParts($structure->parts);  | 
                                                        
| 296 | -		foreach($flattenedParts as $partNumber => $part) { | 
                                                        |
| 296 | +		foreach ($flattenedParts as $partNumber => $part) { | 
                                                        |
| 297 | 297 | |
| 298 | -			switch($part->type) { | 
                                                        |
| 298 | +			switch ($part->type) { | 
                                                        |
| 299 | 299 | |
| 300 | 300 | case 0:  | 
                                                        
| 301 | 301 | // the HTML or plain text part of the email  | 
                                                        
@@ -324,13 +324,13 @@ discard block  | 
                                                    ||
| 324 | 324 | else  | 
                                                        
| 325 | 325 | $message = getPart($connection, $messageNumber, 1, $structure->encoding);  | 
                                                        
| 326 | 326 | |
| 327 | - if ( !empty($message) )  | 
                                                        |
| 327 | + if (!empty($message))  | 
                                                        |
| 328 | 328 | return getDomains($message, $exclusionList);  | 
                                                        
| 329 | 329 | return array();  | 
                                                        
| 330 | 330 | }  | 
                                                        
| 331 | 331 | |
| 332 | 332 |  function humanKey($key) { | 
                                                        
| 333 | -	switch($key) { | 
                                                        |
| 333 | +	switch ($key) { | 
                                                        |
| 334 | 334 | case 'ip':  | 
                                                        
| 335 | 335 | return 'ips';  | 
                                                        
| 336 | 336 | case 'dom':  | 
                                                        
@@ -339,67 +339,67 @@ discard block  | 
                                                    ||
| 339 | 339 | return $key;  | 
                                                        
| 340 | 340 | }  | 
                                                        
| 341 | 341 | |
| 342 | -function writeFileHeader($f,$conf,$key,$type,$rtime) { | 
                                                        |
| 343 | - fwrite( $f, file_get_contents(dirname(__FILE__) . '/' . $conf['report']['reportTemplateHeader']) );  | 
                                                        |
| 344 | -        fwrite( $f,sprintf('<h1> Report of %s %s</h1><h5>%s</h5><h2>Detailed Report</h2>',$type, strtoupper(humanKey($key)),$rtime) ); | 
                                                        |
| 342 | +function writeFileHeader($f, $conf, $key, $type, $rtime) { | 
                                                        |
| 343 | + fwrite($f, file_get_contents(dirname(__FILE__).'/'.$conf['report']['reportTemplateHeader']));  | 
                                                        |
| 344 | +        fwrite($f, sprintf('<h1> Report of %s %s</h1><h5>%s</h5><h2>Detailed Report</h2>', $type, strtoupper(humanKey($key)), $rtime)); | 
                                                        |
| 345 | 345 |          if ($conf["listing$key"]['onlyReport']["$type"]) { | 
                                                        
| 346 | -                fwrite( $f,sprintf('<p>None of the below %s have been listed because listing is not active in configuration.</p>', | 
                                                        |
| 347 | - strtoupper(humanKey($key))) );  | 
                                                        |
| 346 | +                fwrite($f, sprintf('<p>None of the below %s have been listed because listing is not active in configuration.</p>', | 
                                                        |
| 347 | + strtoupper(humanKey($key))));  | 
                                                        |
| 348 | 348 |  		syslog(LOG_INFO, sprintf('%s: Report only for %s %s: no listing activated in configuration.', | 
                                                        
| 349 | - $conf['syslog']['user'],$type,humanKey($key))  | 
                                                        |
| 349 | + $conf['syslog']['user'], $type, humanKey($key))  | 
                                                        |
| 350 | 350 | );  | 
                                                        
| 351 | 351 | }  | 
                                                        
| 352 | -        fwrite( $f,sprintf('<table><tr><th title="taken from Received header" nowrap>Date of Learn</th><th title="taken from Date header" nowrap>Date of Write</th><th nowrap>UID</th><th nowrap>%s</th><th title="How many times this uid learns">#UID</th><th title="Number of times this learned %s appears in different mails">#%s</th><th nowrap>Received by</th><th>Message-Id</th></tr>', | 
                                                        |
| 353 | - strtoupper($key),strtoupper($key),strtoupper($key)) );  | 
                                                        |
| 352 | +        fwrite($f, sprintf('<table><tr><th title="taken from Received header" nowrap>Date of Learn</th><th title="taken from Date header" nowrap>Date of Write</th><th nowrap>UID</th><th nowrap>%s</th><th title="How many times this uid learns">#UID</th><th title="Number of times this learned %s appears in different mails">#%s</th><th nowrap>Received by</th><th>Message-Id</th></tr>', | 
                                                        |
| 353 | + strtoupper($key), strtoupper($key), strtoupper($key)));  | 
                                                        |
| 354 | 354 | }  | 
                                                        
| 355 | 355 | |
| 356 | 356 | |
| 357 | -function imapReport ($cf,$myconnArray,$splunkconn,$tables,$type) { | 
                                                        |
| 358 | - $file = dirname(__FILE__) . '/' . $cf['report']['reportFile']["$type"];  | 
                                                        |
| 359 | - $filed = dirname(__FILE__) . '/' . $cf['report']['reportDomFile']["$type"];  | 
                                                        |
| 360 | - $fileb= dirname(__FILE__) . '/' . $cf['report']['badreportFile']["$type"];  | 
                                                        |
| 361 | -	$m_mail = imap_open('{'.$cf['imap']['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['imap']['authuser'].'}'.$cf['imap']['folder']["$type"], $cf['imap']['account'],$cf['imap']['authpassword'], OP_READONLY) | 
                                                        |
| 362 | - or syslog (LOG_EMERG, $cf['syslog']['user'].': Error in IMAP connection to <'.$cf['imap']['mailhost'].'>: ' . imap_last_error());  | 
                                                        |
| 363 | - if ( !$m_mail ) exit(254);  | 
                                                        |
| 357 | +function imapReport($cf, $myconnArray, $splunkconn, $tables, $type) { | 
                                                        |
| 358 | + $file = dirname(__FILE__).'/'.$cf['report']['reportFile']["$type"];  | 
                                                        |
| 359 | + $filed = dirname(__FILE__).'/'.$cf['report']['reportDomFile']["$type"];  | 
                                                        |
| 360 | + $fileb = dirname(__FILE__).'/'.$cf['report']['badreportFile']["$type"];  | 
                                                        |
| 361 | +	$m_mail = imap_open('{'.$cf['imap']['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['imap']['authuser'].'}'.$cf['imap']['folder']["$type"], $cf['imap']['account'], $cf['imap']['authpassword'], OP_READONLY) | 
                                                        |
| 362 | + or syslog(LOG_EMERG, $cf['syslog']['user'].': Error in IMAP connection to <'.$cf['imap']['mailhost'].'>: '.imap_last_error());  | 
                                                        |
| 363 | + if (!$m_mail) exit(254);  | 
                                                        |
| 364 | 364 | |
| 365 | 365 | |
| 366 | - syslog (LOG_INFO,$cf['syslog']['user'].': Successfully connected to <'.$cf['imap']['mailhost'].">; Reading $type messages of last ".$cf['imap']['oldestday'].' days...');  | 
                                                        |
| 366 | + syslog(LOG_INFO, $cf['syslog']['user'].': Successfully connected to <'.$cf['imap']['mailhost'].">; Reading $type messages of last ".$cf['imap']['oldestday'].' days...');  | 
                                                        |
| 367 | 367 | //get all messages  | 
                                                        
| 368 | - $dateTh = date ( "d-M-Y", strToTime ( '-'.$cf['imap']['oldestday'].' days' ) );  | 
                                                        |
| 369 | - $dateN = date ( "d-M-Y", strToTime ( "now" ) );  | 
                                                        |
| 370 | - $m_search=imap_search ($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\"" );  | 
                                                        |
| 368 | +	$dateTh = date("d-M-Y", strToTime('-'.$cf['imap']['oldestday'].' days')); | 
                                                        |
| 369 | +        $dateN = date("d-M-Y", strToTime("now")); | 
                                                        |
| 370 | + $m_search = imap_search($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\"");  | 
                                                        |
| 371 | 371 | |
| 372 | 372 | // Order results starting from newest message  | 
                                                        
| 373 | -	if ( empty($m_search) ) { | 
                                                        |
| 374 | - syslog (LOG_INFO,$cf['syslog']['user'].": No mail found in $type folder. No reports written for $type.");  | 
                                                        |
| 375 | - if ( $ierr = imap_errors() )  | 
                                                        |
| 376 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 377 | - syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        |
| 378 | - if ( $ierr = imap_alerts() )  | 
                                                        |
| 379 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 380 | - syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        |
| 381 | - imap_close( $m_mail );  | 
                                                        |
| 382 | - if ( file_exists( $file ) ) unlink ($file);  | 
                                                        |
| 383 | - if ( file_exists( $filed ) ) unlink ($filed);  | 
                                                        |
| 384 | - if ( file_exists( $fileb ) ) unlink ($fileb);  | 
                                                        |
| 373 | +	if (empty($m_search)) { | 
                                                        |
| 374 | + syslog(LOG_INFO, $cf['syslog']['user'].": No mail found in $type folder. No reports written for $type.");  | 
                                                        |
| 375 | + if ($ierr = imap_errors())  | 
                                                        |
| 376 | + foreach ($ierr as $thiserr)  | 
                                                        |
| 377 | + syslog(LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        |
| 378 | + if ($ierr = imap_alerts())  | 
                                                        |
| 379 | + foreach ($ierr as $thiserr)  | 
                                                        |
| 380 | + syslog(LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        |
| 381 | + imap_close($m_mail);  | 
                                                        |
| 382 | + if (file_exists($file)) unlink($file);  | 
                                                        |
| 383 | + if (file_exists($filed)) unlink($filed);  | 
                                                        |
| 384 | + if (file_exists($fileb)) unlink($fileb);  | 
                                                        |
| 385 | 385 | return FALSE;  | 
                                                        
| 386 | 386 | }  | 
                                                        
| 387 | - $nmes = count ($m_search);  | 
                                                        |
| 388 | - syslog (LOG_INFO,$cf['syslog']['user'].": Found $nmes mail in $type folder.");  | 
                                                        |
| 387 | + $nmes = count($m_search);  | 
                                                        |
| 388 | + syslog(LOG_INFO, $cf['syslog']['user'].": Found $nmes mail in $type folder.");  | 
                                                        |
| 389 | 389 | if ($nmes>0) rsort($m_search);  | 
                                                        
| 390 | 390 | |
| 391 | 391 | // Create report file  | 
                                                        
| 392 | 392 | |
| 393 | 393 | $fp = fopen($file, 'w');  | 
                                                        
| 394 | - $fpd= fopen($filed, 'w');  | 
                                                        |
| 395 | - $fpb= fopen($fileb, 'w');  | 
                                                        |
| 396 | -	$lastup = "Last Update: " . date ("d F Y H:i", time()); | 
                                                        |
| 397 | - writeFileHeader($fp,$cf,'ip',$type,$lastup);  | 
                                                        |
| 398 | - writeFileHeader($fpd,$cf,'dom',$type,$lastup);  | 
                                                        |
| 394 | + $fpd = fopen($filed, 'w');  | 
                                                        |
| 395 | + $fpb = fopen($fileb, 'w');  | 
                                                        |
| 396 | +	$lastup = "Last Update: ".date("d F Y H:i", time()); | 
                                                        |
| 397 | + writeFileHeader($fp, $cf, 'ip', $type, $lastup);  | 
                                                        |
| 398 | + writeFileHeader($fpd, $cf, 'dom', $type, $lastup);  | 
                                                        |
| 399 | 399 | |
| 400 | - fwrite( $fpb,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateHeader']) );  | 
                                                        |
| 401 | - fwrite( $fpb,"<h1> Report of bad reported $type mails</h1><h5>$lastup</h5><h2>Detailed Report</h2>" );  | 
                                                        |
| 402 | - fwrite( $fpb,'<table><tr><th title="taken from Received header" nowrap>Date Learn</th><th title="taken from Date header" nowrap>Date Received</th><th nowrap>UID</th><th>Message-Id</th><th title="Why is this a bad report?">Reason</th></tr>' );  | 
                                                        |
| 400 | + fwrite($fpb, file_get_contents(dirname(__FILE__).'/'.$cf['report']['reportTemplateHeader']));  | 
                                                        |
| 401 | + fwrite($fpb, "<h1> Report of bad reported $type mails</h1><h5>$lastup</h5><h2>Detailed Report</h2>");  | 
                                                        |
| 402 | + fwrite($fpb, '<table><tr><th title="taken from Received header" nowrap>Date Learn</th><th title="taken from Date header" nowrap>Date Received</th><th nowrap>UID</th><th>Message-Id</th><th title="Why is this a bad report?">Reason</th></tr>');  | 
                                                        |
| 403 | 403 | |
| 404 | 404 | $ipuid = array();  | 
                                                        
| 405 | 405 | $ipuid['count'] = 0;  | 
                                                        
@@ -423,105 +423,105 @@ discard block  | 
                                                    ||
| 423 | 423 | //get imap header info for obj thang  | 
                                                        
| 424 | 424 | //$headers = imap_headerinfo($m_mail, $onem);  | 
                                                        
| 425 | 425 | //$head = imap_fetchheader($m_mail, $headers->Msgno);  | 
                                                        
| 426 | - $head = imap_fetchheader($m_mail, $onem );  | 
                                                        |
| 426 | + $head = imap_fetchheader($m_mail, $onem);  | 
                                                        |
| 427 | 427 | //$obj = imap_rfc822_parse_headers( $head);  | 
                                                        
| 428 | 428 | |
| 429 | - list ($ip,$host,$dateReceived,$dateClient,$mid) = getIP( $head,$cf['mx_hostname']['mx'],$cf['msa']['msalearn'] );  | 
                                                        |
| 429 | + list ($ip, $host, $dateReceived, $dateClient, $mid) = getIP($head, $cf['mx_hostname']['mx'], $cf['msa']['msalearn']);  | 
                                                        |
| 430 | 430 |  		if (empty($mid)) { | 
                                                        
| 431 | - $uid='NA';  | 
                                                        |
| 432 | - syslog (LOG_ERR, $cf['syslog']['user'].": Error retrieving data for empty Message-ID.");  | 
                                                        |
| 433 | -		} else { | 
                                                        |
| 431 | + $uid = 'NA';  | 
                                                        |
| 432 | + syslog(LOG_ERR, $cf['syslog']['user'].": Error retrieving data for empty Message-ID.");  | 
                                                        |
| 433 | +		}else { | 
                                                        |
| 434 | 434 |  			if ($dateReceived === FALSE) { | 
                                                        
| 435 | - $uid='unauthenticated';  | 
                                                        |
| 436 | - syslog (LOG_ERR, $cf['syslog']['user'].": Error retrieving date for $mid. Maybe this mail was not submitted to Learner MSA");  | 
                                                        |
| 437 | - } else  | 
                                                        |
| 438 | -				if ( !($uid = splunksearch ($splunkconn, trim($mid,'<>'), $dateReceived)) ) { | 
                                                        |
| 439 | - syslog (LOG_ERR, $cf['syslog']['user'].": Error retrieving uid from Splunk log for $mid.");  | 
                                                        |
| 440 | - $uid='unknown';  | 
                                                        |
| 435 | + $uid = 'unauthenticated';  | 
                                                        |
| 436 | + syslog(LOG_ERR, $cf['syslog']['user'].": Error retrieving date for $mid. Maybe this mail was not submitted to Learner MSA");  | 
                                                        |
| 437 | + }else  | 
                                                        |
| 438 | +				if (!($uid = splunksearch($splunkconn, trim($mid, '<>'), $dateReceived))) { | 
                                                        |
| 439 | + syslog(LOG_ERR, $cf['syslog']['user'].": Error retrieving uid from Splunk log for $mid.");  | 
                                                        |
| 440 | + $uid = 'unknown';  | 
                                                        |
| 441 | 441 | }  | 
                                                        
| 442 | 442 | }  | 
                                                        
| 443 | 443 | |
| 444 | 444 | /* Extract domains url in body */  | 
                                                        
| 445 | - $domains = parseURL ($m_mail,$onem,$cf['listingdom']['exclude']);  | 
                                                        |
| 445 | + $domains = parseURL($m_mail, $onem, $cf['listingdom']['exclude']);  | 
                                                        |
| 446 | 446 | |
| 447 | 447 | /* Update count of each ip */  | 
                                                        
| 448 | -	        if ($host and ($uid!='NA') and ($uid!='unauthenticated') and ($uid!='unknown')) { /* IP is received by MX servers  and learned by valid uid */ | 
                                                        |
| 449 | - $ipuid['count']++; //number of right messages  | 
                                                        |
| 448 | +	        if ($host and ($uid != 'NA') and ($uid != 'unauthenticated') and ($uid != 'unknown')) { /* IP is received by MX servers  and learned by valid uid */ | 
                                                        |
| 449 | + $ipuid['count']++; //number of right messages  | 
                                                        |
| 450 | 450 | |
| 451 | -	                if (in_array($uid,array_keys($ipuid['uid']))) { | 
                                                        |
| 452 | - $ipuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        |
| 453 | - if (!in_array($ip,$ipuid['uid']["$uid"]))  | 
                                                        |
| 454 | - $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid  | 
                                                        |
| 451 | +	                if (in_array($uid, array_keys($ipuid['uid']))) { | 
                                                        |
| 452 | + $ipuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        |
| 453 | + if (!in_array($ip, $ipuid['uid']["$uid"]))  | 
                                                        |
| 454 | + $ipuid['uid']["$uid"][] = $ip; //ips learned by this uid  | 
                                                        |
| 455 | 455 | }  | 
                                                        
| 456 | 456 |  			else { | 
                                                        
| 457 | 457 | $ipuid['uid']["$uid"]['count'] = 1;  | 
                                                        
| 458 | - $ipuid['uid']["$uid"][]=$ip;  | 
                                                        |
| 459 | - $ipuid['uid']['count']++; //number of unique uids  | 
                                                        |
| 458 | + $ipuid['uid']["$uid"][] = $ip;  | 
                                                        |
| 459 | + $ipuid['uid']['count']++; //number of unique uids  | 
                                                        |
| 460 | 460 | }  | 
                                                        
| 461 | 461 | |
| 462 | -                        if (in_array($ip,array_keys($ipuid['ip']))) { | 
                                                        |
| 463 | - $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages  | 
                                                        |
| 464 | - if (!in_array($uid,$ipuid['ip']["$ip"]))  | 
                                                        |
| 465 | - $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip  | 
                                                        |
| 462 | +                        if (in_array($ip, array_keys($ipuid['ip']))) { | 
                                                        |
| 463 | + $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages  | 
                                                        |
| 464 | + if (!in_array($uid, $ipuid['ip']["$ip"]))  | 
                                                        |
| 465 | + $ipuid['ip']["$ip"][] = $uid; //uids that learned this ip  | 
                                                        |
| 466 | 466 | }  | 
                                                        
| 467 | 467 |                          else { | 
                                                        
| 468 | 468 | $ipuid['ip']["$ip"]['count'] = 1;  | 
                                                        
| 469 | - $ipuid['ip']["$ip"][]=$uid;  | 
                                                        |
| 470 | - $ipuid['ip']['count']++; //number of unique ips  | 
                                                        |
| 469 | + $ipuid['ip']["$ip"][] = $uid;  | 
                                                        |
| 470 | + $ipuid['ip']['count']++; //number of unique ips  | 
                                                        |
| 471 | 471 | }  | 
                                                        
| 472 | 472 | |
| 473 | 473 |  			foreach ($domains as $dom) { | 
                                                        
| 474 | 474 | $domuid['count']++;  | 
                                                        
| 475 | -				if (in_array($uid,array_keys($domuid['uid']))) { | 
                                                        |
| 476 | - $domuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        |
| 477 | - if (!in_array($dom,$domuid['uid']["$uid"]))  | 
                                                        |
| 478 | - $domuid['uid']["$uid"][]=$dom; //domains learned by this uid  | 
                                                        |
| 475 | +				if (in_array($uid, array_keys($domuid['uid']))) { | 
                                                        |
| 476 | + $domuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        |
| 477 | + if (!in_array($dom, $domuid['uid']["$uid"]))  | 
                                                        |
| 478 | + $domuid['uid']["$uid"][] = $dom; //domains learned by this uid  | 
                                                        |
| 479 | 479 | }  | 
                                                        
| 480 | 480 |  				else { | 
                                                        
| 481 | 481 | $domuid['uid']["$uid"]['count'] = 1;  | 
                                                        
| 482 | - $domuid['uid']["$uid"][]=$dom;  | 
                                                        |
| 483 | - $domuid['uid']['count']++; //number of unique uids  | 
                                                        |
| 482 | + $domuid['uid']["$uid"][] = $dom;  | 
                                                        |
| 483 | + $domuid['uid']['count']++; //number of unique uids  | 
                                                        |
| 484 | 484 | }  | 
                                                        
| 485 | 485 | |
| 486 | -				if (in_array($dom,array_keys($domuid['dom']))) { | 
                                                        |
| 487 | - $domuid['dom']["$dom"]['count']++; //number of learn with this domain  | 
                                                        |
| 488 | - if (!in_array($uid,$domuid['dom']["$dom"]))  | 
                                                        |
| 489 | - $domuid['dom']["$dom"][]=$uid; //uids that learned this domain  | 
                                                        |
| 486 | +				if (in_array($dom, array_keys($domuid['dom']))) { | 
                                                        |
| 487 | + $domuid['dom']["$dom"]['count']++; //number of learn with this domain  | 
                                                        |
| 488 | + if (!in_array($uid, $domuid['dom']["$dom"]))  | 
                                                        |
| 489 | + $domuid['dom']["$dom"][] = $uid; //uids that learned this domain  | 
                                                        |
| 490 | 490 | }  | 
                                                        
| 491 | 491 |  				else { | 
                                                        
| 492 | 492 | $domuid['dom']["$dom"]['count'] = 1;  | 
                                                        
| 493 | - $domuid['dom']["$dom"][]=$uid;  | 
                                                        |
| 494 | - $domuid['dom']['count']++; //number of unique domains  | 
                                                        |
| 493 | + $domuid['dom']["$dom"][] = $uid;  | 
                                                        |
| 494 | + $domuid['dom']['count']++; //number of unique domains  | 
                                                        |
| 495 | 495 | }  | 
                                                        
| 496 | 496 | |
| 497 | 497 | fwrite($fpd,  | 
                                                        
| 498 | - updateReport (  | 
                                                        |
| 499 | - $dom,$uid,$domuid['dom']["$dom"]['count'],  | 
                                                        |
| 500 | - $domuid['uid']["$uid"]['count'],$host,  | 
                                                        |
| 501 | - $dateClient,$mid,$dateReceived  | 
                                                        |
| 498 | + updateReport(  | 
                                                        |
| 499 | + $dom, $uid, $domuid['dom']["$dom"]['count'],  | 
                                                        |
| 500 | + $domuid['uid']["$uid"]['count'], $host,  | 
                                                        |
| 501 | + $dateClient, $mid, $dateReceived  | 
                                                        |
| 502 | 502 | )  | 
                                                        
| 503 | 503 | );  | 
                                                        
| 504 | 504 | }  | 
                                                        
| 505 | 505 | |
| 506 | 506 | /* Update HTML report */  | 
                                                        
| 507 | - fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) );  | 
                                                        |
| 507 | + fwrite($fp, updateReport($ip, $uid, $ipuid['ip']["$ip"]['count'], $ipuid['uid']["$uid"]['count'], $host, $dateClient, $mid, $dateReceived));  | 
                                                        |
| 508 | 508 | }  | 
                                                        
| 509 | 509 |  	        else {	/* Bad learn */ | 
                                                        
| 510 | 510 | |
| 511 | - if (in_array($uid,array_keys($uidbad['uid'])))  | 
                                                        |
| 512 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid  | 
                                                        |
| 511 | + if (in_array($uid, array_keys($uidbad['uid'])))  | 
                                                        |
| 512 | + $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid  | 
                                                        |
| 513 | 513 |                          else { | 
                                                        
| 514 | 514 | $uidbad['uid']["$uid"]['count'] = 1;  | 
                                                        
| 515 | - $uidbad['uid']["$uid"][]=$uid;  | 
                                                        |
| 516 | - $uidbad['count']++; //numeber of unique bad uids  | 
                                                        |
| 515 | + $uidbad['uid']["$uid"][] = $uid;  | 
                                                        |
| 516 | + $uidbad['count']++; //numeber of unique bad uids  | 
                                                        |
| 517 | 517 | }  | 
                                                        
| 518 | 518 | /* The reason of bad report */  | 
                                                        
| 519 | 519 | if ($host === FALSE) $reason = 'This mail was not received by recognized MX host';  | 
                                                        
| 520 | 520 | if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn';  | 
                                                        
| 521 | - if ($uid=='unknown') $reason = 'The uid of this mail was not found in splunk log';  | 
                                                        |
| 521 | + if ($uid == 'unknown') $reason = 'The uid of this mail was not found in splunk log';  | 
                                                        |
| 522 | 522 | if (!isset($reason)) $reason = '?';  | 
                                                        
| 523 | 523 | |
| 524 | - fwrite( $fpb,updatebadReport ( $uid,$dateClient,$mid,$dateReceived,$reason ) );  | 
                                                        |
| 524 | + fwrite($fpb, updatebadReport($uid, $dateClient, $mid, $dateReceived, $reason));  | 
                                                        |
| 525 | 525 | }  | 
                                                        
| 526 | 526 | }  | 
                                                        
| 527 | 527 | |
@@ -529,54 +529,54 @@ discard block  | 
                                                    ||
| 529 | 529 | //close report file and mailbox  | 
                                                        
| 530 | 530 | |
| 531 | 531 | /* Summary Report */  | 
                                                        
| 532 | -	$ipuid['ip'] = array_msort( $ipuid['ip'], array('count'=>SORT_DESC) ); | 
                                                        |
| 533 | -	$ipuid['uid'] = array_msort( $ipuid['uid'], array('count'=>SORT_DESC) ); | 
                                                        |
| 534 | -	$domuid['dom'] = array_msort( $domuid['dom'], array('count'=>SORT_DESC) ); | 
                                                        |
| 535 | -	$domuid['uid'] = array_msort( $domuid['uid'], array('count'=>SORT_DESC) ); | 
                                                        |
| 536 | -	$uidbad['uid'] = array_msort( $uidbad['uid'], array('count'=>SORT_DESC) ); | 
                                                        |
| 532 | +	$ipuid['ip'] = array_msort($ipuid['ip'], array('count'=>SORT_DESC)); | 
                                                        |
| 533 | +	$ipuid['uid'] = array_msort($ipuid['uid'], array('count'=>SORT_DESC)); | 
                                                        |
| 534 | +	$domuid['dom'] = array_msort($domuid['dom'], array('count'=>SORT_DESC)); | 
                                                        |
| 535 | +	$domuid['uid'] = array_msort($domuid['uid'], array('count'=>SORT_DESC)); | 
                                                        |
| 536 | +	$uidbad['uid'] = array_msort($uidbad['uid'], array('count'=>SORT_DESC)); | 
                                                        |
| 537 | 537 | |
| 538 | 538 | fwrite($fp, '</table>');  | 
                                                        
| 539 | 539 | fwrite($fpd, '</table>');  | 
                                                        
| 540 | - fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['listingip']['threshold']["$type"].' times from at least '.$cf['listingip']['thresholduid']["$type"].' different valid uids.</h5>' );  | 
                                                        |
| 541 | - fwrite($fpd, '<hr><h2>Summary Report</h2><h5>Listing policy: domains must be learned at least '.$cf['listingdom']['threshold']["$type"].' times from at least '.$cf['listingdom']['thresholduid']["$type"].' different valid uids.</h5>' );  | 
                                                        |
| 540 | + fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['listingip']['threshold']["$type"].' times from at least '.$cf['listingip']['thresholduid']["$type"].' different valid uids.</h5>');  | 
                                                        |
| 541 | + fwrite($fpd, '<hr><h2>Summary Report</h2><h5>Listing policy: domains must be learned at least '.$cf['listingdom']['threshold']["$type"].' times from at least '.$cf['listingdom']['thresholduid']["$type"].' different valid uids.</h5>');  | 
                                                        |
| 542 | 542 | |
| 543 | 543 | /* Make MYSQL connection */  | 
                                                        
| 544 | - if ( $cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"] )  | 
                                                        |
| 544 | + if ($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"])  | 
                                                        |
| 545 | 545 | $mysqli = NULL;  | 
                                                        
| 546 | 546 |  	else { | 
                                                        
| 547 | 547 | $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']);  | 
                                                        
| 548 | 548 |          	if ($mysqli->connect_error) { | 
                                                        
| 549 | -                	syslog (LOG_EMERG, $cf['syslog']['user'].': Connect Error (' . $mysqli->connect_errno . ') ' | 
                                                        |
| 549 | +                	syslog(LOG_EMERG, $cf['syslog']['user'].': Connect Error ('.$mysqli->connect_errno.') ' | 
                                                        |
| 550 | 550 | . $mysqli->connect_error);  | 
                                                        
| 551 | 551 | exit (254);  | 
                                                        
| 552 | 552 | }  | 
                                                        
| 553 | - syslog(LOG_INFO, $cf['syslog']['user'].': Successfully mysql connected to ' . $mysqli->host_info) ;  | 
                                                        |
| 553 | + syslog(LOG_INFO, $cf['syslog']['user'].': Successfully mysql connected to '.$mysqli->host_info);  | 
                                                        |
| 554 | 554 | }  | 
                                                        
| 555 | 555 | /***********************/  | 
                                                        
| 556 | 556 | |
| 557 | - fwrite($fp, summaryReportAndList ($cf,$mysqli,$tables,$type,$ipuid, 'ip') );  | 
                                                        |
| 558 | - fwrite($fp,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateFooter']));  | 
                                                        |
| 557 | + fwrite($fp, summaryReportAndList($cf, $mysqli, $tables, $type, $ipuid, 'ip'));  | 
                                                        |
| 558 | + fwrite($fp, file_get_contents(dirname(__FILE__).'/'.$cf['report']['reportTemplateFooter']));  | 
                                                        |
| 559 | 559 | fclose($fp);  | 
                                                        
| 560 | 560 | |
| 561 | - fwrite($fpd, summaryReportAndList ($cf,$mysqli,$tables,$type,$domuid, 'dom') );  | 
                                                        |
| 562 | - fwrite($fpd,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateFooter']));  | 
                                                        |
| 561 | + fwrite($fpd, summaryReportAndList($cf, $mysqli, $tables, $type, $domuid, 'dom'));  | 
                                                        |
| 562 | + fwrite($fpd, file_get_contents(dirname(__FILE__).'/'.$cf['report']['reportTemplateFooter']));  | 
                                                        |
| 563 | 563 | fclose($fpd);  | 
                                                        
| 564 | 564 | |
| 565 | - if ( !($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]) )  | 
                                                        |
| 565 | + if (!($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]))  | 
                                                        |
| 566 | 566 | $mysqli->close();  | 
                                                        
| 567 | 567 | |
| 568 | 568 | fwrite($fpb, '</table>');  | 
                                                        
| 569 | - fwrite( $fpb,summaryBadReport( $uidbad ) );  | 
                                                        |
| 570 | - fwrite($fpb,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateFooter']));  | 
                                                        |
| 569 | + fwrite($fpb, summaryBadReport($uidbad));  | 
                                                        |
| 570 | + fwrite($fpb, file_get_contents(dirname(__FILE__).'/'.$cf['report']['reportTemplateFooter']));  | 
                                                        |
| 571 | 571 | fclose($fpb);  | 
                                                        
| 572 | - syslog (LOG_INFO,$cf['syslog']['user'].': Report files written. Listing job for '.$type.' terminated.');  | 
                                                        |
| 573 | -  | 
                                                        |
| 574 | - if ( $ierr = imap_errors() )  | 
                                                        |
| 575 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 576 | - syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        |
| 577 | - if ( $ierr = imap_alerts() )  | 
                                                        |
| 578 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 579 | - syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        |
| 572 | + syslog(LOG_INFO, $cf['syslog']['user'].': Report files written. Listing job for '.$type.' terminated.');  | 
                                                        |
| 573 | +  | 
                                                        |
| 574 | + if ($ierr = imap_errors())  | 
                                                        |
| 575 | + foreach ($ierr as $thiserr)  | 
                                                        |
| 576 | + syslog(LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        |
| 577 | + if ($ierr = imap_alerts())  | 
                                                        |
| 578 | + foreach ($ierr as $thiserr)  | 
                                                        |
| 579 | + syslog(LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        |
| 580 | 580 | imap_close($m_mail);  | 
                                                        
| 581 | 581 | }  | 
                                                        
| 582 | 582 | ?>  | 
                                                        
@@ -10,21 +10,25 @@ discard block  | 
                                                    ||
| 10 | 10 |  	if ( preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m',$header,$received) ) { | 
                                                        
| 11 | 11 |  		for ($i = count($received[0])-1;$i>=0;$i--) { | 
                                                        
| 12 | 12 | # print "Examine ".$received[0][$i]."\n";  | 
                                                        
| 13 | - if ( preg_match($msa,$received['host'][$i]) )  | 
                                                        |
| 14 | - $dateR = $received['date'][$i];  | 
                                                        |
| 13 | +			if ( preg_match($msa,$received['host'][$i]) ) { | 
                                                        |
| 14 | + $dateR = $received['date'][$i];  | 
                                                        |
| 15 | + }  | 
                                                        |
| 15 | 16 |          		foreach ($mxserver as $mx) { | 
                                                        
| 16 | - if (!$ip)  | 
                                                        |
| 17 | -					if ($mx == $received['host'][$i]) { | 
                                                        |
| 17 | +        			if (!$ip) { | 
                                                        |
| 18 | +        								if ($mx == $received['host'][$i]) { | 
                                                        |
| 18 | 19 | $host = $received['host'][$i];  | 
                                                        
| 20 | + }  | 
                                                        |
| 19 | 21 | $ip = $received['ip'][$i];  | 
                                                        
| 20 | 22 | }  | 
                                                        
| 21 | 23 | }  | 
                                                        
| 22 | 24 | }  | 
                                                        
| 23 | 25 | }  | 
                                                        
| 24 | -	if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) | 
                                                        |
| 25 | - $dateC['date'] = 'Not found';  | 
                                                        |
| 26 | -	if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) | 
                                                        |
| 27 | - $mid['mid'] = NULL;  | 
                                                        |
| 26 | +	if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) { | 
                                                        |
| 27 | + $dateC['date'] = 'Not found';  | 
                                                        |
| 28 | + }  | 
                                                        |
| 29 | +	if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) { | 
                                                        |
| 30 | + $mid['mid'] = NULL;  | 
                                                        |
| 31 | + }  | 
                                                        |
| 28 | 32 | return array($ip,$host,$dateR,$dateC['date'],$mid['mid']);  | 
                                                        
| 29 | 33 | }  | 
                                                        
| 30 | 34 | |
@@ -40,7 +44,9 @@ discard block  | 
                                                    ||
| 40 | 44 | |
| 41 | 45 |  function summaryBadReport ($uidvet) { | 
                                                        
| 42 | 46 | $nuid = $uidvet['count'];  | 
                                                        
| 43 | - if ( empty($uidvet) ) return NULL;  | 
                                                        |
| 47 | +        if ( empty($uidvet) ) { | 
                                                        |
| 48 | + return NULL;  | 
                                                        |
| 49 | + }  | 
                                                        |
| 44 | 50 | $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n";  | 
                                                        
| 45 | 51 | |
| 46 | 52 | /* Remove count index */  | 
                                                        
@@ -75,8 +81,12 @@ discard block  | 
                                                    ||
| 75 | 81 |      foreach ($colarr as $col => $arr) { | 
                                                        
| 76 | 82 |          foreach ($arr as $k => $v) { | 
                                                        
| 77 | 83 | $k = substr($k,1);  | 
                                                        
| 78 | - if (!isset($ret[$k])) $ret[$k] = $array[$k];  | 
                                                        |
| 79 | - if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col];  | 
                                                        |
| 84 | +            if (!isset($ret[$k])) { | 
                                                        |
| 85 | + $ret[$k] = $array[$k];  | 
                                                        |
| 86 | + }  | 
                                                        |
| 87 | +            if (isset ($array[$k][$col])) { | 
                                                        |
| 88 | + $ret[$k][$col] = $array[$k][$col];  | 
                                                        |
| 89 | + }  | 
                                                        |
| 80 | 90 | }  | 
                                                        
| 81 | 91 | }  | 
                                                        
| 82 | 92 | return $ret;  | 
                                                        
@@ -87,14 +97,18 @@ discard block  | 
                                                    ||
| 87 | 97 |  function summaryReportAndList ($cf,$myconn,$tables,$category,$vet,$key) { | 
                                                        
| 88 | 98 | $nk = $vet['count'];  | 
                                                        
| 89 | 99 | |
| 90 | - if ( empty($vet) ) return NULL;  | 
                                                        |
| 100 | +	if ( empty($vet) ) { | 
                                                        |
| 101 | + return NULL;  | 
                                                        |
| 102 | + }  | 
                                                        |
| 91 | 103 | |
| 92 | 104 |  	$return = sprintf('<h3>Statistics by %s</h3><table><tr><th>%s</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this %s is currently listed, but it says if this %s has listed now!">Listed Now</th></tr>'."\n", strtoupper($key),strtoupper($key),$key,$key); | 
                                                        
| 93 | 105 | |
| 94 | 106 | $values = array_keys($vet["$key"]);  | 
                                                        
| 95 | 107 | |
| 96 | 108 |  	foreach ( $values as $value ) { | 
                                                        
| 97 | - if ( $value == 'count' ) continue;  | 
                                                        |
| 109 | +		if ( $value == 'count' ) { | 
                                                        |
| 110 | + continue;  | 
                                                        |
| 111 | + }  | 
                                                        |
| 98 | 112 | $nlearn = $vet["$key"]["$value"]['count'];  | 
                                                        
| 99 | 113 | unset($vet["$key"]["$value"]['count']);  | 
                                                        
| 100 | 114 | $quantity = $cf["listing$key"]['quantity']["$category"]; /* In searchAndList this value is  | 
                                                        
@@ -106,10 +120,12 @@ discard block  | 
                                                    ||
| 106 | 120 | 'The %s <%s> has been listed because was marked %u times as %s by %u different accounts during last %u days.',  | 
                                                        
| 107 | 121 | strtoupper($key),$value,$nlearn,$category,$nuid,$cf['imap']['oldestday']);  | 
                                                        
| 108 | 122 | $listed = searchAndList ($myconn,$cf['syslog']['user'],$tables,$cf["listing$key"]['list']["$category"],$value,$cf["listing$key"]['unit']["$category"],$quantity,$reason);  | 
                                                        
| 123 | +			} else { | 
                                                        |
| 124 | + $listed = FALSE;  | 
                                                        |
| 109 | 125 | }  | 
                                                        
| 110 | - else $listed = FALSE;  | 
                                                        |
| 126 | +		} else { | 
                                                        |
| 127 | + $listed = FALSE;  | 
                                                        |
| 111 | 128 | }  | 
                                                        
| 112 | - else $listed = FALSE;  | 
                                                        |
| 113 | 129 | $nowlist = array( TRUE => array(  | 
                                                        
| 114 | 130 | 'style' => 'id=\'ipfound\'',  | 
                                                        
| 115 | 131 | 'name' => 'YES',  | 
                                                        
@@ -127,7 +143,9 @@ discard block  | 
                                                    ||
| 127 | 143 | $return .='<tr><td rowspan="'.$nuid.'">'.$value.'</td>';  | 
                                                        
| 128 | 144 |  		$return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$vet["$key"]["$value"][0],$nlearn,$nowlist["$listed"]['name']); | 
                                                        
| 129 | 145 | $rowuid=NULL;  | 
                                                        
| 130 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 146 | +                for ($j=1;$j<$nuid;$j++) { | 
                                                        |
| 147 | + $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 148 | + }  | 
                                                        |
| 131 | 149 | array_shift($vet["$key"]["$value"]);  | 
                                                        
| 132 | 150 | $return .= vsprintf ($rowuid,$vet["$key"]["$value"]);  | 
                                                        
| 133 | 151 | |
@@ -140,14 +158,18 @@ discard block  | 
                                                    ||
| 140 | 158 |  	$return .= sprintf('<h3>Statistics by UID</h3><table><tr><th>UID</th><th>%s learned</th><th>Learned times</th></tr>'."\n",$key); | 
                                                        
| 141 | 159 | $uids = array_keys($vet['uid']);  | 
                                                        
| 142 | 160 |          foreach ( $uids as $uid ) { | 
                                                        
| 143 | - if ( $uid == 'count' ) continue;  | 
                                                        |
| 161 | +		if ( $uid == 'count' ) { | 
                                                        |
| 162 | + continue;  | 
                                                        |
| 163 | + }  | 
                                                        |
| 144 | 164 | $nlearn = $vet['uid']["$uid"]['count'];  | 
                                                        
| 145 | 165 | unset ( $vet['uid']["$uid"]['count'] );  | 
                                                        
| 146 | 166 | $nip = count($vet['uid']["$uid"]);  | 
                                                        
| 147 | 167 | $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>';  | 
                                                        
| 148 | 168 |  		$return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$vet['uid']["$uid"][0],$nlearn); | 
                                                        
| 149 | 169 | $rowuid=NULL;  | 
                                                        
| 150 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 170 | +                for ($j=1;$j<$nip;$j++) { | 
                                                        |
| 171 | + $rowuid .= '<tr><td>%s</td></tr>';  | 
                                                        |
| 172 | + }  | 
                                                        |
| 151 | 173 | array_shift($vet['uid']["$uid"]);  | 
                                                        
| 152 | 174 | $return .= vsprintf ($rowuid,$vet['uid']["$uid"]);  | 
                                                        
| 153 | 175 | |
@@ -197,14 +219,14 @@ discard block  | 
                                                    ||
| 197 | 219 |  	    { | 
                                                        
| 198 | 220 | // More than one field attribute returned by search  | 
                                                        
| 199 | 221 | // You must redefine the search  | 
                                                        
| 200 | - if ( count($result->getFieldNames()) > 1 ) return FALSE;  | 
                                                        |
| 201 | - }  | 
                                                        |
| 202 | - else if ($result instanceof Splunk_ResultsMessage)  | 
                                                        |
| 222 | +	      if ( count($result->getFieldNames()) > 1 ) { | 
                                                        |
| 223 | + return FALSE;  | 
                                                        |
| 224 | + }  | 
                                                        |
| 225 | + } else if ($result instanceof Splunk_ResultsMessage)  | 
                                                        |
| 203 | 226 |  	    { | 
                                                        
| 204 | 227 | // I don't want messages in my search  | 
                                                        
| 205 | 228 | return FALSE;  | 
                                                        
| 206 | - }  | 
                                                        |
| 207 | - else if (is_array($result))  | 
                                                        |
| 229 | + } else if (is_array($result))  | 
                                                        |
| 208 | 230 |  	    { | 
                                                        
| 209 | 231 | // Process a row  | 
                                                        
| 210 | 232 | foreach ($result as $key => $valueOrValues)  | 
                                                        
@@ -212,15 +234,13 @@ discard block  | 
                                                    ||
| 212 | 234 | if (is_array($valueOrValues))  | 
                                                        
| 213 | 235 |  	          { | 
                                                        
| 214 | 236 | return FALSE;  | 
                                                        
| 215 | - }  | 
                                                        |
| 216 | - else  | 
                                                        |
| 237 | + } else  | 
                                                        |
| 217 | 238 |  	          { | 
                                                        
| 218 | 239 | return $valueOrValues;  | 
                                                        
| 219 | 240 |  	            #print "  {$key} => {$value}\r\n"; | 
                                                        
| 220 | 241 | }  | 
                                                        
| 221 | 242 | }  | 
                                                        
| 222 | - }  | 
                                                        |
| 223 | - else  | 
                                                        |
| 243 | + } else  | 
                                                        |
| 224 | 244 |  	    { | 
                                                        
| 225 | 245 | #print "Unknow result type";  | 
                                                        
| 226 | 246 | return FALSE;  | 
                                                        
@@ -240,11 +260,9 @@ discard block  | 
                                                    ||
| 240 | 260 |                  if(isset($part->parts)) { | 
                                                        
| 241 | 261 |                          if($part->type == 2) { | 
                                                        
| 242 | 262 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.', 0, false);  | 
                                                        
| 243 | - }  | 
                                                        |
| 244 | -                        elseif($fullPrefix) { | 
                                                        |
| 263 | +                        } elseif($fullPrefix) { | 
                                                        |
| 245 | 264 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.');  | 
                                                        
| 246 | - }  | 
                                                        |
| 247 | -                        else { | 
                                                        |
| 265 | +                        } else { | 
                                                        |
| 248 | 266 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix);  | 
                                                        
| 249 | 267 | }  | 
                                                        
| 250 | 268 | unset($flattenedParts[$prefix.$index]->parts);  | 
                                                        
@@ -281,8 +299,9 @@ discard block  | 
                                                    ||
| 281 | 299 |  	if ( ($num_found !== FALSE) && ($num_found>0) ) { | 
                                                        
| 282 | 300 |  		foreach ($out[0] as $url) { | 
                                                        
| 283 | 301 | $dom=nsdom(parse_url($url, PHP_URL_HOST));  | 
                                                        
| 284 | - if (!( empty($dom) || in_array($dom,$exclude) ))  | 
                                                        |
| 285 | - $ret[] = $dom;  | 
                                                        |
| 302 | +			if (!( empty($dom) || in_array($dom,$exclude) )) { | 
                                                        |
| 303 | + $ret[] = $dom;  | 
                                                        |
| 304 | + }  | 
                                                        |
| 286 | 305 | }  | 
                                                        
| 287 | 306 | }  | 
                                                        
| 288 | 307 | return array_values(array_unique($ret));  | 
                                                        
@@ -320,12 +339,13 @@ discard block  | 
                                                    ||
| 320 | 339 | }  | 
                                                        
| 321 | 340 | |
| 322 | 341 | }  | 
                                                        
| 342 | +	} else { | 
                                                        |
| 343 | + $message = getPart($connection, $messageNumber, 1, $structure->encoding);  | 
                                                        |
| 323 | 344 | }  | 
                                                        
| 324 | - else  | 
                                                        |
| 325 | - $message = getPart($connection, $messageNumber, 1, $structure->encoding);  | 
                                                        |
| 326 | 345 | |
| 327 | - if ( !empty($message) )  | 
                                                        |
| 328 | - return getDomains($message, $exclusionList);  | 
                                                        |
| 346 | +	if ( !empty($message) ) { | 
                                                        |
| 347 | + return getDomains($message, $exclusionList);  | 
                                                        |
| 348 | + }  | 
                                                        |
| 329 | 349 | return array();  | 
                                                        
| 330 | 350 | }  | 
                                                        
| 331 | 351 | |
@@ -360,7 +380,9 @@ discard block  | 
                                                    ||
| 360 | 380 | $fileb= dirname(__FILE__) . '/' . $cf['report']['badreportFile']["$type"];  | 
                                                        
| 361 | 381 |  	$m_mail = imap_open('{'.$cf['imap']['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['imap']['authuser'].'}'.$cf['imap']['folder']["$type"], $cf['imap']['account'],$cf['imap']['authpassword'], OP_READONLY) | 
                                                        
| 362 | 382 | or syslog (LOG_EMERG, $cf['syslog']['user'].': Error in IMAP connection to <'.$cf['imap']['mailhost'].'>: ' . imap_last_error());  | 
                                                        
| 363 | - if ( !$m_mail ) exit(254);  | 
                                                        |
| 383 | +	if ( !$m_mail ) { | 
                                                        |
| 384 | + exit(254);  | 
                                                        |
| 385 | + }  | 
                                                        |
| 364 | 386 | |
| 365 | 387 | |
| 366 | 388 | syslog (LOG_INFO,$cf['syslog']['user'].': Successfully connected to <'.$cf['imap']['mailhost'].">; Reading $type messages of last ".$cf['imap']['oldestday'].' days...');  | 
                                                        
@@ -372,21 +394,31 @@ discard block  | 
                                                    ||
| 372 | 394 | // Order results starting from newest message  | 
                                                        
| 373 | 395 |  	if ( empty($m_search) ) { | 
                                                        
| 374 | 396 | syslog (LOG_INFO,$cf['syslog']['user'].": No mail found in $type folder. No reports written for $type.");  | 
                                                        
| 375 | - if ( $ierr = imap_errors() )  | 
                                                        |
| 376 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 397 | +	        if ( $ierr = imap_errors() ) { | 
                                                        |
| 398 | + foreach ( $ierr as $thiserr )  | 
                                                        |
| 377 | 399 | syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        
| 378 | - if ( $ierr = imap_alerts() )  | 
                                                        |
| 379 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 400 | + }  | 
                                                        |
| 401 | +	        if ( $ierr = imap_alerts() ) { | 
                                                        |
| 402 | + foreach ( $ierr as $thiserr )  | 
                                                        |
| 380 | 403 | syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        
| 404 | + }  | 
                                                        |
| 381 | 405 | imap_close( $m_mail );  | 
                                                        
| 382 | - if ( file_exists( $file ) ) unlink ($file);  | 
                                                        |
| 383 | - if ( file_exists( $filed ) ) unlink ($filed);  | 
                                                        |
| 384 | - if ( file_exists( $fileb ) ) unlink ($fileb);  | 
                                                        |
| 406 | +		if ( file_exists( $file ) ) { | 
                                                        |
| 407 | + unlink ($file);  | 
                                                        |
| 408 | + }  | 
                                                        |
| 409 | +		if ( file_exists( $filed ) ) { | 
                                                        |
| 410 | + unlink ($filed);  | 
                                                        |
| 411 | + }  | 
                                                        |
| 412 | +		if ( file_exists( $fileb ) ) { | 
                                                        |
| 413 | + unlink ($fileb);  | 
                                                        |
| 414 | + }  | 
                                                        |
| 385 | 415 | return FALSE;  | 
                                                        
| 386 | 416 | }  | 
                                                        
| 387 | 417 | $nmes = count ($m_search);  | 
                                                        
| 388 | 418 | syslog (LOG_INFO,$cf['syslog']['user'].": Found $nmes mail in $type folder.");  | 
                                                        
| 389 | - if ($nmes>0) rsort($m_search);  | 
                                                        |
| 419 | +	if ($nmes>0) { | 
                                                        |
| 420 | + rsort($m_search);  | 
                                                        |
| 421 | + }  | 
                                                        |
| 390 | 422 | |
| 391 | 423 | // Create report file  | 
                                                        
| 392 | 424 | |
@@ -450,10 +482,11 @@ discard block  | 
                                                    ||
| 450 | 482 | |
| 451 | 483 |  	                if (in_array($uid,array_keys($ipuid['uid']))) { | 
                                                        
| 452 | 484 | $ipuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        
| 453 | - if (!in_array($ip,$ipuid['uid']["$uid"]))  | 
                                                        |
| 454 | - $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid  | 
                                                        |
| 455 | - }  | 
                                                        |
| 456 | -			else { | 
                                                        |
| 485 | +				if (!in_array($ip,$ipuid['uid']["$uid"])) { | 
                                                        |
| 486 | + $ipuid['uid']["$uid"][]=$ip;  | 
                                                        |
| 487 | + }  | 
                                                        |
| 488 | + //ips learned by this uid  | 
                                                        |
| 489 | +			} else { | 
                                                        |
| 457 | 490 | $ipuid['uid']["$uid"]['count'] = 1;  | 
                                                        
| 458 | 491 | $ipuid['uid']["$uid"][]=$ip;  | 
                                                        
| 459 | 492 | $ipuid['uid']['count']++; //number of unique uids  | 
                                                        
@@ -461,10 +494,11 @@ discard block  | 
                                                    ||
| 461 | 494 | |
| 462 | 495 |                          if (in_array($ip,array_keys($ipuid['ip']))) { | 
                                                        
| 463 | 496 | $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages  | 
                                                        
| 464 | - if (!in_array($uid,$ipuid['ip']["$ip"]))  | 
                                                        |
| 465 | - $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip  | 
                                                        |
| 466 | - }  | 
                                                        |
| 467 | -                        else { | 
                                                        |
| 497 | +				if (!in_array($uid,$ipuid['ip']["$ip"])) { | 
                                                        |
| 498 | + $ipuid['ip']["$ip"][]=$uid;  | 
                                                        |
| 499 | + }  | 
                                                        |
| 500 | + //uids that learned this ip  | 
                                                        |
| 501 | +			} else { | 
                                                        |
| 468 | 502 | $ipuid['ip']["$ip"]['count'] = 1;  | 
                                                        
| 469 | 503 | $ipuid['ip']["$ip"][]=$uid;  | 
                                                        
| 470 | 504 | $ipuid['ip']['count']++; //number of unique ips  | 
                                                        
@@ -474,10 +508,11 @@ discard block  | 
                                                    ||
| 474 | 508 | $domuid['count']++;  | 
                                                        
| 475 | 509 |  				if (in_array($uid,array_keys($domuid['uid']))) { | 
                                                        
| 476 | 510 | $domuid['uid']["$uid"]['count']++; //number of learn by this uid  | 
                                                        
| 477 | - if (!in_array($dom,$domuid['uid']["$uid"]))  | 
                                                        |
| 478 | - $domuid['uid']["$uid"][]=$dom; //domains learned by this uid  | 
                                                        |
| 479 | - }  | 
                                                        |
| 480 | -				else { | 
                                                        |
| 511 | +					if (!in_array($dom,$domuid['uid']["$uid"])) { | 
                                                        |
| 512 | + $domuid['uid']["$uid"][]=$dom;  | 
                                                        |
| 513 | + }  | 
                                                        |
| 514 | + //domains learned by this uid  | 
                                                        |
| 515 | +				} else { | 
                                                        |
| 481 | 516 | $domuid['uid']["$uid"]['count'] = 1;  | 
                                                        
| 482 | 517 | $domuid['uid']["$uid"][]=$dom;  | 
                                                        
| 483 | 518 | $domuid['uid']['count']++; //number of unique uids  | 
                                                        
@@ -485,10 +520,11 @@ discard block  | 
                                                    ||
| 485 | 520 | |
| 486 | 521 |  				if (in_array($dom,array_keys($domuid['dom']))) { | 
                                                        
| 487 | 522 | $domuid['dom']["$dom"]['count']++; //number of learn with this domain  | 
                                                        
| 488 | - if (!in_array($uid,$domuid['dom']["$dom"]))  | 
                                                        |
| 489 | - $domuid['dom']["$dom"][]=$uid; //uids that learned this domain  | 
                                                        |
| 490 | - }  | 
                                                        |
| 491 | -				else { | 
                                                        |
| 523 | +					if (!in_array($uid,$domuid['dom']["$dom"])) { | 
                                                        |
| 524 | + $domuid['dom']["$dom"][]=$uid;  | 
                                                        |
| 525 | + }  | 
                                                        |
| 526 | + //uids that learned this domain  | 
                                                        |
| 527 | +				} else { | 
                                                        |
| 492 | 528 | $domuid['dom']["$dom"]['count'] = 1;  | 
                                                        
| 493 | 529 | $domuid['dom']["$dom"][]=$uid;  | 
                                                        
| 494 | 530 | $domuid['dom']['count']++; //number of unique domains  | 
                                                        
@@ -505,21 +541,30 @@ discard block  | 
                                                    ||
| 505 | 541 | |
| 506 | 542 | /* Update HTML report */  | 
                                                        
| 507 | 543 | fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) );  | 
                                                        
| 508 | - }  | 
                                                        |
| 509 | -	        else {	/* Bad learn */ | 
                                                        |
| 544 | +		} else {	/* Bad learn */ | 
                                                        |
| 510 | 545 | |
| 511 | - if (in_array($uid,array_keys($uidbad['uid'])))  | 
                                                        |
| 512 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid  | 
                                                        |
| 546 | +                        if (in_array($uid,array_keys($uidbad['uid']))) { | 
                                                        |
| 547 | + $uidbad['uid']["$uid"]['count']++;  | 
                                                        |
| 548 | + }  | 
                                                        |
| 549 | + //number of bad learn by this uid  | 
                                                        |
| 513 | 550 |                          else { | 
                                                        
| 514 | 551 | $uidbad['uid']["$uid"]['count'] = 1;  | 
                                                        
| 515 | 552 | $uidbad['uid']["$uid"][]=$uid;  | 
                                                        
| 516 | 553 | $uidbad['count']++; //numeber of unique bad uids  | 
                                                        
| 517 | 554 | }  | 
                                                        
| 518 | 555 | /* The reason of bad report */  | 
                                                        
| 519 | - if ($host === FALSE) $reason = 'This mail was not received by recognized MX host';  | 
                                                        |
| 520 | - if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn';  | 
                                                        |
| 521 | - if ($uid=='unknown') $reason = 'The uid of this mail was not found in splunk log';  | 
                                                        |
| 522 | - if (!isset($reason)) $reason = '?';  | 
                                                        |
| 556 | +			if ($host === FALSE) { | 
                                                        |
| 557 | + $reason = 'This mail was not received by recognized MX host';  | 
                                                        |
| 558 | + }  | 
                                                        |
| 559 | +			if ($dateReceived === FALSE) { | 
                                                        |
| 560 | + $reason = 'This mail was not submitted to recognized MSA for learn';  | 
                                                        |
| 561 | + }  | 
                                                        |
| 562 | +			if ($uid=='unknown') { | 
                                                        |
| 563 | + $reason = 'The uid of this mail was not found in splunk log';  | 
                                                        |
| 564 | + }  | 
                                                        |
| 565 | +			if (!isset($reason)) { | 
                                                        |
| 566 | + $reason = '?';  | 
                                                        |
| 567 | + }  | 
                                                        |
| 523 | 568 | |
| 524 | 569 | fwrite( $fpb,updatebadReport ( $uid,$dateClient,$mid,$dateReceived,$reason ) );  | 
                                                        
| 525 | 570 | }  | 
                                                        
@@ -541,9 +586,9 @@ discard block  | 
                                                    ||
| 541 | 586 | fwrite($fpd, '<hr><h2>Summary Report</h2><h5>Listing policy: domains must be learned at least '.$cf['listingdom']['threshold']["$type"].' times from at least '.$cf['listingdom']['thresholduid']["$type"].' different valid uids.</h5>' );  | 
                                                        
| 542 | 587 | |
| 543 | 588 | /* Make MYSQL connection */  | 
                                                        
| 544 | - if ( $cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"] )  | 
                                                        |
| 545 | - $mysqli = NULL;  | 
                                                        |
| 546 | -	else { | 
                                                        |
| 589 | +	if ( $cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"] ) { | 
                                                        |
| 590 | + $mysqli = NULL;  | 
                                                        |
| 591 | +	} else { | 
                                                        |
| 547 | 592 | $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']);  | 
                                                        
| 548 | 593 |          	if ($mysqli->connect_error) { | 
                                                        
| 549 | 594 |                  	syslog (LOG_EMERG, $cf['syslog']['user'].': Connect Error (' . $mysqli->connect_errno . ') ' | 
                                                        
@@ -562,8 +607,9 @@ discard block  | 
                                                    ||
| 562 | 607 | fwrite($fpd,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateFooter']));  | 
                                                        
| 563 | 608 | fclose($fpd);  | 
                                                        
| 564 | 609 | |
| 565 | - if ( !($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]) )  | 
                                                        |
| 566 | - $mysqli->close();  | 
                                                        |
| 610 | +	if ( !($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]) ) { | 
                                                        |
| 611 | + $mysqli->close();  | 
                                                        |
| 612 | + }  | 
                                                        |
| 567 | 613 | |
| 568 | 614 | fwrite($fpb, '</table>');  | 
                                                        
| 569 | 615 | fwrite( $fpb,summaryBadReport( $uidbad ) );  | 
                                                        
@@ -571,12 +617,14 @@ discard block  | 
                                                    ||
| 571 | 617 | fclose($fpb);  | 
                                                        
| 572 | 618 | syslog (LOG_INFO,$cf['syslog']['user'].': Report files written. Listing job for '.$type.' terminated.');  | 
                                                        
| 573 | 619 | |
| 574 | - if ( $ierr = imap_errors() )  | 
                                                        |
| 575 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 620 | +	if ( $ierr = imap_errors() ) { | 
                                                        |
| 621 | + foreach ( $ierr as $thiserr )  | 
                                                        |
| 576 | 622 | syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr");  | 
                                                        
| 577 | - if ( $ierr = imap_alerts() )  | 
                                                        |
| 578 | - foreach ( $ierr as $thiserr )  | 
                                                        |
| 623 | + }  | 
                                                        |
| 624 | +	if ( $ierr = imap_alerts() ) { | 
                                                        |
| 625 | + foreach ( $ierr as $thiserr )  | 
                                                        |
| 579 | 626 | syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr");  | 
                                                        
| 627 | + }  | 
                                                        |
| 580 | 628 | imap_close($m_mail);  | 
                                                        
| 581 | 629 | }  | 
                                                        
| 582 | 630 | ?>  |