Project

General

Profile

« Previous | Next » 

Revision 2125

Added by darkviper almost 9 years ago

! /framework/class.Login.php
! /account/ ~login_form.php ~login.php
! /admin/login/index.php
fixed some possible intruder vectors and complete 2.8.4 adaption

View differences:

login.php
15 15 
 *
16 16 
 */
17 17 

  		




  18
  
  
    
// Include config file


  		




  19
  
  
    
$config_file = realpath('../config.php');


  		




  20
  
  
    
if(file_exists($config_file) && !defined('WB_URL'))


  		




  21
  
  
    
{


  		




  22
  
  
    
	require_once($config_file);


  		




  23
  
  
    
}


  		




  
  18
  
    
// Include the configuration file


  		




  
  19
  
    
$sStartFile = dirname(__DIR__).'/framework/initialize.php';


  		




  
  20
  
    
if (!defined('SYSTEM_RUN')) { require($sStartFile); }


  		




  
  21
  
    
require_once($oReg->AppPath.'framework/functions.php');


  		




  24
  22
  
    

  		




  25
  
  
    
//if(!class_exists('login', false)){ include(WB_PATH.'/framework/class.login.php'); }


  		




  26
  
  
    
//if(!class_exists('frontend', false)){ include(WB_PATH.'/framework/class.frontend.php'); }


  		




  27
  
  
    

  		




  28
  
  
    
require_once(WB_PATH.'/framework/functions.php');


  		




  29
  
  
    

  		




  30
  23
  
    
$wb = new frontend(false);


  		




  31
  24
  
    

  		




  32
  25
  
    
// Make sure the login is enabled


  		




  33
  
  
    
if(!FRONTEND_LOGIN) {


  		




  34
  
  
    
		header('Location: '.WB_URL.'/');


  		




  35
  
  
    
		exit(0);


  		




  36
  
  
    
//	if(INTRO_PAGE) {


  		




  37
  
  
    
//		header('Location: '.WB_URL.PAGES_DIRECTORY.'/index.php');


  		




  38
  
  
    
//		exit(0);


  		




  39
  
  
    
//	} else {


  		




  40
  
  
    
//	}


  		




  
  26
  
    
if(!$oReg->FrontendLogin) {


  		




  
  27
  
    
    header('Location: '.$oReg->AppUrl);


  		




  
  28
  
    
    exit;


  		




  41
  29
  
    
}


  		




  
  30
  
    
$page_id =


  		




  
  31
  
    
    isset($oReg->ReferrerId)


  		




  
  32
  
    
    ? $oReg->ReferrerId


  		




  
  33
  
    
    : isset($_SESSION['PAGE_ID']) ? $_SESSION['PAGE_ID'] : 0;


  		




  42
  34
  
    

  		




  43
  
  
    
$page_id = defined('REFERRER_ID') ? REFERRER_ID : isset($_SESSION['PAGE_ID']) ? $_SESSION['PAGE_ID'] : 0;


  		




  44
  
  
    

  		




  45
  35
  
    
// Required page details


  		




  46
  36
  
    
$page_description = '';


  		




  47
  37
  
    
$page_keywords = '';


  		




  48
  38
  
    
// Work out level


  		




  49
  
  
    
$level = ($page_id > 0 )? level_count($page_id): $page_id;


  		




  
  39
  
    
$level = ($page_id > 0 ) ? level_count($page_id) : $page_id;


  		




  50
  40
  
    
// Work out root parent


  		




  51
  
  
    
$root_parent = ($page_id > 0 )? root_parent($page_id): $page_id;


  		




  
  41
  
    
$root_parent = ($page_id > 0 ) ? root_parent($page_id) : $page_id;


  		




  52
  42
  
    

  		




  53
  43
  
    
define('PAGE_ID', $page_id);


  		




  54
  44
  
    
define('ROOT_PARENT', $root_parent);


  		




  55
  45
  
    
define('PARENT', 0);


  		




  56
  46
  
    
define('LEVEL', $level);


  		




  57
  47
  
    

  		




  58
  
  
    
define('PAGE_TITLE', $TEXT['PLEASE_LOGIN']);


  		




  59
  
  
    
define('MENU_TITLE', $TEXT['PLEASE_LOGIN']);


  		




  
  48
  
    
define('PAGE_TITLE', $oTrans->TEXT_PLEASE_LOGIN);


  		




  
  49
  
    
define('MENU_TITLE', $oTrans->TEXT_PLEASE_LOGIN);


  		




  60
  50
  
    
define('VISIBILITY', 'public');


  		




  61
  51
  
    
// Set the page content include file


  		




  62
  
  
    
define('PAGE_CONTENT', WB_PATH.'/account/login_form.php');


  		




  
  52
  
    
define('PAGE_CONTENT', $oReg->AppPath.'account/login_form.php');


  		




  63
  53
  
    

  		




  64
  54
  
    
// Create new login app


  		




  65
  55
  
    
$requestMethod = '_'.strtoupper($_SERVER['REQUEST_METHOD']);


  		




  66
  
  
    
$redirect  = strip_tags(isset(${$requestMethod}['redirect']) ? ${$requestMethod}['redirect'] : '');


  		




  
  56
  
    
$sRedirect  = strip_tags(isset(${$requestMethod}['redirect']) ? ${$requestMethod}['redirect'] : '');


  		




  67
  57
  
    
//$redirect = ( (empty($redirect)) ?  $_SERVER['HTTP_REFERER'] : $redirect);


  		




  68
  
  
    
$_SESSION['HTTP_REFERER'] = str_replace(WB_URL,'',$redirect);


  		




  
  58
  
    
$_SESSION['HTTP_REFERER'] = str_replace($oReg->AppUrl,'/',$sRedirect);


  		




  69
  59
  
    

  		




  70
  
  
    
$loginUrl  = WB_URL.'/account/login.php';


  		




  71
  
  
    
$loginUrl .= (!empty($redirect) ? '?redirect=' .$_SESSION['HTTP_REFERER'] : '');


  		




  
  60
  
    
$sLoginUrl  = $oReg->AppUrl.'account/login.php';


  		




  
  61
  
    
$sLoginUrl .= (!empty($sRedirect) ? '?redirect=' .$_SESSION['HTTP_REFERER'] : '');


  		




  72
  62
  
    

  		




  73
  
  
    
$WarningUrl  = str_replace(WB_PATH,WB_URL,$wb->correct_theme_source('warning.html'));


  		




  
  63
  
    
$sWarningUrl  = str_replace($oReg->AppPath, $oReg->AppUrl, $wb->correct_theme_source('warning.html'));


  		




  74
  64
  
    
// Setup template object, parse vars to it, then parse it


  		




  75
  
  
    
$ThemePath = realpath(WB_PATH.$wb->correct_theme_source('loginBox.htt'));


  		




  
  65
  
    
$sThemePath = realpath($oReg->AppPath . ltrim($wb->correct_theme_source('loginBox.htt'), '/'));


  		




  76
  66
  
    

  		




  77
  67
  
    
$thisApp = new Login(


  		




  78
  
  
    
				array(


  		




  79
  
  
    
						"MAX_ATTEMPS" => "3",


  		




  80
  
  
    
						"WARNING_URL" => $WarningUrl,


  		




  81
  
  
    
						"USERNAME_FIELDNAME" => 'username',


  		




  82
  
  
    
						"PASSWORD_FIELDNAME" => 'password',


  		




  83
  
  
    
						"REMEMBER_ME_OPTION" => SMART_LOGIN,


  		




  84
  
  
    
						"MIN_USERNAME_LEN" => "2",


  		




  85
  
  
    
						"MIN_PASSWORD_LEN" => "2",


  		




  86
  
  
    
						"MAX_USERNAME_LEN" => "30",


  		




  87
  
  
    
						"MAX_PASSWORD_LEN" => "30",


  		




  88
  
  
    
						"LOGIN_URL" => $loginUrl,


  		




  89
  
  
    
						"DEFAULT_URL" => WB_URL."/index.php",


  		




  90
  
  
    
						"TEMPLATE_DIR" => $ThemePath,


  		




  91
  
  
    
						"TEMPLATE_FILE" => "login.htt",


  		




  92
  
  
    
						"FRONTEND" => true,


  		




  93
  
  
    
						"FORGOTTEN_DETAILS_APP" => WB_URL."/account/forgot.php",


  		




  94
  
  
    
						"USERS_TABLE" => TABLE_PREFIX."users",


  		




  95
  
  
    
						"GROUPS_TABLE" => TABLE_PREFIX."groups",


  		




  96
  
  
    
						"REDIRECT_URL" => $redirect


  		




  97
  
  
    
                    )


  		




  98
  
  
    
		);


  		




  99
  
  
    

  		




  
  68
  
    
    array(


  		




  
  69
  
    
        'MAX_ATTEMPS'           => 3,


  		




  
  70
  
    
        'WARNING_URL'           => $sWarningUrl,


  		




  
  71
  
    
        'USERNAME_FIELDNAME'    => 'username',


  		




  
  72
  
    
        'PASSWORD_FIELDNAME'    => 'password',


  		




  
  73
  
    
        'REMEMBER_ME_OPTION'    => $oReg->SmartLogin,


  		




  
  74
  
    
        'MIN_USERNAME_LEN'      => 2,


  		




  
  75
  
    
        'MIN_PASSWORD_LEN'      => 3,


  		




  
  76
  
    
        'MAX_USERNAME_LEN'      => 100,


  		




  
  77
  
    
        'MAX_PASSWORD_LEN'      => 100,


  		




  
  78
  
    
        'LOGIN_URL'             => $sLoginUrl,


  		




  
  79
  
    
        'DEFAULT_URL'           => $oReg->AppUrl.'index.php',


  		




  
  80
  
    
        'TEMPLATE_DIR'          => $sThemePath,


  		




  
  81
  
    
        'TEMPLATE_FILE'         => 'login.htt',


  		




  
  82
  
    
        'FRONTEND'              => true,


  		




  
  83
  
    
        'FORGOTTEN_DETAILS_APP' => $oReg->AppUrl.'/account/forgot.php',


  		




  
  84
  
    
        'USERS_TABLE'           => $oDb->TablePrefix.'users',


  		




  
  85
  
    
        'GROUPS_TABLE'          => $oDb->TablePrefix.'groups',


  		




  
  86
  
    
        'REDIRECT_URL'          => $sRedirect


  		




  
  87
  
    
    )


  		




  
  88
  
    
);


  		




  100
  89
  
    
// Set extra outsider var


  		




  101
  90
  
    
$globals[] = 'thisApp';


  		




  102
  
  
    

  		




  103
  91
  
    
// Include the index (wrapper) file


  		




  104
  
  
    
require(WB_PATH.'/index.php');


  		




  
  92
  
    
require($oReg->AppPath.'index.php');


  		












Also available in:  Unified diff