Changeset 1858 in ExiteCMS for trunk/setuser.php


Ignore:
Timestamp:
10/17/08 16:40:38 (4 years ago)
Author:
hverton
Message:

rewritten the login/logout code, all code is now located in setuser.php
added a security setting "require SSL for logins"
added a security setting "require login before site access"
fixed small date display issue in several rev. upgrade files
added alternative login methods to the full-screen login

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/setuser.php

    r1853 r1858  
    33| ExiteCMS Content Management System                 | 
    44+----------------------------------------------------+ 
    5 | Copyright 2007 Harro "WanWizard" Verton, Exite BV  | 
     5| Copyright 2008 Harro "WanWizard" Verton, Exite BV  | 
    66| for support, please visit http://exitecms.exite.eu | 
    77+----------------------------------------------------+ 
    … …  
    1414+----------------------------------------------------*/ 
    1515require_once dirname(__FILE__)."/includes/core_functions.php"; 
    16 require_once dirname(__FILE__)."/includes/theme_functions.php"; 
     16require_once PATH_INCLUDES."theme_functions.php"; 
     17 
     18/*---------------------------------------------------+ 
     19| User authentication functions                      | 
     20+----------------------------------------------------*/ 
     21 
     22// authentication against the local user database 
     23function auth_local($userid, $password) { 
     24    global $db_prefix; 
     25     
     26    // check and validate the given userid and pasword 
     27    $user_pass = md5(md5($password)); 
     28    $user_name = preg_replace(array("/\=/","/\#/","/\sOR\s/"), "", stripinput($userid)); 
     29 
     30    // check if we have a user record for this userid and password 
     31    $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_name='$user_name' AND user_password='".$user_pass."'"); 
     32    if (dbrows($result) == 0) { 
     33        // not found, display an error message 
     34        return 3; 
     35    } else { 
     36        // found, get the record and do some more validation 
     37        $ret = auth_user_validate(dbarray($result)); 
     38        return $ret; 
     39    } 
     40} 
     41 
     42// authentication against an LDAP server 
     43function auth_ldap($userid, $password) { 
     44    terminate('auth_ldap not defined yet!'); 
     45} 
     46 
     47// authentication against an Active Directory server 
     48function auth_ad($userid, $password) { 
     49    terminate('auth_ad not defined yet!'); 
     50} 
     51 
     52// authentication using an OpenID 
     53function auth_openid($openid_url) { 
     54    global $settings; 
     55 
     56    // check if the URL is valid 
     57    if (isURL($openid_url)) { 
     58        require_once(PATH_INCLUDES."class.openid.php"); 
     59        $openid = new SimpleOpenID; 
     60        $openid->SetIdentity($openid_url); 
     61        $openid->SetApprovedURL($settings['siteurl']."setuser.php"); 
     62        $openid->SetTrustRoot($settings['siteurl']); 
     63        $server_url = $openid->GetOpenIDServer(); 
     64        if ($server_url) { 
     65            redirect($openid->GetRedirectURL() , "script"); 
     66            exit; 
     67        } 
     68    } else { 
     69        // for now... 
     70        return 0; 
     71    } 
     72} 
     73 
     74// further validation on the userid found 
     75function auth_user_validate($userrecord) { 
     76    global $settings; 
     77 
     78    // if the account is suspended, check for an expiry date 
     79    if ($userrecord['user_status'] == 1 && $userrecord['user_ban_expire'] > 0 && $userrecord['user_ban_expire'] < time() ) { 
     80        // if this user's email address is marked as bad, reset the countdown counter 
     81        $userrecord['user_bad_email'] = $userrecord['user_bad_email'] == 0 ? 0 : time(); 
     82        // reset the user status and the expiry date 
     83        $result = dbquery("UPDATE ".$db_prefix."users SET user_status='0', user_ban_expire='0', user_bad_email = '".$userrecord['user_bad_email']."' WHERE user_id='".$userrecord['user_id']."'"); 
     84        $userrecord['user_status'] = 0; 
     85    } 
     86    if ($userrecord['user_status'] == 0) {   
     87        header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
     88        // set the 'remember me' status value  
     89        $_SESSION['remember_me'] = isset($_POST['remember_me']) ? "yes" : "no"; 
     90        $_SESSION['userinfo'] = $userrecord['user_id'].".".$userrecord['user_password']; 
     91        // login expiry defined? 
     92        if ($settings['login_expire']) { 
     93            if (isset($_POST['remember_me']) && $_POST['remember_me'] == "yes") { 
     94                $_SESSION['login_expire'] = time() + $settings['login_extended_expire']; 
     95            } else { 
     96                $_SESSION['login_expire'] = time() + $settings['login_expire']; 
     97            } 
     98        } else { 
     99            $_SESSION['login_expire'] = mktime(0,0,0,1,1,2038); // do not expire 
     100        } 
     101        return 4; 
     102    } elseif ($userrecord['user_status'] == 1) { 
     103        return 1; 
     104    } elseif ($userrecord['user_status'] == 2) { 
     105        return 2; 
     106    } else { 
     107        return 0; 
     108    } 
     109} 
     110 
     111 
     112/*---------------------------------------------------+ 
     113| Main code                                          | 
     114+----------------------------------------------------*/ 
     115 
    17116// temp storage for template variables 
    18117$variables = array(); 
     118 
     119// array to store the lines of the setuser message 
     120$message = array(); 
     121 
     122// make sure the error variable has a value 
     123if (!isset($error) || !isNum($error)) $error = 0; 
    19124 
    20125// set the redirect url (set in theme_cleanup), butnot when in maintenance! 
    … …  
    29134} 
    30135 
    31 // array to store the lines of the setuser message 
    32 $message = array(); 
    33  
    34 // make sure the error parameter has a value 
    35 if (!isset($error) || !isNum($error)) $error = 0; 
    36  
    37 if (isset($_REQUEST['logout']) && $_REQUEST['logout'] == "yes") { 
     136if (isset($_GET['logout']) && $_GET['logout'] == "yes") { 
     137 
     138    // process the logout request 
     139 
    38140    header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
    39141    // make sure the user info is erased from the session 
    … …  
    45147        $message['line2'] =  "<b>".$locale['192'].$userdata['user_name']."</b>"; 
    46148    } 
     149 
     150} elseif (isset($_GET['login']) && $_GET['login'] == "yes") { 
     151 
     152    // process the login request 
     153    $auth_methods = isset($settings['auth_type']) ? explode(",",$settings['auth_type'].",") : array('local'); 
     154    foreach($auth_methods as $auth_method) { 
     155        switch($auth_method) { 
     156            case "local": 
     157                // authentication against the local user database 
     158                if (!empty($_POST['user_name']) && !empty($_POST['user_pass'])) { 
     159                    $error = auth_local($_POST['user_name'], $_POST['user_pass']); 
     160                } 
     161                break; 
     162            case "ldap": 
     163                break; 
     164            case "ad": 
     165                break; 
     166            case "openid": 
     167                // authentication against an openid provider 
     168                if (!empty($_POST['user_openid_url'])) { 
     169                    $error = auth_openid($_POST['user_openid_url']); 
     170                } 
     171                break; 
     172            case "default": 
     173                // empty or unknown entry, ignore 
     174                break; 
     175        } 
     176    } 
     177 
    47178} else { 
    48     if ($error == 1) { 
     179 
     180    if (isset($_GET['openid_mode'])) { 
     181        // handle openid login 
     182        require_once(PATH_INCLUDES."class.openid.php"); 
     183        $openid = new SimpleOpenID; 
     184        $openid->SetIdentity(urldecode($_GET['openid_identity'])); 
     185        if ($openid->ValidateWithServer()) { 
     186            $openid_url = strtolower($openid->OpenID_Standarize($_GET['openid_identity'])); 
     187            $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_openid_url='".$openid_url."'"); 
     188            if (dbrows($result) != 0) { 
     189                // found, get the record and do some more validation 
     190                $error = auth_user_validate(dbarray($result)); 
     191            } else { 
     192                $message['line2'] =  "<b>".$locale['196']."</b>"; 
     193            } 
     194        } else { 
     195            trigger_error($openid->GetError()); 
     196            exit; 
     197        } 
     198    } 
     199 
     200} 
     201 
     202// check the result of the authentication attempt, and process it 
     203switch($error) { 
     204    case 0: 
     205        //  
     206        $refresh = 1; 
     207        break; 
     208    case 1: 
    49209        $message['line1'] = "<b>".$locale['194']."</b>"; 
    50210        $data = dbarray(dbquery("SELECT user_ban_reason, user_ban_expire FROM ".$db_prefix."users WHERE user_id='$user_id'")); 
    … …  
    53213            if ($data['user_ban_expire'] > 0) $message['line4']  = "<b>".$locale['181']." ".showdate('forumdate', $data['user_ban_expire'])."</b>"; 
    54214        } 
    55     } elseif ($error == 2) { 
     215        $refresh = 10; 
     216        break; 
     217    case 2: 
    56218        $message['line2'] =  "<b>".$locale['195']."</b>"; 
    57     } elseif ($error == 3) { 
     219        $refresh = 10; 
     220        break; 
     221    case 3: 
    58222        $message['line2'] =  "<b>".$locale['196']."</b>"; 
    59     } else { 
    60         if (isset($_GET['openid_mode'])) { 
    61             // handle openid login 
    62             require_once(PATH_INCLUDES."class.openid.php"); 
    63             $openid = new SimpleOpenID; 
    64             $openid->SetIdentity(urldecode($_GET['openid_identity'])); 
    65             if ($openid->ValidateWithServer()) { 
    66                 $openid_url = strtolower($openid->OpenID_Standarize($_GET['openid_identity'])); 
    67                 $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_openid_url='".$openid_url."'"); 
    68                 if (dbrows($result) != 0) { 
    69                     // found, get the record and do some more validation 
    70                     $res = auth_user_validate(dbarray($result)); 
    71                     if (!is_array($res)) { 
    72                         $message['line2'] =  "<b>Internal error: Invalid auth_user_validate() return code!</b>"; 
    73                     } 
    74                 } else { 
    75                     $message['line2'] =  "<b>".$locale['196']."</b>"; 
    76                 } 
    77             } else { 
    78                 trigger_error($openid->GetError()); 
    79                 exit; 
    80             } 
    81         } 
     223        $refresh = 10; 
     224        break; 
     225    case 4: 
    82226        if (isset($_SESSION['userinfo'])) { 
    83             // handle local login 
     227            // now that we have user info, finish the login validation 
    84228            $userinfo_vars = explode(".", $_SESSION['userinfo']); 
    85229            $user_pass = (preg_match("/^[0-9a-z]{32}$/", $userinfo_vars['1']) ? $userinfo_vars['1'] : ""); 
    … …  
    92236                $result = dbquery("DELETE FROM ".$db_prefix."online WHERE online_user='0' AND online_ip='".USER_IP."'"); 
    93237                $message['line2'] =  "<b>".$locale['193'].$data['user_name']."</b>"; 
     238                $refresh = 1; 
    94239            } else { 
    95240                $message['line2'] =  "<b>".$locale['196']."</b>"; 
     241                $refresh = 10; 
    96242            } 
    97243        } else { 
    98244            $message['line2'] =  "<b>SESSION ERROR. Please report this to the Webmaster</b>"; 
    99         } 
    100     } 
     245            $refresh = 99999; 
     246        } 
     247        break; 
     248    case 5: 
     249        $message['line2'] =  "<b>".$locale['https']."</b>"; 
     250        $refresh = 99999; 
     251        break; 
     252    default: 
     253        // unknown result code 
     254        _debug($error); 
     255        terminate("unknown result code from an authentication module!"); 
     256        break; 
    101257} 
    102258 
    … …  
    106262// auto-redirect counter (in seconds) 
    107263$variables['error'] = $error; 
    108 $variables['refresh'] = $error==0 ? 1 : 10; 
     264$variables['refresh'] = isset($refresh) ? $refresh : 10; 
    109265 
    110266// define the first body panel variables 
Note: See TracChangeset for help on using the changeset viewer.