1 <?php |
|
2 /*********************************************************************** |
|
3 |
|
4 Copyright (C) 2002-2005 Rickard Andersson (rickard@punbb.org) |
|
5 |
|
6 This file is part of PunBB. |
|
7 |
|
8 PunBB is free software; you can redistribute it and/or modify it |
|
9 under the terms of the GNU General Public License as published |
|
10 by the Free Software Foundation; either version 2 of the License, |
|
11 or (at your option) any later version. |
|
12 |
|
13 PunBB is distributed in the hope that it will be useful, but |
|
14 WITHOUT ANY WARRANTY; without even the implied warranty of |
|
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
16 GNU General Public License for more details. |
|
17 |
|
18 You should have received a copy of the GNU General Public License |
|
19 along with this program; if not, write to the Free Software |
|
20 Foundation, Inc., 59 Temple Place, Suite 330, Boston, |
|
21 MA 02111-1307 USA |
|
22 |
|
23 ************************************************************************/ |
|
24 |
|
25 |
|
26 if (isset($_GET['action'])) |
|
27 define('PUN_QUIET_VISIT', 1); |
|
28 |
|
29 //define('PUN_ROOT', './'); |
|
30 //require PUN_ROOT.'include/common.php'; |
|
31 |
|
32 global $pun_db, $pun_user, $pun_config, $lang_common; |
|
33 |
|
34 |
|
35 |
|
36 // Load the login.php language file |
|
37 require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php'; |
|
38 |
|
39 $action = isset($_GET['action']) ? $_GET['action'] : null; |
|
40 |
|
41 if (isset($_POST['form_sent']) && $action == 'in') |
|
42 { |
|
43 $form_username = trim($_POST['req_username']); |
|
44 $form_password = trim($_POST['req_password']); |
|
45 |
|
46 $username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$pun_db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$pun_db->escape($form_username).'\')'; |
|
47 |
|
48 $result = $pun_db->query('SELECT id, group_id, password, save_pass FROM '.$pun_db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); |
|
49 list($user_id, $group_id, $db_password_hash, $save_pass) = $pun_db->fetch_row($result); |
|
50 |
|
51 $authorized = false; |
|
52 |
|
53 if (!empty($db_password_hash)) |
|
54 { |
|
55 $sha1_in_db = (strlen($db_password_hash) == 40) ? true : false; |
|
56 $sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false; |
|
57 |
|
58 $form_password_hash = pun_hash($form_password); // This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available) |
|
59 |
|
60 if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash) |
|
61 $authorized = true; |
|
62 else if (!$sha1_in_db && $db_password_hash == md5($form_password)) |
|
63 { |
|
64 $authorized = true; |
|
65 |
|
66 if ($sha1_available) // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB |
|
67 $pun_db->query('UPDATE '.$pun_db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $pun_db->error()); |
|
68 } |
|
69 } |
|
70 |
|
71 if (!$authorized) |
|
72 message($lang_login['Wrong user/pass'].' <a href="login.php?action=forget">'.$lang_login['Forgotten pass'].'</a>'); |
|
73 |
|
74 // Update the status if this is the first time the user logged in |
|
75 if ($group_id == PUN_UNVERIFIED) |
|
76 $pun_db->query('UPDATE '.$pun_db->prefix.'users SET group_id='.$pun_config['o_default_user_group'].' WHERE id='.$user_id) or error('Unable to update user status', __FILE__, __LINE__, $pun_db->error()); |
|
77 |
|
78 // Remove this users guest entry from the online list |
|
79 $pun_db->query('DELETE FROM '.$pun_db->prefix.'online WHERE ident=\''.$pun_db->escape(get_remote_address()).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $pun_db->error()); |
|
80 |
|
81 $expire = ($save_pass == '1') ? time() + 31536000 : 0; |
|
82 pun_setcookie($user_id, $form_password_hash, $expire); |
|
83 |
|
84 pun_redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']); |
|
85 } |
|
86 |
|
87 |
|
88 else if ($action == 'out') |
|
89 { |
|
90 if ($pun_user['is_guest'] || !isset($_GET['id']) || $_GET['id'] != $pun_user['id']) |
|
91 { |
|
92 header('Location: index.php'); |
|
93 exit; |
|
94 } |
|
95 |
|
96 // Remove user from "users online" list. |
|
97 $pun_db->query('DELETE FROM '.$pun_db->prefix.'online WHERE user_id='.$pun_user['id']) or error('Unable to delete from online list', __FILE__, __LINE__, $pun_db->error()); |
|
98 |
|
99 // Update last_visit (make sure there's something to update it with) |
|
100 if (isset($pun_user['logged'])) |
|
101 $pun_db->query('UPDATE '.$pun_db->prefix.'users SET last_visit='.$pun_user['logged'].' WHERE id='.$pun_user['id']) or error('Unable to update user visit data', __FILE__, __LINE__, $pun_db->error()); |
|
102 |
|
103 pun_setcookie(1, random_pass(8), time() + 31536000); |
|
104 |
|
105 pun_redirect('index.php', $lang_login['Logout redirect']); |
|
106 } |
|
107 |
|
108 |
|
109 else if ($action == 'forget' || $action == 'forget_2') |
|
110 { |
|
111 if (!$pun_user['is_guest']) |
|
112 header('Location: index.php'); |
|
113 |
|
114 if (isset($_POST['form_sent'])) |
|
115 { |
|
116 require PUN_ROOT.'include/email.php'; |
|
117 |
|
118 // Validate the email-address |
|
119 $email = strtolower(trim($_POST['req_email'])); |
|
120 if (!is_valid_email($email)) |
|
121 message($lang_common['Invalid e-mail']); |
|
122 |
|
123 $result = $pun_db->query('SELECT id, username FROM '.$pun_db->prefix.'users WHERE email=\''.$pun_db->escape($email).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); |
|
124 |
|
125 if ($pun_db->num_rows($result)) |
|
126 { |
|
127 // Load the "activate password" template |
|
128 $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_password.tpl')); |
|
129 |
|
130 // The first row contains the subject |
|
131 $first_crlf = strpos($mail_tpl, "\n"); |
|
132 $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); |
|
133 $mail_message = trim(substr($mail_tpl, $first_crlf)); |
|
134 |
|
135 // Do the generic replacements first (they apply to all e-mails sent out here) |
|
136 $mail_message = str_replace('<base_url>', $pun_config['o_base_url'].'/', $mail_message); |
|
137 $mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message); |
|
138 |
|
139 // Loop through users we found |
|
140 while ($cur_hit = $pun_db->fetch_assoc($result)) |
|
141 { |
|
142 // Generate a new password and a new password activation code |
|
143 $new_password = random_pass(8); |
|
144 $new_password_key = random_pass(8); |
|
145 |
|
146 $pun_db->query('UPDATE '.$pun_db->prefix.'users SET activate_string=\''.pun_hash($new_password).'\', activate_key=\''.$new_password_key.'\' WHERE id='.$cur_hit['id']) or error('Unable to update activation data', __FILE__, __LINE__, $pun_db->error()); |
|
147 |
|
148 // Do the user specific replacements to the template |
|
149 $cur_mail_message = str_replace('<username>', $cur_hit['username'], $mail_message); |
|
150 $cur_mail_message = str_replace('<activation_url>', $pun_config['o_base_url'].'/profile.php?id='.$cur_hit['id'].'&action=change_pass&key='.$new_password_key, $cur_mail_message); |
|
151 $cur_mail_message = str_replace('<new_password>', $new_password, $cur_mail_message); |
|
152 |
|
153 pun_mail($email, $mail_subject, $cur_mail_message); |
|
154 } |
|
155 |
|
156 message($lang_login['Forget mail'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
|
157 } |
|
158 else |
|
159 message($lang_login['No e-mail match'].' '.htmlspecialchars($email).'.'); |
|
160 } |
|
161 |
|
162 |
|
163 $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_login['Request pass']; |
|
164 $required_fields = array('req_email' => $lang_common['E-mail']); |
|
165 $focus_element = array('request_pass', 'req_email'); |
|
166 require PUN_ROOT.'header.php'; |
|
167 |
|
168 ?> |
|
169 <div class="blockform"> |
|
170 <h2><span><?php echo $lang_login['Request pass'] ?></span></h2> |
|
171 <div class="box"> |
|
172 <form id="request_pass" method="post" action="login.php?action=forget_2" onsubmit="this.request_pass.disabled=true;if(process_form(this)){return true;}else{this.request_pass.disabled=false;return false;}"> |
|
173 <div class="inform"> |
|
174 <fieldset> |
|
175 <legend><?php echo $lang_login['Request pass legend'] ?></legend> |
|
176 <div class="infldset"> |
|
177 <input type="hidden" name="form_sent" value="1" /> |
|
178 <input id="req_email" type="text" name="req_email" size="50" maxlength="50" /> |
|
179 <p><?php echo $lang_login['Request pass info'] ?></p> |
|
180 </div> |
|
181 </fieldset> |
|
182 </div> |
|
183 <p><input type="submit" name="request_pass" value="<?php echo $lang_common['Submit'] ?>" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p> |
|
184 </form> |
|
185 </div> |
|
186 </div> |
|
187 <?php |
|
188 |
|
189 require PUN_ROOT.'footer.php'; |
|
190 } |
|
191 |
|
192 |
|
193 if (!$pun_user['is_guest']) |
|
194 header('Location: index.php'); |
|
195 |
|
196 // Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to index.php after login) |
|
197 $redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : 'index.php'; |
|
198 |
|
199 $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Login']; |
|
200 $required_fields = array('req_username' => $lang_common['Username'], 'req_password' => $lang_common['Password']); |
|
201 $focus_element = array('login', 'req_username'); |
|
202 require PUN_ROOT.'header.php'; |
|
203 |
|
204 ?> |
|
205 <div class="blockform"> |
|
206 <h2><span><?php echo $lang_common['Login'] ?></span></h2> |
|
207 <div class="box"> |
|
208 <form id="login" method="post" action="login.php?action=in" onsubmit="return process_form(this)"> |
|
209 <div class="inform"> |
|
210 <fieldset> |
|
211 <legend><?php echo $lang_login['Login legend'] ?></legend> |
|
212 <div class="infldset"> |
|
213 <input type="hidden" name="form_sent" value="1" /> |
|
214 <input type="hidden" name="redirect_url" value="<?php echo $redirect_url ?>" /> |
|
215 <label class="conl"><strong><?php echo $lang_common['Username'] ?></strong><br /><input type="text" name="req_username" size="25" maxlength="25" tabindex="1" /><br /></label> |
|
216 <label class="conl"><strong><?php echo $lang_common['Password'] ?></strong><br /><input type="password" name="req_password" size="16" maxlength="16" tabindex="2" /><br /></label> |
|
217 <p class="clearb"><?php echo $lang_login['Login info'] ?></p> |
|
218 <p><a href="register.php" tabindex="4"><?php echo $lang_login['Not registered'] ?></a> |
|
219 <a href="login.php?action=forget" tabindex="5"><?php echo $lang_login['Forgotten pass'] ?></a></p> |
|
220 </div> |
|
221 </fieldset> |
|
222 </div> |
|
223 <p><input type="submit" name="login" value="<?php echo $lang_common['Login'] ?>" tabindex="3" /></p> |
|
224 </form> |
|
225 </div> |
|
226 </div> |
|
227 <?php |
|
228 |
|
229 require PUN_ROOT.'footer.php'; |
|