<commit_before><?php 
// get built-in php classes
$system_classes = get_declared_classes();
$system_classes[] = 'DB';

include '../lib/common.php';

$session_id1 = (!empty($_POST['session_id'])) ? preg_replace("/[^0-9]/","",$_POST['session_id']) : false;
$signature1 = (!empty($_POST['signature'])) ? hex2bin($_POST['signature']) : false;
$nonce1 = (!empty($_POST['nonce'])) ? preg_replace("/[^0-9]/","",$_POST['nonce']) : false;
$token1 = (!empty($_POST['token'])) ? preg_replace("/[^0-9]/","",$_POST['token']) : false;
$settings_change_id1 = (!empty($_POST['settings_change_id'])) ? $_REQUEST['settings_change_id'] : false;
$request_id1 = (!empty($_POST['request_id'])) ? $_REQUEST['request_id'] : false;
$api_key1 = (!empty($_POST['api_key'])) ? preg_replace("/[^0-9a-zA-Z]/","",$_POST['api_key']) : false;
$api_signature1 = (!empty($_POST['api_signature'])) ? preg_replace("/[^0-9a-zA-Z]/","",$_POST['api_signature']) : false;
$raw_params_json = (!empty($_POST['raw_params_json'])) ? $_POST['raw_params_json'] : false;
$update_nonce = false;

$CFG->language = (!empty($_POST['lang']) && in_array(strtolower($_POST['lang']),array('en','es','ru','zh'))) ? strtolower($_POST['lang']) : false;
$CFG->client_ip = (!empty($_POST['ip'])) ? preg_replace("/[^0-9\.]/","",$_POST['ip']) : false;
$CFG->session_id = $session_id1;
$CFG->session_locked = false;
$CFG->session_active = false;
$CFG->session_api = false;
$CFG->token_verified = false;
$CFG->email_2fa_verified = false;

// commands is of form array('Class1'=>array('method1'=>array('arg1'=>blah,'arg2'=>bob)));
$commands = (!empty($_POST['commands'])) ? json_decode($_POST['commands'],true) : false;

// authenticate session
if ($session_id1) {
	$result = db_query_array('SELECT sessions.nonce AS nonce ,sessions.session_key AS session_key, sessions.awaiting AS awaiting, site_users.* FROM sessions LEFT JOIN site_users ON (sessions.user_id = site_users.id) WHERE sessions.session_id = '.$session_id1);
	$return['session'] = $session_id1;
	if ($result && ($nonce1 >= ($result[0]['nonce'] + 5) || $nonce1 <= ($result[0]['nonce'] - 5))) {
		$return['error'] = 'invalid-nonce';
	}
	elseif (!empty($result)) {
		if (!empty($_POST['commands']) && openssl_verify($_POST['commands'],$signature1,$result[0]['session_key'])) {
			User::setInfo($result[0]);
			$update_nonce = $_POST['update_nonce'];
			
			if (User::$info['locked'] == 'Y' || User::$info['deactivated'] == 'Y') {
				$return['error'] = 'account-locked-or-deactivated';
				$CFG->session_locked = true;
			}
			else {
				$CFG->session_active = true;
			}
			
			if (empty($CFG->language))
				$CFG->language = $result[0]['last_lang'];
		}
		else
			$return['error'] = 'invalid-signature';
	}
	else 
		$return['error'] = 'session-not-found';
}

// verify api key
if ($api_key1 && $api_signature1) {
	$result = db_query_array('SELECT api_keys.id AS key_id, api_keys.nonce AS nonce, api_keys.key AS api_key, api_keys.secret AS secret, api_keys.view AS p_view, api_keys.orders AS p_orders, api_keys.withdraw AS p_withdraw, site_users.* FROM api_keys LEFT JOIN site_users ON (api_keys.site_user = site_users.id) WHERE api_keys.key = "'.$api_key1.'"');
	if ($result && $nonce1 <= ($result[0]['nonce'] - 5)) {
		$return['error'] = 'AUTH_INVALID_NONCE';
	}
	elseif ($result && !($result[0]['id'] > 0)) {
		$return['error'] = 'AUTH_USER_NOT_FOUND';
	}
	elseif (!empty($result)) {
		if ($raw_params_json) {
			$decoded = json_decode($raw_params_json,1);
			$decoded['api_key'] = $result[0]['api_key'];<commit_msg>Truncating nonce at 10 integers when forgiving race conditions.<commit_after><?php 
// get built-in php classes
$system_classes = get_declared_classes();
$system_classes[] = 'DB';

include '../lib/common.php';

$session_id1 = (!empty($_POST['session_id'])) ? preg_replace("/[^0-9]/","",$_POST['session_id']) : false;
$signature1 = (!empty($_POST['signature'])) ? hex2bin($_POST['signature']) : false;
$nonce1 = (!empty($_POST['nonce'])) ? preg_replace("/[^0-9]/","",$_POST['nonce']) : false;
$token1 = (!empty($_POST['token'])) ? preg_replace("/[^0-9]/","",$_POST['token']) : false;
$settings_change_id1 = (!empty($_POST['settings_change_id'])) ? $_REQUEST['settings_change_id'] : false;
$request_id1 = (!empty($_POST['request_id'])) ? $_REQUEST['request_id'] : false;
$api_key1 = (!empty($_POST['api_key'])) ? preg_replace("/[^0-9a-zA-Z]/","",$_POST['api_key']) : false;
$api_signature1 = (!empty($_POST['api_signature'])) ? preg_replace("/[^0-9a-zA-Z]/","",$_POST['api_signature']) : false;
$raw_params_json = (!empty($_POST['raw_params_json'])) ? $_POST['raw_params_json'] : false;
$update_nonce = false;

$CFG->language = (!empty($_POST['lang']) && in_array(strtolower($_POST['lang']),array('en','es','ru','zh'))) ? strtolower($_POST['lang']) : false;
$CFG->client_ip = (!empty($_POST['ip'])) ? preg_replace("/[^0-9\.]/","",$_POST['ip']) : false;
$CFG->session_id = $session_id1;
$CFG->session_locked = false;
$CFG->session_active = false;
$CFG->session_api = false;
$CFG->token_verified = false;
$CFG->email_2fa_verified = false;

// commands is of form array('Class1'=>array('method1'=>array('arg1'=>blah,'arg2'=>bob)));
$commands = (!empty($_POST['commands'])) ? json_decode($_POST['commands'],true) : false;

// authenticate session
if ($session_id1) {
	$result = db_query_array('SELECT sessions.nonce AS nonce ,sessions.session_key AS session_key, sessions.awaiting AS awaiting, site_users.* FROM sessions LEFT JOIN site_users ON (sessions.user_id = site_users.id) WHERE sessions.session_id = '.$session_id1);
	$return['session'] = $session_id1;
	if ($result && ($nonce1 >= ($result[0]['nonce'] + 5) || $nonce1 <= ($result[0]['nonce'] - 5))) {
		$return['error'] = 'invalid-nonce';
	}
	elseif (!empty($result)) {
		if (!empty($_POST['commands']) && openssl_verify($_POST['commands'],$signature1,$result[0]['session_key'])) {
			User::setInfo($result[0]);
			$update_nonce = $_POST['update_nonce'];
			
			if (User::$info['locked'] == 'Y' || User::$info['deactivated'] == 'Y') {
				$return['error'] = 'account-locked-or-deactivated';
				$CFG->session_locked = true;
			}
			else {
				$CFG->session_active = true;
			}
			
			if (empty($CFG->language))
				$CFG->language = $result[0]['last_lang'];
		}
		else
			$return['error'] = 'invalid-signature';
	}
	else 
		$return['error'] = 'session-not-found';
}

// verify api key
if ($api_key1 && $api_signature1) {
	$result = db_query_array('SELECT api_keys.id AS key_id, api_keys.nonce AS nonce, api_keys.key AS api_key, api_keys.secret AS secret, api_keys.view AS p_view, api_keys.orders AS p_orders, api_keys.withdraw AS p_withdraw, site_users.* FROM api_keys LEFT JOIN site_users ON (api_keys.site_user = site_users.id) WHERE api_keys.key = "'.$api_key1.'"');
	if ($result && floatval(substr(strval($nonce1),0,10)) <= (floatval(substr(strval($result[0]['nonce']),0,10)) - 5)) {
		$return['error'] = 'AUTH_INVALID_NONCE';
	}
	elseif ($result && !($result[0]['id'] > 0)) {
		$return['error'] = 'AUTH_USER_NOT_FOUND';
	}
	elseif (!empty($result)) {
		if ($raw_params_json) {
			$decoded = json_decode($raw_params_json,1);
			$decoded['api_key'] = $result[0]['api_key'];
{'fraction_non_alphanumeric': 0.2322878745449454, 'fraction_numerical': 0.01512181461775413, 'mean_word_length': 6.303680981595092, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 39, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '601546', 'n_tokens_mistral': 2673, 'n_tokens_neox': 2545, 'n_words': 427}