[Sommaire] [Imprimer]

   1  <?php
   2  # Mantis - a php based bugtracking system
   3  
   4  # Copyright (C) 2000 - 2002  Kenzaburo Ito - kenito@300baud.org
   5  # Copyright (C) 2002 - 2007  Mantis Team   - mantisbt-dev@lists.sourceforge.net
   6  
   7  # Mantis is free software: you can redistribute it and/or modify
   8  # it under the terms of the GNU General Public License as published by
   9  # the Free Software Foundation, either version 2 of the License, or
  10  # (at your option) any later version.
  11  #
  12  # Mantis is distributed in the hope that it will be useful,
  13  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  # GNU General Public License for more details.
  16  #
  17  # You should have received a copy of the GNU General Public License
  18  # along with Mantis.  If not, see <http://www.gnu.org/licenses/>.
  19  
  20      # --------------------------------------------------------
  21      # $Id: login_page.php,v 1.57.2.1 2007-10-13 22:33:19 giallu Exp $
  22      # --------------------------------------------------------
  23  
  24      # Login page POSTs results to login.php
  25      # Check to see if the user is already logged in
  26  
  27      require_once ( 'core.php' );
  28  
  29      if ( auth_is_user_authenticated() && !current_user_is_anonymous() ) {
  30          print_header_redirect( config_get( 'default_home_page' ) );
  31      }
  32  
  33      $f_error        = gpc_get_bool( 'error' );
  34      $f_cookie_error    = gpc_get_bool( 'cookie_error' );
  35      $f_return        = gpc_get_string( 'return', '' );
  36  
  37      # Check for HTTP_AUTH. HTTP_AUTH is handled in login.php
  38  
  39      if ( HTTP_AUTH == config_get( 'login_method' ) ) {
  40          $t_uri = "login.php";
  41  
  42          if ( !$f_return && ON == config_get( 'allow_anonymous_login' ) ) {
  43              $t_uri = "login_anon.php";
  44          }
  45  
  46          if ( $f_return ) {
  47              $t_uri .= "?return=" . urlencode( $f_return );
  48          }
  49  
  50          print_header_redirect( $t_uri );
  51          exit;
  52      }
  53  
  54      html_page_top1();
  55      html_page_top2a();
  56  
  57      echo '<br /><div align="center">';
  58  
  59      # Display short greeting message
  60      # echo lang_get( 'login_page_info' ) . '<br />';
  61  
  62      # Only echo error message if error variable is set
  63      if ( $f_error ) {
  64          echo '<font color="red">' . lang_get( 'login_error' ) . '</font>';
  65      }
  66      if ( $f_cookie_error ) {
  67          echo lang_get( 'login_cookies_disabled' ) . '<br />';
  68      }
  69  
  70      echo '</div>';
  71  ?>
  72  
  73  <!-- Login Form BEGIN -->
  74  <br />
  75  <div align="center">
  76  <form name="login_form" method="post" action="login.php">
  77  <table class="width50" cellspacing="1">
  78  <tr>
  79      <td class="form-title">
  80          <?php
  81              if ( !is_blank( $f_return ) ) {
  82              ?>
  83                  <input type="hidden" name="return" value="<?php echo string_html_specialchars( $f_return ) ?>" />
  84                  <?php
  85              }
  86              echo lang_get( 'login_title' ) ?>
  87      </td>
  88      <td class="right">
  89      <?php
  90          if ( ON == config_get( 'allow_anonymous_login' ) ) {
  91              print_bracket_link( 'login_anon.php', lang_get( 'login_anonymously' ) );
  92          }
  93      ?>
  94      </td>
  95  </tr>
  96  <tr class="row-1">
  97      <td class="category" width="25%">
  98          <?php echo lang_get( 'username' ) ?>
  99      </td>
 100      <td width="75%">
 101          <input type="text" name="username" size="32" maxlength="32" />
 102      </td>
 103  </tr>
 104  <tr class="row-2">
 105      <td class="category">
 106          <?php echo lang_get( 'password' ) ?>
 107      </td>
 108      <td>
 109          <input type="password" name="password" size="16" maxlength="32" />
 110      </td>
 111  </tr>
 112  <tr class="row-1">
 113      <td class="category">
 114          <?php echo lang_get( 'save_login' ) ?>
 115      </td>
 116      <td>
 117          <input type="checkbox" name="perm_login" />
 118      </td>
 119  </tr>
 120  <tr>
 121      <td class="center" colspan="2">
 122          <input type="submit" class="button" value="<?php echo lang_get( 'login_button' ) ?>" />
 123      </td>
 124  </tr>
 125  </table>
 126  </form>
 127  </div>
 128  
 129  <?php
 130      PRINT '<br /><div align="center">';
 131      print_signup_link();
 132      PRINT '&nbsp;';
 133      print_lost_password_link();
 134      PRINT '</div>';
 135  
 136      #
 137      # Do some checks to warn administrators of possible security holes.
 138      # Since this is considered part of the admin-checks, the strings are not translated.
 139      #
 140  
 141      # Warning, if plain passwords are selected
 142      if ( config_get( 'login_method' ) === PLAIN ) {
 143          echo '<div class="warning" align="center">';
 144          echo '<p><font color="red"><strong>WARNING:</strong> Plain password authentication is used, this will expose your passwords to administrators.</font></p>';
 145          echo '</div>';
 146      }
 147  
 148      # Generate a warning if administrator/root is valid.
 149      $t_admin_user_id = user_get_id_by_name( 'administrator' );
 150      if ( $t_admin_user_id !== false ) {
 151          if ( user_is_enabled( $t_admin_user_id ) && auth_does_password_match( $t_admin_user_id, 'root' ) ) {
 152              echo '<div class="warning" align="center">';
 153              echo '<p><font color="red"><strong>WARNING:</strong> You should disable the default "administrator" account or change its password.</font></p>';
 154              echo '</div>';
 155          }
 156      }
 157  
 158      # Check if the admin directory is available and is readable.
 159      $t_admin_dir = dirname( __FILE__ ) . DIRECTORY_SEPARATOR . 'admin' . DIRECTORY_SEPARATOR;
 160      if ( is_dir( $t_admin_dir ) && is_readable( $t_admin_dir ) ) {
 161          echo '<div class="warning" align="center">', "\n";
 162          echo '<p><font color="red"><strong>WARNING:</strong> Admin directory should be removed.</font></p>', "\n";
 163          echo '</div>', "\n";
 164              
 165          # since admin directory and db_upgrade lists are available check for missing db upgrades    
 166          # Check for db upgrade for versions < 1.0.0 using old upgrader
 167          $t_db_version = config_get( 'database_version' , 0 );
 168          # if db version is 0, we haven't moved to new installer.
 169          if ( $t_db_version == 0 ) {
 170              if ( db_table_exists( config_get( 'mantis_upgrade_table' ) ) ) {
 171                  $query = "SELECT COUNT(*) from " . config_get( 'mantis_upgrade_table' ) . ";";
 172                  $result = db_query( $query );
 173                  if ( db_num_rows( $result ) < 1 ) {
 174                      $t_upgrade_count = 0;
 175                  } else {
 176                      $t_upgrade_count = (int)db_result( $result );
 177                  }
 178              } else {
 179                  $t_upgrade_count = 0;
 180              }
 181  
 182              if ( $t_upgrade_count > 0 ) { # table exists, check for number of updates
 183                  if ( file_exists( 'admin/upgrade_inc.php' ) ) {
 184                      require_once( 'admin/upgrade_inc.php' );
 185                      $t_upgrades_reqd = $upgrade_set->count_items();
 186                  } else {
 187                      // can't find upgrade file, assume system is up to date
 188                      $t_upgrades_reqd = $t_upgrade_count;
 189                  }
 190              } else {
 191                  $t_upgrades_reqd = 1000; # arbitrarily large number to force an upgrade
 192              }
 193  
 194              if ( ( $t_upgrade_count != $t_upgrades_reqd ) &&
 195                      ( $t_upgrade_count != ( $t_upgrades_reqd + 10 ) ) ) { # there are 10 optional data escaping fixes that may be present
 196                  echo '<div class="warning" align="center">';
 197                  echo '<p><font color="red"><strong>WARNING:</strong> The database structure may be out of date. Please upgrade <a href="admin/upgrade.php">here</a> before logging in.</font></p>';
 198                  echo '</div>';
 199              }
 200          }
 201  
 202          # Check for db upgrade for versions > 1.0.0 using new installer and schema
 203          require_once( 'admin/schema.php' );
 204          $t_upgrades_reqd = sizeof( $upgrade ) - 1;
 205  
 206          if ( ( 0 < $t_db_version ) &&
 207                  ( $t_db_version != $t_upgrades_reqd ) ) {
 208  
 209              if ( $t_db_version < $t_upgrades_reqd ) {
 210                  echo '<div class="warning" align="center">';
 211                  echo '<p><font color="red"><strong>WARNING:</strong> The database structure may be out of date. Please upgrade <a href="admin/install.php">here</a> before logging in.</font></p>';
 212                  echo '</div>';
 213              } else {
 214                  echo '<div class="warning" align="center">';
 215                  echo '<p><font color="red"><strong>WARNING:</strong> The database structure is more up-to-date than the code installed.  Please upgrade the code.</font></p>';
 216                  echo '</div>';
 217              }
 218          }
 219      }
 220  ?>
 221  
 222  <!-- Autofocus JS -->
 223  <?php if ( ON == config_get( 'use_javascript' ) ) { ?>
 224  <script type="text/javascript" language="JavaScript">
 225  <!--
 226      window.document.login_form.username.focus();
 227  // -->
 228  </script>
 229  <?php } ?>
 230  
 231  <?php html_page_bottom1a( __FILE__ ) ?>