|
1 <?php |
|
2 /*********************************************************************** |
|
3 |
|
4 Copyright (C) 2002-2008 PunBB.org |
|
5 |
|
6 This file is part of PunBB. |
|
7 |
|
8 PunBB is free software; you can redistribute it and/or modify it |
|
9 under the terms of the GNU General Public License as published |
|
10 by the Free Software Foundation; either version 2 of the License, |
|
11 or (at your option) any later version. |
|
12 |
|
13 PunBB is distributed in the hope that it will be useful, but |
|
14 WITHOUT ANY WARRANTY; without even the implied warranty of |
|
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
16 GNU General Public License for more details. |
|
17 |
|
18 You should have received a copy of the GNU General Public License |
|
19 along with this program; if not, write to the Free Software |
|
20 Foundation, Inc., 59 Temple Place, Suite 330, Boston, |
|
21 MA 02111-1307 USA |
|
22 |
|
23 ************************************************************************/ |
|
24 |
|
25 |
|
26 if (isset($_GET['action'])) |
|
27 define('PUN_QUIET_VISIT', 1); |
|
28 |
|
29 // if (!defined('PUN_ROOT')) |
|
30 // define('PUN_ROOT', './'); |
|
31 // require PUN_ROOT.'include/common.php'; |
|
32 |
|
33 // import globals (I really hope this isn't dangerous) |
|
34 foreach ( $GLOBALS as $key => $_ ) |
|
35 { |
|
36 $$key =& $GLOBALS[$key]; |
|
37 } |
|
38 |
|
39 ($hook = get_hook('li_start')) ? eval($hook) : null; |
|
40 |
|
41 // Load the login.php language file |
|
42 require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php'; |
|
43 |
|
44 |
|
45 $action = isset($_GET['action']) ? $_GET['action'] : null; |
|
46 |
|
47 |
|
48 // Login |
|
49 if (isset($_POST['form_sent']) && $action == 'in') |
|
50 { |
|
51 $form_username = trim($_POST['req_username']); |
|
52 $form_password = trim($_POST['req_password']); |
|
53 |
|
54 ($hook = get_hook('li_login_form_submitted')) ? eval($hook) : null; |
|
55 |
|
56 // Get user info matching login attempt |
|
57 $query = array( |
|
58 'SELECT' => 'u.id, u.group_id, u.password, u.save_pass, u.salt', |
|
59 'FROM' => 'users AS u' |
|
60 ); |
|
61 |
|
62 if ($db_type == 'mysql' || $db_type == 'mysqli') |
|
63 $query['WHERE'] = 'username=\''.$pun_db->escape($form_username).'\''; |
|
64 else |
|
65 $query['WHERE'] = 'LOWER(username)=LOWER(\''.$pun_db->escape($form_username).'\')'; |
|
66 |
|
67 ($hook = get_hook('li_qr_get_login_data')) ? eval($hook) : null; |
|
68 $result = $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
69 list($user_id, $group_id, $db_password_hash, $save_pass, $salt) = $pun_db->fetch_row($result); |
|
70 |
|
71 $authorized = false; |
|
72 if (!empty($db_password_hash)) |
|
73 { |
|
74 $sha1_in_db = (strlen($db_password_hash) == 40) ? true : false; |
|
75 $form_password_hash = sha1($salt.sha1($form_password)); |
|
76 |
|
77 if ($sha1_in_db && $db_password_hash == $form_password_hash) |
|
78 $authorized = true; |
|
79 else if ((!$sha1_in_db && $db_password_hash == md5($form_password)) || ($sha1_in_db && $db_password_hash == sha1($form_password))) |
|
80 { |
|
81 $authorized = true; |
|
82 |
|
83 $salt = random_key(12); |
|
84 $form_password_hash = sha1($salt.sha1($form_password)); |
|
85 |
|
86 // There's an old MD5 hash or an unsalted SHA1 hash in the database, so we replace it |
|
87 // with a randomly generated salt and a new, salted SHA1 hash |
|
88 $query = array( |
|
89 'UPDATE' => 'users', |
|
90 'SET' => 'password=\''.$form_password_hash.'\', salt=\''.$pun_db->escape($salt).'\'', |
|
91 'WHERE' => 'id='.$user_id |
|
92 ); |
|
93 |
|
94 ($hook = get_hook('li_qr_update_user_hash')) ? eval($hook) : null; |
|
95 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
96 } |
|
97 } |
|
98 |
|
99 ($hook = get_hook('li_login_pre_auth_message')) ? eval($hook) : null; |
|
100 |
|
101 if (!$authorized) |
|
102 message($lang_login['Wrong user/pass'], sprintf($lang_login['Forgotten password'], '<a href="'.pun_link($pun_url['request_password']).'">'.$lang_login['Request pass'].'</a>')); |
|
103 |
|
104 // Update the status if this is the first time the user logged in |
|
105 if ($group_id == PUN_UNVERIFIED) |
|
106 { |
|
107 $query = array( |
|
108 'UPDATE' => 'users', |
|
109 'SET' => 'group_id='.$pun_config['o_default_user_group'], |
|
110 'WHERE' => 'id='.$user_id |
|
111 ); |
|
112 |
|
113 ($hook = get_hook('li_qr_update_user_group')) ? eval($hook) : null; |
|
114 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
115 } |
|
116 |
|
117 // Remove this user's guest entry from the online list |
|
118 $query = array( |
|
119 'DELETE' => 'online', |
|
120 'WHERE' => 'ident=\''.$pun_db->escape(get_remote_address()).'\'' |
|
121 ); |
|
122 |
|
123 ($hook = get_hook('li_qr_delete_online_user')) ? eval($hook) : null; |
|
124 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
125 |
|
126 $expire = ($save_pass == '1') ? time() + 31536000 : 0; |
|
127 pun_setcookie($cookie_name, base64_encode($user_id.'|'.$form_password_hash), $expire); |
|
128 |
|
129 pun_redirect(htmlspecialchars($_POST['redirect_url']).((substr_count($_POST['redirect_url'], '?') == 1) ? '&' : '?').'login=1', $lang_login['Login redirect']); |
|
130 } |
|
131 |
|
132 |
|
133 // Logout |
|
134 else if ($action == 'out') |
|
135 { |
|
136 if ($pun_user['is_guest'] || !isset($_GET['id']) || $_GET['id'] != $pun_user['id']) |
|
137 { |
|
138 header('Location: '.pun_link($pun_url['index'])); |
|
139 exit; |
|
140 } |
|
141 |
|
142 // We validate the CSRF token. If it's set in POST and we're at this point, the token is valid. |
|
143 // If it's in GET, we need to make sure it's valid. |
|
144 if (!isset($_POST['csrf_token']) && (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== generate_form_token('logout'.$pun_user['id']))) |
|
145 csrf_confirm_form(); |
|
146 |
|
147 ($hook = get_hook('li_logout_selected')) ? eval($hook) : null; |
|
148 |
|
149 // Remove user from "users online" list. |
|
150 $query = array( |
|
151 'DELETE' => 'online', |
|
152 'WHERE' => 'user_id='.$pun_user['id'] |
|
153 ); |
|
154 |
|
155 ($hook = get_hook('li_qr_delete_online_user2')) ? eval($hook) : null; |
|
156 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
157 |
|
158 // Update last_visit (make sure there's something to update it with) |
|
159 if (isset($pun_user['logged'])) |
|
160 { |
|
161 $query = array( |
|
162 'UPDATE' => 'users', |
|
163 'SET' => 'last_visit='.$pun_user['logged'], |
|
164 'WHERE' => 'id='.$pun_user['id'] |
|
165 ); |
|
166 |
|
167 ($hook = get_hook('li_qr_update_last_visit')) ? eval($hook) : null; |
|
168 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
169 } |
|
170 |
|
171 pun_setcookie($cookie_name, base64_encode('1|'.random_key(8, true)), time() + 31536000); |
|
172 |
|
173 // Reset tracked topics |
|
174 set_tracked_topics(null); |
|
175 |
|
176 ($hook = get_hook('li_logout_pre_redirect')) ? eval($hook) : null; |
|
177 |
|
178 pun_redirect(pun_link($pun_url['index']), $lang_login['Logout redirect']); |
|
179 } |
|
180 |
|
181 |
|
182 // New password |
|
183 else if ($action == 'forget' || $action == 'forget_2') |
|
184 { |
|
185 if (!$pun_user['is_guest']) |
|
186 header('Location: '.pun_link($pun_url['index'])); |
|
187 |
|
188 ($hook = get_hook('li_forgot_pass_selected')) ? eval($hook) : null; |
|
189 |
|
190 if (isset($_POST['form_sent'])) |
|
191 { |
|
192 require PUN_ROOT.'include/email.php'; |
|
193 |
|
194 // Validate the email-address |
|
195 $email = strtolower(trim($_POST['req_email'])); |
|
196 if (!is_valid_email($email)) |
|
197 message($lang_common['Invalid e-mail']); |
|
198 |
|
199 // Fetch user matching $email |
|
200 $query = array( |
|
201 'SELECT' => 'u.id, u.username, u.salt', |
|
202 'FROM' => 'users AS u', |
|
203 'WHERE' => 'u.email=\''.$pun_db->escape($email).'\'' |
|
204 ); |
|
205 |
|
206 ($hook = get_hook('li_qr_get_user_data')) ? eval($hook) : null; |
|
207 $result = $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
208 if ($pun_db->num_rows($result)) |
|
209 { |
|
210 ($hook = get_hook('li_forgot_pass_pre_email')) ? eval($hook) : null; |
|
211 |
|
212 // Load the "activate password" template |
|
213 $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_password.tpl')); |
|
214 |
|
215 // The first row contains the subject |
|
216 $first_crlf = strpos($mail_tpl, "\n"); |
|
217 $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); |
|
218 $mail_message = trim(substr($mail_tpl, $first_crlf)); |
|
219 |
|
220 // Do the generic replacements first (they apply to all e-mails sent out here) |
|
221 $mail_message = str_replace('<base_url>', $base_url.'/', $mail_message); |
|
222 $mail_message = str_replace('<board_mailer>', sprintf($lang_common['Forum mailer'], $pun_config['o_board_title']), $mail_message); |
|
223 |
|
224 // Loop through users we found |
|
225 while ($cur_hit = $pun_db->fetch_assoc($result)) |
|
226 { |
|
227 // Generate a new password activation key |
|
228 $new_password_key = random_key(8, true); |
|
229 |
|
230 $query = array( |
|
231 'UPDATE' => 'users', |
|
232 'SET' => 'activate_key=\''.$new_password_key.'\'', |
|
233 'WHERE' => 'id='.$cur_hit['id'] |
|
234 ); |
|
235 |
|
236 ($hook = get_hook('li_qr_set_activate_key')) ? eval($hook) : null; |
|
237 $pun_db->query_build($query) or error(__FILE__, __LINE__); |
|
238 |
|
239 // Do the user specific replacements to the template |
|
240 $cur_mail_message = str_replace('<username>', $cur_hit['username'], $mail_message); |
|
241 $cur_mail_message = str_replace('<activation_url>', str_replace('&', '&', pun_link($pun_url['change_password_key'], array($cur_hit['id'], $new_password_key))), $cur_mail_message); |
|
242 |
|
243 pun_mail($email, $mail_subject, $cur_mail_message); |
|
244 } |
|
245 |
|
246 message(sprintf($lang_login['Forget mail'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>')); |
|
247 } |
|
248 else |
|
249 message(sprintf($lang_login['No e-mail match'], htmlspecialchars($email))); |
|
250 } |
|
251 |
|
252 // Setup form |
|
253 $pun_page['set_count'] = $pun_page['fld_count'] = 0; |
|
254 $pun_page['form_action'] = $base_url.'/login.php?action=forget_2'; |
|
255 |
|
256 // Setup breadcrumbs |
|
257 $pun_page['crumbs'] = array( |
|
258 array($pun_config['o_board_title'], pun_link($pun_url['index'])), |
|
259 $lang_login['New password request'] |
|
260 ); |
|
261 |
|
262 ($hook = get_hook('li_forgot_pass_pre_header_load')) ? eval($hook) : null; |
|
263 |
|
264 define ('PUN_PAGE', 'dialogue'); |
|
265 require PUN_ROOT.'header.php'; |
|
266 |
|
267 ?> |
|
268 <div id="pun-main" class="main"> |
|
269 |
|
270 <h1><span><?php echo end($pun_page['crumbs']) ?></span></h1> |
|
271 |
|
272 <div class="main-head"> |
|
273 <h2><span><?php echo $lang_login['New password head'] ?></span></h2> |
|
274 </div> |
|
275 |
|
276 <div class="main-content frm"> |
|
277 <div class="frm-info"> |
|
278 <p class="important"><?php echo $lang_login['New password info'] ?></p> |
|
279 </div> |
|
280 <div id="req-msg" class="frm-warn"> |
|
281 <p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p> |
|
282 </div> |
|
283 <form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>"> |
|
284 <div class="hidden"> |
|
285 <input type="hidden" name="form_sent" value="1" /> |
|
286 </div> |
|
287 <?php ($hook = get_hook('li_forgot_pass_pre_fieldset')) ? eval($hook) : null; ?> |
|
288 <fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>"> |
|
289 <legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend> |
|
290 <div class="frm-fld text required"> |
|
291 <label for="fld<?php echo ++$pun_page['fld_count'] ?>"> |
|
292 <span class="fld-label"><?php echo $lang_login['E-mail address'] ?></span><br /> |
|
293 <span class="fld-input"><input id="fld<?php echo $pun_page['fld_count'] ?>" type="text" name="req_email" size="35" maxlength="80" /></span><br /> |
|
294 <em class="req-text"><?php echo $lang_common['Required'] ?></em> |
|
295 <span class="fld-help"><?php echo $lang_login['E-mail address help'] ?></span> |
|
296 </label> |
|
297 </div> |
|
298 </fieldset> |
|
299 <?php ($hook = get_hook('li_forgot_pass_post_fieldset')) ? eval($hook) : null; ?> |
|
300 <div class="frm-buttons"> |
|
301 <span class="submit"><input type="submit" name="request_pass" value="<?php echo $lang_common['Submit'] ?>" /></span> |
|
302 <span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span> |
|
303 </div> |
|
304 </form> |
|
305 </div> |
|
306 |
|
307 </div> |
|
308 <?php |
|
309 |
|
310 require PUN_ROOT.'footer.php'; |
|
311 } |
|
312 |
|
313 if (!$pun_user['is_guest']) |
|
314 header('Location: '.pun_link($pun_url['index'])); |
|
315 |
|
316 // Setup form |
|
317 $pun_page['set_count'] = $pun_page['fld_count'] = 0; |
|
318 $pun_page['form_action'] = $base_url.'/login.php?action=in'; |
|
319 |
|
320 $pun_page['hidden_fields'] = array( |
|
321 '<input type="hidden" name="form_sent" value="1" />', |
|
322 '<input type="hidden" name="redirect_url" value="'.htmlspecialchars($pun_user['prev_url']).'" />' |
|
323 ); |
|
324 |
|
325 // Setup form information |
|
326 $pun_page['frm_info'] = array( |
|
327 '<li><span>'.sprintf($lang_login['Must be registered'], '<a href="'.pun_link($pun_url['register']).'">'.$lang_login['Register now'].'</a>').'</span></li>', |
|
328 '<li><span>'.sprintf($lang_login['Forgotten password'], '<a href="'.pun_link($pun_url['request_password']).'">'.$lang_login['Request pass'].'</a>').'</span></li>' |
|
329 ); |
|
330 |
|
331 // Setup breadcrumbs |
|
332 $pun_page['crumbs'] = array( |
|
333 array($pun_config['o_board_title'], pun_link($pun_url['index'])), |
|
334 $lang_common['Login'] |
|
335 ); |
|
336 |
|
337 ($hook = get_hook('li_login_pre_header_load')) ? eval($hook) : null; |
|
338 |
|
339 define('PUN_PAGE', 'login'); |
|
340 require PUN_ROOT.'header.php'; |
|
341 |
|
342 ?> |
|
343 <div id="pun-main" class="main"> |
|
344 |
|
345 <h1><span><?php echo end($pun_page['crumbs']) ?></span></h1> |
|
346 |
|
347 <div class="main-head"> |
|
348 <h2><span><?php printf($lang_login['Login info'], htmlspecialchars($pun_config['o_board_title'])) ?></span></h2> |
|
349 </div> |
|
350 |
|
351 <div class="main-content frm"> |
|
352 <div class="frm-info"> |
|
353 <ul> |
|
354 <?php echo implode("\n\t\t\t\t\t", $pun_page['frm_info'])."\n" ?> |
|
355 </ul> |
|
356 </div> |
|
357 <div id="req-msg" class="frm-warn"> |
|
358 <p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p> |
|
359 </div> |
|
360 <form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>"> |
|
361 <div class="hidden"> |
|
362 <?php echo implode("\n\t\t\t\t", $pun_page['hidden_fields'])."\n" ?> |
|
363 </div> |
|
364 <?php ($hook = get_hook('li_login_pre_fieldset')) ? eval($hook) : null; ?> |
|
365 <fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>"> |
|
366 <legend class="frm-legend"><strong><?php echo $lang_login['Login information'] ?></strong></legend> |
|
367 <div class="frm-fld text required"> |
|
368 <label for="fld<?php echo ++$pun_page['fld_count'] ?>"> |
|
369 <span class="fld-label"><?php echo $lang_login['Username'] ?></span><br /> |
|
370 <span class="fld-input"><input type="text" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_username" size="30" maxlength="25" /></span><br /> |
|
371 <em class="req-text"><?php echo $lang_common['Required'] ?></em> |
|
372 </label> |
|
373 </div> |
|
374 <div class="frm-fld text required"> |
|
375 <label for="fld<?php echo ++$pun_page['fld_count'] ?>"> |
|
376 <span class="fld-label"><?php echo $lang_login['Password'] ?></span><br /> |
|
377 <span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_password" size="30" /></span><br /> |
|
378 <em class="req-text"><?php echo $lang_common['Required'] ?></em> |
|
379 </label> |
|
380 </div> |
|
381 </fieldset> |
|
382 <?php ($hook = get_hook('li_login_post_fieldset')) ? eval($hook) : null; ?> |
|
383 <div class="frm-buttons"> |
|
384 <span class="submit"><input type="submit" name="login" value="<?php echo $lang_common['Login'] ?>" /></span> |
|
385 </div> |
|
386 </form> |
|
387 </div> |
|
388 |
|
389 </div> |
|
390 <?php |
|
391 |
|
392 ($hook = get_hook('li_end')) ? eval($hook) : null; |
|
393 |
|
394 require PUN_ROOT.'footer.php'; |