0
|
1 |
<?php
|
|
2 |
/***********************************************************************
|
|
3 |
|
|
4 |
Copyright (C) 2002-2005 Rickard Andersson (rickard@punbb.org)
|
|
5 |
|
|
6 |
This file is part of PunBB.
|
|
7 |
|
|
8 |
PunBB is free software; you can redistribute it and/or modify it
|
|
9 |
under the terms of the GNU General Public License as published
|
|
10 |
by the Free Software Foundation; either version 2 of the License,
|
|
11 |
or (at your option) any later version.
|
|
12 |
|
|
13 |
PunBB is distributed in the hope that it will be useful, but
|
|
14 |
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16 |
GNU General Public License for more details.
|
|
17 |
|
|
18 |
You should have received a copy of the GNU General Public License
|
|
19 |
along with this program; if not, write to the Free Software
|
|
20 |
Foundation, Inc., 59 Temple Place, Suite 330, Boston,
|
|
21 |
MA 02111-1307 USA
|
|
22 |
|
|
23 |
************************************************************************/
|
|
24 |
|
|
25 |
|
|
26 |
if (isset($_GET['action']))
|
|
27 |
define('PUN_QUIET_VISIT', 1);
|
|
28 |
|
|
29 |
define('PUN_ROOT', './');
|
|
30 |
require PUN_ROOT.'include/common.php';
|
|
31 |
|
|
32 |
|
|
33 |
// Load the login.php language file
|
|
34 |
require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
|
|
35 |
|
|
36 |
$action = isset($_GET['action']) ? $_GET['action'] : null;
|
|
37 |
|
|
38 |
if (isset($_POST['form_sent']) && $action == 'in')
|
|
39 |
{
|
|
40 |
$form_username = trim($_POST['req_username']);
|
|
41 |
$form_password = trim($_POST['req_password']);
|
|
42 |
|
|
43 |
$username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$db->escape($form_username).'\')';
|
|
44 |
|
|
45 |
$result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
|
|
46 |
list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result);
|
|
47 |
|
|
48 |
$authorized = false;
|
|
49 |
|
|
50 |
if (!empty($db_password_hash))
|
|
51 |
{
|
|
52 |
$sha1_in_db = (strlen($db_password_hash) == 40) ? true : false;
|
|
53 |
$sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false;
|
|
54 |
|
|
55 |
$form_password_hash = pun_hash($form_password); // This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available)
|
|
56 |
|
|
57 |
if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash)
|
|
58 |
$authorized = true;
|
|
59 |
else if (!$sha1_in_db && $db_password_hash == md5($form_password))
|
|
60 |
{
|
|
61 |
$authorized = true;
|
|
62 |
|
|
63 |
if ($sha1_available) // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
|
|
64 |
$db->query('UPDATE '.$db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $db->error());
|
|
65 |
}
|
|
66 |
}
|
|
67 |
|
|
68 |
if (!$authorized)
|
|
69 |
message($lang_login['Wrong user/pass'].' <a href="login.php?action=forget">'.$lang_login['Forgotten pass'].'</a>');
|
|
70 |
|
|
71 |
// Update the status if this is the first time the user logged in
|
|
72 |
if ($group_id == PUN_UNVERIFIED)
|
|
73 |
$db->query('UPDATE '.$db->prefix.'users SET group_id='.$pun_config['o_default_user_group'].' WHERE id='.$user_id) or error('Unable to update user status', __FILE__, __LINE__, $db->error());
|
|
74 |
|
|
75 |
// Remove this users guest entry from the online list
|
|
76 |
$db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape(get_remote_address()).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());
|
|
77 |
|
|
78 |
$expire = ($save_pass == '1') ? time() + 31536000 : 0;
|
|
79 |
pun_setcookie($user_id, $form_password_hash, $expire);
|
|
80 |
|
|
81 |
redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']);
|
|
82 |
}
|
|
83 |
|
|
84 |
|
|
85 |
else if ($action == 'out')
|
|
86 |
{
|
|
87 |
if ($pun_user['is_guest'] || !isset($_GET['id']) || $_GET['id'] != $pun_user['id'])
|
|
88 |
{
|
|
89 |
header('Location: index.php');
|
|
90 |
exit;
|
|
91 |
}
|
|
92 |
|
|
93 |
// Remove user from "users online" list.
|
|
94 |
$db->query('DELETE FROM '.$db->prefix.'online WHERE user_id='.$pun_user['id']) or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());
|
|
95 |
|
|
96 |
// Update last_visit (make sure there's something to update it with)
|
|
97 |
if (isset($pun_user['logged']))
|
|
98 |
$db->query('UPDATE '.$db->prefix.'users SET last_visit='.$pun_user['logged'].' WHERE id='.$pun_user['id']) or error('Unable to update user visit data', __FILE__, __LINE__, $db->error());
|
|
99 |
|
|
100 |
pun_setcookie(1, random_pass(8), time() + 31536000);
|
|
101 |
|
|
102 |
redirect('index.php', $lang_login['Logout redirect']);
|
|
103 |
}
|
|
104 |
|
|
105 |
|
|
106 |
else if ($action == 'forget' || $action == 'forget_2')
|
|
107 |
{
|
|
108 |
if (!$pun_user['is_guest'])
|
|
109 |
header('Location: index.php');
|
|
110 |
|
|
111 |
if (isset($_POST['form_sent']))
|
|
112 |
{
|
|
113 |
require PUN_ROOT.'include/email.php';
|
|
114 |
|
|
115 |
// Validate the email-address
|
|
116 |
$email = strtolower(trim($_POST['req_email']));
|
|
117 |
if (!is_valid_email($email))
|
|
118 |
message($lang_common['Invalid e-mail']);
|
|
119 |
|
|
120 |
$result = $db->query('SELECT id, username FROM '.$db->prefix.'users WHERE email=\''.$db->escape($email).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
|
|
121 |
|
|
122 |
if ($db->num_rows($result))
|
|
123 |
{
|
|
124 |
// Load the "activate password" template
|
|
125 |
$mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_password.tpl'));
|
|
126 |
|
|
127 |
// The first row contains the subject
|
|
128 |
$first_crlf = strpos($mail_tpl, "\n");
|
|
129 |
$mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8));
|
|
130 |
$mail_message = trim(substr($mail_tpl, $first_crlf));
|
|
131 |
|
|
132 |
// Do the generic replacements first (they apply to all e-mails sent out here)
|
|
133 |
$mail_message = str_replace('<base_url>', $pun_config['o_base_url'].'/', $mail_message);
|
|
134 |
$mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message);
|
|
135 |
|
|
136 |
// Loop through users we found
|
|
137 |
while ($cur_hit = $db->fetch_assoc($result))
|
|
138 |
{
|
|
139 |
// Generate a new password and a new password activation code
|
|
140 |
$new_password = random_pass(8);
|
|
141 |
$new_password_key = random_pass(8);
|
|
142 |
|
|
143 |
$db->query('UPDATE '.$db->prefix.'users SET activate_string=\''.pun_hash($new_password).'\', activate_key=\''.$new_password_key.'\' WHERE id='.$cur_hit['id']) or error('Unable to update activation data', __FILE__, __LINE__, $db->error());
|
|
144 |
|
|
145 |
// Do the user specific replacements to the template
|
|
146 |
$cur_mail_message = str_replace('<username>', $cur_hit['username'], $mail_message);
|
|
147 |
$cur_mail_message = str_replace('<activation_url>', $pun_config['o_base_url'].'/profile.php?id='.$cur_hit['id'].'&action=change_pass&key='.$new_password_key, $cur_mail_message);
|
|
148 |
$cur_mail_message = str_replace('<new_password>', $new_password, $cur_mail_message);
|
|
149 |
|
|
150 |
pun_mail($email, $mail_subject, $cur_mail_message);
|
|
151 |
}
|
|
152 |
|
|
153 |
message($lang_login['Forget mail'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.');
|
|
154 |
}
|
|
155 |
else
|
|
156 |
message($lang_login['No e-mail match'].' '.htmlspecialchars($email).'.');
|
|
157 |
}
|
|
158 |
|
|
159 |
|
|
160 |
$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_login['Request pass'];
|
|
161 |
$required_fields = array('req_email' => $lang_common['E-mail']);
|
|
162 |
$focus_element = array('request_pass', 'req_email');
|
|
163 |
require PUN_ROOT.'header.php';
|
|
164 |
|
|
165 |
?>
|
|
166 |
<div class="blockform">
|
|
167 |
<h2><span><?php echo $lang_login['Request pass'] ?></span></h2>
|
|
168 |
<div class="box">
|
|
169 |
<form id="request_pass" method="post" action="login.php?action=forget_2" onsubmit="this.request_pass.disabled=true;if(process_form(this)){return true;}else{this.request_pass.disabled=false;return false;}">
|
|
170 |
<div class="inform">
|
|
171 |
<fieldset>
|
|
172 |
<legend><?php echo $lang_login['Request pass legend'] ?></legend>
|
|
173 |
<div class="infldset">
|
|
174 |
<input type="hidden" name="form_sent" value="1" />
|
|
175 |
<input id="req_email" type="text" name="req_email" size="50" maxlength="50" />
|
|
176 |
<p><?php echo $lang_login['Request pass info'] ?></p>
|
|
177 |
</div>
|
|
178 |
</fieldset>
|
|
179 |
</div>
|
|
180 |
<p><input type="submit" name="request_pass" value="<?php echo $lang_common['Submit'] ?>" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p>
|
|
181 |
</form>
|
|
182 |
</div>
|
|
183 |
</div>
|
|
184 |
<?php
|
|
185 |
|
|
186 |
require PUN_ROOT.'footer.php';
|
|
187 |
}
|
|
188 |
|
|
189 |
|
|
190 |
if (!$pun_user['is_guest'])
|
|
191 |
header('Location: index.php');
|
|
192 |
|
|
193 |
// Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to index.php after login)
|
|
194 |
$redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : 'index.php';
|
|
195 |
|
|
196 |
$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Login'];
|
|
197 |
$required_fields = array('req_username' => $lang_common['Username'], 'req_password' => $lang_common['Password']);
|
|
198 |
$focus_element = array('login', 'req_username');
|
|
199 |
require PUN_ROOT.'header.php';
|
|
200 |
|
|
201 |
?>
|
|
202 |
<div class="blockform">
|
|
203 |
<h2><span><?php echo $lang_common['Login'] ?></span></h2>
|
|
204 |
<div class="box">
|
|
205 |
<form id="login" method="post" action="login.php?action=in" onsubmit="return process_form(this)">
|
|
206 |
<div class="inform">
|
|
207 |
<fieldset>
|
|
208 |
<legend><?php echo $lang_login['Login legend'] ?></legend>
|
|
209 |
<div class="infldset">
|
|
210 |
<input type="hidden" name="form_sent" value="1" />
|
|
211 |
<input type="hidden" name="redirect_url" value="<?php echo $redirect_url ?>" />
|
|
212 |
<label class="conl"><strong><?php echo $lang_common['Username'] ?></strong><br /><input type="text" name="req_username" size="25" maxlength="25" tabindex="1" /><br /></label>
|
|
213 |
<label class="conl"><strong><?php echo $lang_common['Password'] ?></strong><br /><input type="password" name="req_password" size="16" maxlength="16" tabindex="2" /><br /></label>
|
|
214 |
<p class="clearb"><?php echo $lang_login['Login info'] ?></p>
|
|
215 |
<p><a href="register.php" tabindex="4"><?php echo $lang_login['Not registered'] ?></a>
|
|
216 |
<a href="login.php?action=forget" tabindex="5"><?php echo $lang_login['Forgotten pass'] ?></a></p>
|
|
217 |
</div>
|
|
218 |
</fieldset>
|
|
219 |
</div>
|
|
220 |
<p><input type="submit" name="login" value="<?php echo $lang_common['Login'] ?>" tabindex="3" /></p>
|
|
221 |
</form>
|
|
222 |
</div>
|
|
223 |
</div>
|
|
224 |
<?php
|
|
225 |
|
|
226 |
require PUN_ROOT.'footer.php';
|