| 32 |
32 |
global $MESSAGE, $database;
|
| 33 |
33 |
parent::__construct();
|
| 34 |
34 |
// Get configuration values
|
| 35 |
|
$this->USERS_TABLE = $config_array['USERS_TABLE'];
|
| 36 |
|
$this->GROUPS_TABLE = $config_array['GROUPS_TABLE'];
|
| 37 |
|
$this->username_fieldname = $config_array['USERNAME_FIELDNAME'];
|
| 38 |
|
$this->password_fieldname = $config_array['PASSWORD_FIELDNAME'];
|
| 39 |
|
$this->remember_me_option = $config_array['REMEMBER_ME_OPTION'];
|
| 40 |
|
$this->max_attemps = $config_array['MAX_ATTEMPS'];
|
| 41 |
|
$this->warning_url = $config_array['WARNING_URL'];
|
| 42 |
|
$this->login_url = $config_array['LOGIN_URL'];
|
| 43 |
|
$this->template_dir = $config_array['TEMPLATE_DIR'];
|
| 44 |
|
$this->template_file = $config_array['TEMPLATE_FILE'];
|
| 45 |
|
$this->frontend = $config_array['FRONTEND'];
|
| 46 |
|
$this->forgotten_details_app = $config_array['FORGOTTEN_DETAILS_APP'];
|
| 47 |
|
$this->max_username_len = $config_array['MAX_USERNAME_LEN'];
|
| 48 |
|
$this->max_password_len = $config_array['MAX_PASSWORD_LEN'];
|
| 49 |
|
if (array_key_exists('REDIRECT_URL',$config_array))
|
| 50 |
|
$this->redirect_url = $config_array['REDIRECT_URL'];
|
| 51 |
|
else
|
| 52 |
|
$this->redirect_url = '';
|
|
35 |
while(list($key, $value) = each($config_array)) {
|
|
36 |
$this->{(strtolower($key))} = $value;
|
|
37 |
}
|
|
38 |
if(!isset($this->redirect_url)) { $this->redirect_url = ''; }
|
| 53 |
39 |
// Get the supplied username and password
|
| 54 |
40 |
if ($this->get_post('username_fieldname') != ''){
|
| 55 |
41 |
$username_fieldname = $this->get_post('username_fieldname');
|
| ... | ... | |
| 88 |
74 |
// User has been "remembered"
|
| 89 |
75 |
// Get the users password
|
| 90 |
76 |
// $database = new database();
|
| 91 |
|
$query_details = $database->query("SELECT * FROM ".$this->USERS_TABLE." WHERE user_id = '".$this->get_safe_remember_key()."' LIMIT 1");
|
|
77 |
$query_details = $database->query("SELECT * FROM ".$this->users_table." WHERE user_id = '".$this->get_safe_remember_key()."' LIMIT 1");
|
| 92 |
78 |
$fetch_details = $query_details->fetchRow();
|
| 93 |
79 |
$this->username = $fetch_details['username'];
|
| 94 |
80 |
$this->password = $fetch_details['password'];
|
| ... | ... | |
| 142 |
128 |
global $database;
|
| 143 |
129 |
// Get user information
|
| 144 |
130 |
// $database = new database();
|
| 145 |
|
// $query = 'SELECT * FROM `'.$this->USERS_TABLE.'` WHERE MD5(`username`) = "'.md5($this->username).'" AND `password` = "'.$this->password.'" AND `active` = 1';
|
|
131 |
// $query = 'SELECT * FROM `'.$this->users_table.'` WHERE MD5(`username`) = "'.md5($this->username).'" AND `password` = "'.$this->password.'" AND `active` = 1';
|
| 146 |
132 |
$loginname = ( preg_match('/[\;\=\&\|\<\> ]/',$this->username) ? '' : $this->username );
|
| 147 |
|
$query = 'SELECT * FROM `'.$this->USERS_TABLE.'` WHERE `username` = "'.$loginname.'" AND `password` = "'.$this->password.'" AND `active` = 1';
|
|
133 |
$query = 'SELECT * FROM `'.$this->users_table.'` WHERE `username` = "'.$loginname.'" AND `password` = "'.$this->password.'" AND `active` = 1';
|
| 148 |
134 |
$results = $database->query($query);
|
| 149 |
135 |
$results_array = $results->fetchRow();
|
| 150 |
136 |
$num_rows = $results->numRows();
|
| ... | ... | |
| 197 |
183 |
$first_group = true;
|
| 198 |
184 |
foreach (explode(",", $this->get_session('GROUPS_ID')) as $cur_group_id)
|
| 199 |
185 |
{
|
| 200 |
|
$query = "SELECT * FROM ".$this->GROUPS_TABLE." WHERE group_id = '".$cur_group_id."'";
|
|
186 |
$query = "SELECT * FROM ".$this->groups_table." WHERE group_id = '".$cur_group_id."'";
|
| 201 |
187 |
$results = $database->query($query);
|
| 202 |
188 |
$results_array = $results->fetchRow();
|
| 203 |
189 |
$_SESSION['GROUP_NAME'][$cur_group_id] = $results_array['name'];
|
| ... | ... | |
| 227 |
213 |
// Update the users table with current ip and timestamp
|
| 228 |
214 |
$get_ts = time();
|
| 229 |
215 |
$get_ip = $_SERVER['REMOTE_ADDR'];
|
| 230 |
|
$query = "UPDATE ".$this->USERS_TABLE." SET login_when = '$get_ts', login_ip = '$get_ip' WHERE user_id = '$user_id'";
|
|
216 |
$query = "UPDATE ".$this->users_table." SET login_when = '$get_ts', login_ip = '$get_ip' WHERE user_id = '$user_id'";
|
| 231 |
217 |
$database->query($query);
|
| 232 |
218 |
}else {
|
| 233 |
219 |
$num_rows = 0;
|
| ... | ... | |
| 248 |
234 |
|
| 249 |
235 |
// Function to set a "remembering" cookie for the user
|
| 250 |
236 |
function remember($user_id) {
|
| 251 |
|
global $database;
|
| 252 |
|
$remember_key = '';
|
| 253 |
|
// Generate user id to append to the remember key
|
| 254 |
|
$length = 11-strlen($user_id);
|
| 255 |
|
if($length > 0) {
|
| 256 |
|
for($i = 1; $i <= $length; $i++) {
|
| 257 |
|
$remember_key .= '0';
|
| 258 |
|
}
|
| 259 |
|
}
|
| 260 |
|
// Generate remember key
|
| 261 |
|
$remember_key .= $user_id.'_';
|
| 262 |
|
$salt = "abchefghjkmnpqrstuvwxyz0123456789";
|
| 263 |
|
srand((double)microtime()*1000000);
|
| 264 |
|
$i = 0;
|
| 265 |
|
while ($i <= 10) {
|
| 266 |
|
$num = rand() % 33;
|
| 267 |
|
$tmp = substr($salt, $num, 1);
|
| 268 |
|
$remember_key = $remember_key . $tmp;
|
| 269 |
|
$i++;
|
| 270 |
|
}
|
| 271 |
|
$remember_key = $remember_key;
|
| 272 |
|
// Update the remember key in the db
|
| 273 |
|
// $database = new database();
|
| 274 |
|
$database->query("UPDATE ".$this->USERS_TABLE." SET remember_key = '$remember_key' WHERE user_id = '$user_id' LIMIT 1");
|
| 275 |
|
if($database->is_error()) {
|
| 276 |
|
return false;
|
| 277 |
|
} else {
|
| 278 |
|
// Workout options for the cookie
|
| 279 |
|
$cookie_name = 'REMEMBER_KEY';
|
| 280 |
|
$cookie_value = $remember_key;
|
| 281 |
|
$cookie_expire = time()+60*60*24*30;
|
| 282 |
|
// Set the cookie
|
| 283 |
|
if(setcookie($cookie_name, $cookie_value, $cookie_expire, '/')) {
|
| 284 |
|
return true;
|
| 285 |
|
} else {
|
| 286 |
|
return false;
|
| 287 |
|
}
|
| 288 |
|
}
|
|
237 |
return true;
|
|
238 |
// global $database;
|
|
239 |
// $remember_key = '';
|
|
240 |
// // Generate user id to append to the remember key
|
|
241 |
// $length = 11-strlen($user_id);
|
|
242 |
// if($length > 0) {
|
|
243 |
// for($i = 1; $i <= $length; $i++) {
|
|
244 |
// $remember_key .= '0';
|
|
245 |
// }
|
|
246 |
// }
|
|
247 |
// // Generate remember key
|
|
248 |
// $remember_key .= $user_id.'_';
|
|
249 |
// $salt = "abchefghjkmnpqrstuvwxyz0123456789";
|
|
250 |
// srand((double)microtime()*1000000);
|
|
251 |
// $i = 0;
|
|
252 |
// while ($i <= 10) {
|
|
253 |
// $num = rand() % 33;
|
|
254 |
// $tmp = substr($salt, $num, 1);
|
|
255 |
// $remember_key = $remember_key . $tmp;
|
|
256 |
// $i++;
|
|
257 |
// }
|
|
258 |
// $remember_key = $remember_key;
|
|
259 |
// // Update the remember key in the db
|
|
260 |
// // $database = new database();
|
|
261 |
// $database->query("UPDATE ".$this->users_table." SET remember_key = '$remember_key' WHERE user_id = '$user_id' LIMIT 1");
|
|
262 |
// if($database->is_error()) {
|
|
263 |
// return false;
|
|
264 |
// } else {
|
|
265 |
// // Workout options for the cookie
|
|
266 |
// $cookie_name = 'REMEMBER_KEY';
|
|
267 |
// $cookie_value = $remember_key;
|
|
268 |
// $cookie_expire = time()+60*60*24*30;
|
|
269 |
// // Set the cookie
|
|
270 |
// if(setcookie($cookie_name, $cookie_value, $cookie_expire, '/')) {
|
|
271 |
// return true;
|
|
272 |
// } else {
|
|
273 |
// return false;
|
|
274 |
// }
|
|
275 |
// }
|
| 289 |
276 |
}
|
| 290 |
277 |
|
| 291 |
278 |
// Function to check if a user has been remembered
|
| 292 |
279 |
function is_remembered()
|
| 293 |
280 |
{
|
| 294 |
|
global $database;
|
| 295 |
|
// add if get_safe_remember_key not empty
|
| 296 |
|
if(isset($_COOKIE['REMEMBER_KEY']) && ($_COOKIE['REMEMBER_KEY'] != '') && ($this->get_safe_remember_key() <> '' ) )
|
| 297 |
|
{
|
| 298 |
|
// Check if the remember key is correct
|
| 299 |
|
// $database = new database();
|
| 300 |
|
$sql = "SELECT `user_id` FROM `" . $this->USERS_TABLE . "` WHERE `remember_key` = '";
|
| 301 |
|
$sql .= $this->get_safe_remember_key() . "' LIMIT 1";
|
| 302 |
|
$check_query = $database->query($sql);
|
| 303 |
|
|
| 304 |
|
if($check_query->numRows() > 0)
|
| 305 |
|
{
|
| 306 |
|
$check_fetch = $check_query->fetchRow();
|
| 307 |
|
$user_id = $check_fetch['user_id'];
|
| 308 |
|
// Check the remember key prefix
|
| 309 |
|
$remember_key_prefix = '';
|
| 310 |
|
$length = 11-strlen($user_id);
|
| 311 |
|
if($length > 0)
|
| 312 |
|
{
|
| 313 |
|
for($i = 1; $i <= $length; $i++)
|
| 314 |
|
{
|
| 315 |
|
$remember_key_prefix .= '0';
|
| 316 |
|
}
|
| 317 |
|
}
|
| 318 |
|
$remember_key_prefix .= $user_id.'_';
|
| 319 |
|
$length = strlen($remember_key_prefix);
|
| 320 |
|
if(substr($_COOKIE['REMEMBER_KEY'], 0, $length) == $remember_key_prefix)
|
| 321 |
|
{
|
| 322 |
|
return true;
|
| 323 |
|
} else {
|
| 324 |
|
return false;
|
| 325 |
|
}
|
| 326 |
|
} else {
|
| 327 |
|
return false;
|
| 328 |
|
}
|
| 329 |
|
} else {
|
| 330 |
|
return false;
|
| 331 |
|
}
|
|
281 |
return false;
|
|
282 |
// global $database;
|
|
283 |
// // add if get_safe_remember_key not empty
|
|
284 |
// if(isset($_COOKIE['REMEMBER_KEY']) && ($_COOKIE['REMEMBER_KEY'] != '') && ($this->get_safe_remember_key() <> '' ) )
|
|
285 |
// {
|
|
286 |
// // Check if the remember key is correct
|
|
287 |
// // $database = new database();
|
|
288 |
// $sql = "SELECT `user_id` FROM `" . $this->users_table . "` WHERE `remember_key` = '";
|
|
289 |
// $sql .= $this->get_safe_remember_key() . "' LIMIT 1";
|
|
290 |
// $check_query = $database->query($sql);
|
|
291 |
//
|
|
292 |
// if($check_query->numRows() > 0)
|
|
293 |
// {
|
|
294 |
// $check_fetch = $check_query->fetchRow();
|
|
295 |
// $user_id = $check_fetch['user_id'];
|
|
296 |
// // Check the remember key prefix
|
|
297 |
// $remember_key_prefix = '';
|
|
298 |
// $length = 11-strlen($user_id);
|
|
299 |
// if($length > 0)
|
|
300 |
// {
|
|
301 |
// for($i = 1; $i <= $length; $i++)
|
|
302 |
// {
|
|
303 |
// $remember_key_prefix .= '0';
|
|
304 |
// }
|
|
305 |
// }
|
|
306 |
// $remember_key_prefix .= $user_id.'_';
|
|
307 |
// $length = strlen($remember_key_prefix);
|
|
308 |
// if(substr($_COOKIE['REMEMBER_KEY'], 0, $length) == $remember_key_prefix)
|
|
309 |
// {
|
|
310 |
// return true;
|
|
311 |
// } else {
|
|
312 |
// return false;
|
|
313 |
// }
|
|
314 |
// } else {
|
|
315 |
// return false;
|
|
316 |
// }
|
|
317 |
// } else {
|
|
318 |
// return false;
|
|
319 |
// }
|
| 332 |
320 |
}
|
| 333 |
321 |
|
| 334 |
322 |
// Display the login screen
|
| ... | ... | |
| 353 |
341 |
$template->set_var('DISPLAY_REMEMBER_ME', '');
|
| 354 |
342 |
}
|
| 355 |
343 |
$template->set_var(array(
|
| 356 |
|
'ACTION_URL' => $this->login_url,
|
| 357 |
|
'ATTEMPS' => $this->get_session('ATTEMPS'),
|
| 358 |
|
'USERNAME' => $this->username,
|
| 359 |
|
'USERNAME_FIELDNAME' => $this->username_fieldname,
|
| 360 |
|
'PASSWORD_FIELDNAME' => $this->password_fieldname,
|
| 361 |
|
'MESSAGE' => $this->message,
|
| 362 |
|
'INTERFACE_DIR_URL' => ADMIN_URL.'/interface',
|
| 363 |
|
'MAX_USERNAME_LEN' => $this->max_username_len,
|
| 364 |
|
'MAX_PASSWORD_LEN' => $this->max_password_len,
|
| 365 |
|
'WB_URL' => WB_URL,
|
| 366 |
|
'THEME_URL' => THEME_URL,
|
| 367 |
|
'VERSION' => VERSION,
|
| 368 |
|
'REVISION' => REVISION,
|
| 369 |
|
'LANGUAGE' => strtolower(LANGUAGE),
|
| 370 |
|
'FORGOTTEN_DETAILS_APP' => $this->forgotten_details_app,
|
| 371 |
|
'TEXT_FORGOTTEN_DETAILS' => $TEXT['FORGOTTEN_DETAILS'],
|
| 372 |
|
'TEXT_USERNAME' => $TEXT['USERNAME'],
|
| 373 |
|
'TEXT_PASSWORD' => $TEXT['PASSWORD'],
|
| 374 |
|
'TEXT_REMEMBER_ME' => $TEXT['REMEMBER_ME'],
|
| 375 |
|
'TEXT_LOGIN' => $TEXT['LOGIN'],
|
| 376 |
|
'TEXT_HOME' => $TEXT['HOME'],
|
| 377 |
|
'PAGES_DIRECTORY' => PAGES_DIRECTORY,
|
| 378 |
|
'SECTION_LOGIN' => $MENU['LOGIN']
|
| 379 |
|
)
|
| 380 |
|
);
|
|
344 |
'ACTION_URL' => $this->login_url,
|
|
345 |
'ATTEMPS' => $this->get_session('ATTEMPS'),
|
|
346 |
'USERNAME' => $this->username,
|
|
347 |
'USERNAME_FIELDNAME' => $this->username_fieldname,
|
|
348 |
'PASSWORD_FIELDNAME' => $this->password_fieldname,
|
|
349 |
'MESSAGE' => $this->message,
|
|
350 |
'INTERFACE_DIR_URL' => ADMIN_URL.'/interface',
|
|
351 |
'MAX_USERNAME_LEN' => $this->max_username_len,
|
|
352 |
'MAX_PASSWORD_LEN' => $this->max_password_len,
|
|
353 |
'WB_URL' => WB_URL,
|
|
354 |
'THEME_URL' => THEME_URL,
|
|
355 |
'VERSION' => VERSION,
|
|
356 |
'REVISION' => REVISION,
|
|
357 |
'LANGUAGE' => strtolower(LANGUAGE),
|
|
358 |
'FORGOTTEN_DETAILS_APP' => $this->forgotten_details_app,
|
|
359 |
'TEXT_FORGOTTEN_DETAILS' => $TEXT['FORGOTTEN_DETAILS'],
|
|
360 |
'TEXT_USERNAME' => $TEXT['USERNAME'],
|
|
361 |
'TEXT_PASSWORD' => $TEXT['PASSWORD'],
|
|
362 |
'TEXT_REMEMBER_ME' => $TEXT['REMEMBER_ME'],
|
|
363 |
'TEXT_LOGIN' => $TEXT['LOGIN'],
|
|
364 |
'TEXT_HOME' => $TEXT['HOME'],
|
|
365 |
'PAGES_DIRECTORY' => PAGES_DIRECTORY,
|
|
366 |
'SECTION_LOGIN' => $MENU['LOGIN']
|
|
367 |
)
|
|
368 |
);
|
| 381 |
369 |
if(defined('DEFAULT_CHARSET')) {
|
| 382 |
370 |
$charset=DEFAULT_CHARSET;
|
| 383 |
371 |
} else {
|
for security reasons the 'remember me' functionality is deaktivated in class login
'Get configuration values' is optimized