Dotclear 2.0-beta6 : /admin/auth.php source

[Sommaire] [Imprimer]
   1  <?php
   2  # ***** BEGIN LICENSE BLOCK *****
   3  # This file is part of DotClear.
   4  # Copyright (c) 2005 Olivier Meunier and contributors. All rights
   5  # reserved.
   6  #
   7  # DotClear is free software; you can redistribute it and/or modify
   8  # it under the terms of the GNU General Public License as published by
   9  # the Free Software Foundation; either version 2 of the License, or
  10  # (at your option) any later version.
  11  # 
  12  # DotClear is distributed in the hope that it will be useful,
  13  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  # GNU General Public License for more details.
  16  # 
  17  # You should have received a copy of the GNU General Public License
  18  # along with DotClear; if not, write to the Free Software
  19  # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  20  #
  21  # ***** END LICENSE BLOCK *****
  22  
  23  require dirname(__FILE__).'/../inc/admin/prepend.php';
  24  
  25  # If we have a session cookie, go to index.php
  26  if (isset($_SESSION['sess_user_id']))
  27  {
  28      http::redirect('index.php');
  29  }
  30  
  31  # Loading locales for detected language
  32  $dlang = http::getAcceptLanguage();
  33  if ($dlang) {
  34      l10n::set(dirname(__FILE__).'/../locales/'.$dlang.'/main');
  35  }
  36  
  37  $page_url = http::getHost().$_SERVER['REQUEST_URI'];
  38  
  39  $recover = $core->auth->allowPassChange() && !empty($_REQUEST['recover']);
  40  $akey = $core->auth->allowPassChange() && !empty($_GET['akey']) ? $_GET['akey'] : null;
  41  $user_id = $user_pwd = $user_key = $user_email = null;
  42  $err = $msg = null;
  43  
  44  # Auto upgrade
  45  if (empty($_GET) && empty($_POST)) {
  46      require dirname(__FILE__).'/../inc/dbschema/upgrade.php';
  47      try {
  48          if (dotclearUpgrade($core) == true) {
  49              $msg = __('DotClear has been upgraded.');
  50          }
  51      } catch (Exception $e) {
  52          $err = $e->getMessage();
  53      }
  54  }
  55  
  56  # If we have POST login informations, go throug auth process
  57  if (!empty($_POST['user_id']) && !empty($_POST['user_pwd']))
  58  {
  59      $user_id = !empty($_POST['user_id']) ? $_POST['user_id'] : null;
  60      $user_pwd = !empty($_POST['user_pwd']) ? $_POST['user_pwd'] : null;
  61  }
  62  # If we have POST login informations, go throug auth process
  63  elseif (isset($_COOKIE['dc_admin']) &&
  64  ($cookie_admin = @unserialize($_COOKIE['dc_admin'])) !== false)
  65  {
  66      # If we have a remember cookie, go through auth process with user_key
  67      $user_id = $cookie_admin['user_id'];
  68      $user_pwd = null;
  69      $user_key = $cookie_admin['user_key'];
  70  }
  71  
  72  # Recover password
  73  if ($recover && !empty($_POST['user_id']) && !empty($_POST['user_email']))
  74  {
  75      $user_id = !empty($_POST['user_id']) ? $_POST['user_id'] : null;
  76      $user_email = !empty($_POST['user_email']) ? $_POST['user_email'] : '';
  77      try
  78      {
  79          $recover_key = $core->auth->setRecoverKey($user_id,$user_email);
  80          
  81          $subject = mb_encode_mimeheader('DotClear '.__('Password reset'),'UTF-8','B');
  82          $message =
  83          __('Someone has requested to reset the password for the following site and username.')."\n\n".
  84          $page_url."\n".__('Username:').' '.$user_id."\n\n".
  85          __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.')."\n".
  86          $page_url.'?akey='.$recover_key;
  87          
  88          $headers[] = 'From: dotclear@'.$_SERVER['HTTP_HOST'];
  89          $headers[] = 'Content-Type: text/plain; charset=UTF-8;';
  90          
  91          mail::sendMail($user_email,$subject,$message,$headers);
  92          $msg = sprintf(__('The e-mail was sent successfully to %s.'),$user_email);
  93      }
  94      catch (Exception $e)
  95      {
  96          $err = $e->getMessage();
  97      }
  98  }
  99  # Send new password
 100  elseif ($akey)
 101  {
 102      try
 103      {
 104          $recover_res = $core->auth->recoverUserPassword($akey);
 105          
 106          $subject = mb_encode_mimeheader('DotClear '.__('Your new password'),'UTF-8','B');
 107          $message =
 108          __('Username:').' '.$recover_res['user_id']."\n".
 109          __('Password:').' '.$recover_res['new_pass']."\n\n".
 110          preg_replace('/\?(.*)$/','',$page_url);
 111          
 112          $headers[] = 'From: dotclear@'.$_SERVER['HTTP_HOST'];
 113          $headers[] = 'Content-Type: text/plain; charset=UTF-8;';
 114          
 115          mail::sendMail($recover_res['user_email'],$subject,$message,$headers);
 116          $msg = __('Your new password is in your mailbox.');
 117      }
 118      catch (Exception $e)
 119      {
 120          $err = $e->getMessage();
 121      }
 122  }
 123  # Try to log
 124  elseif ($user_id !== null && ($user_pwd !== null || $user_key !== null))
 125  {
 126      # We check the user
 127      if ($core->auth->checkUser($user_id,$user_pwd,$user_key) === true)
 128      {
 129          $core->session->start();
 130          $_SESSION['sess_user_id'] = $user_id;
 131          $_SESSION['sess_user_ip'] = http::realIP();
 132          
 133          if (!empty($_POST['blog'])) {
 134              $_SESSION['sess_blog_id'] = $_POST['blog'];
 135          }
 136          
 137          if (!empty($_POST['user_remember'])) {
 138              $cookie_admin = array(
 139                  'user_id' => $user_id,
 140                  'user_key' => crypt::hmac(DC_MASTER_KEY,
 141                      $user_id.
 142                      crypt::hmac(DC_MASTER_KEY,$user_pwd).
 143                      http::realIP().
 144                      $_SERVER['HTTP_USER_AGENT'])
 145              );
 146              setcookie('dc_admin',serialize($cookie_admin),strtotime('+15 days'),'/');
 147          }
 148          
 149          http::redirect('index.php');
 150      }
 151      else
 152      {
 153          if (isset($_COOKIE['dc_admin'])) {
 154              unset($_COOKIE['dc_admin']);
 155              setcookie('dc_admin',null,0,'/');
 156          }
 157          $err = __('Wrong username or password');
 158      }
 159  }
 160  
 161  if (isset($_GET['user'])) {
 162      $user_id = $_GET['user'];
 163  }
 164  
 165  header('Content-Type: text/html; charset=UTF-8');
 166  ?>
 167  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 168  <html xmlns="http://www.w3.org/1999/xhtml"
 169  xml:lang="en" lang="en">
 170  <head>
 171    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
 172    <meta http-equiv="Content-Script-Type" content="text/javascript" />
 173    <meta http-equiv="Content-Style-Type" content="text/css" />
 174    <meta http-equiv="Content-Language" content="en" />
 175    <meta name="MSSmartTagsPreventParsing" content="TRUE" />
 176    <meta name="ROBOTS" content="NOARCHIVE,NOINDEX,NOFOLLOW" />
 177    <meta name="GOOGLEBOT" content="NOSNIPPET" />
 178    <title>DotClear</title>
 179    
 180  <?php
 181  echo dcPage::jsLoadIE7();
 182  echo dcPage::jsCommon();
 183  ?>
 184    
 185    <style type="text/css">
 186    @import url(style/default.css); 
 187    </style>
 188    <?php
 189    # --BEHAVIOR-- loginPageHTMLHead
 190    $core->callBehavior('loginPageHTMLHead');
 191    ?>
 192  </head>
 193  
 194  <body id="dotclear-admin" class="auth">
 195  
 196  <form action="auth.php" method="post" id="login-screen">
 197  <h1><?php echo DC_VENDOR_NAME; ?></h1>
 198  
 199  <?php
 200  if ($err) {
 201      echo '<div class="error">'.$err.'</div>';
 202  }
 203  if ($msg) {
 204      echo '<p class="message">'.$msg.'</p>';
 205  }
 206  
 207  if ($akey)
 208  {
 209      echo '<p><a href="auth.php">'.__('Back to login screen').'</a></p>';
 210  }
 211  elseif ($recover)
 212  {
 213      echo
 214      '<fieldset><legend>'.__('Request a new password').'</legend>'.
 215      '<p><label>'.__('Login:').' '.
 216      form::field(array('user_id'),20,32,html::escapeHTML($user_id),'',1).'</label></p>'.
 217      
 218      '<p><label>'.__('Email:').' '.
 219      form::field(array('user_email'),20,255,html::escapeHTML($user_email),'',2).'</label></p>'.
 220      
 221      '<p><input type="submit" value="'.__('recover').'" tabindex="3" />'.
 222      form::hidden(array('recover'),1).'</p>'.
 223      '</fieldset>'.
 224      
 225      '<p><a href="auth.php">'.__('Back to login screen').'</a></p>';
 226  }
 227  else
 228  {
 229      echo
 230      '<fieldset>'.
 231      '<p><label>'.__('Login:').' '.
 232      form::field(array('user_id'),20,32,html::escapeHTML($user_id),'',1).'</label></p>'.
 233      
 234      '<p><label>'.__('Password:').' '.
 235      form::password(array('user_pwd'),20,255,'','',2).'</label></p>'.
 236      
 237      '<p><label class="classic">'.
 238      form::checkbox(array('user_remember'),1,'','',3).' '.
 239      __('Remember my ID on this computer').'</label></p>'.
 240      
 241      '<p><input type="submit" value="'.__('login').'" tabindex="4" /></p>';
 242      
 243      if (!empty($_REQUEST['blog'])) {
 244          echo form::hidden('blog',$_REQUEST['blog']);
 245      }
 246      
 247      echo
 248      '</fieldset>'.
 249      
 250      '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
 251      
 252      if ($core->auth->allowPassChange()) {
 253          echo '<p><a href="auth.php?recover=1">'.__('I forgot my password').'</a></p>';
 254      }
 255  }
 256  ?>
 257  </form>
 258  
 259  <script type="text/javascript">
 260  //<![CDATA[
 261  $('input[@name="user_id"]').get(0).focus();
 262  //]]>
 263  </script>
 264  
 265  </body>
 266  </html>
Code source de Dotclear 2.0-beta6

/admin/ -> auth.php (source)
