[Sommaire] [Imprimer]

   1  <?php
   2  /***********************************************************************

   3  

   4    Copyright (C) 2002-2005  Rickard Andersson (rickard@punbb.org)

   5  

   6    This file is part of PunBB.

   7  

   8    PunBB is free software; you can redistribute it and/or modify it

   9    under the terms of the GNU General Public License as published

  10    by the Free Software Foundation; either version 2 of the License,

  11    or (at your option) any later version.

  12  

  13    PunBB is distributed in the hope that it will be useful, but

  14    WITHOUT ANY WARRANTY; without even the implied warranty of

  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  16    GNU General Public License for more details.

  17  

  18    You should have received a copy of the GNU General Public License

  19    along with this program; if not, write to the Free Software

  20    Foundation, Inc., 59 Temple Place, Suite 330, Boston,

  21    MA  02111-1307  USA

  22  

  23  ************************************************************************/
  24  
  25  
  26  if (isset($_GET['action']))
  27      define('PUN_QUIET_VISIT', 1);
  28  
  29  define('PUN_ROOT', './');
  30  require  PUN_ROOT.'include/common.php';
  31  
  32  
  33  // Load the login.php language file

  34  require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
  35  
  36  $action = isset($_GET['action']) ? $_GET['action'] : null;
  37  
  38  if (isset($_POST['form_sent']) && $action == 'in')
  39  {
  40      $form_username = trim($_POST['req_username']);
  41      $form_password = trim($_POST['req_password']);
  42  
  43      $username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$db->escape($form_username).'\')';
  44  
  45      $result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
  46      list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result);
  47  
  48      $authorized = false;
  49  
  50      if (!empty($db_password_hash))
  51      {
  52          $sha1_in_db = (strlen($db_password_hash) == 40) ? true : false;
  53          $sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false;
  54  
  55          $form_password_hash = pun_hash($form_password);    // This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available)

  56  
  57          if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash)
  58              $authorized = true;
  59          else if (!$sha1_in_db && $db_password_hash == md5($form_password))
  60          {
  61              $authorized = true;
  62  
  63              if ($sha1_available)    // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
  64                  $db->query('UPDATE '.$db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $db->error());
  65          }
  66      }
  67  
  68      if (!$authorized)
  69          message($lang_login['Wrong user/pass'].' <a href="login.php?action=forget">'.$lang_login['Forgotten pass'].'</a>');
  70  
  71      // Update the status if this is the first time the user logged in

  72      if ($group_id == PUN_UNVERIFIED)
  73          $db->query('UPDATE '.$db->prefix.'users SET group_id='.$pun_config['o_default_user_group'].' WHERE id='.$user_id) or error('Unable to update user status', __FILE__, __LINE__, $db->error());
  74  
  75      // Remove this users guest entry from the online list

  76      $db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape(get_remote_address()).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());
  77  
  78      $expire = ($save_pass == '1') ? time() + 31536000 : 0;
  79      pun_setcookie($user_id, $form_password_hash, $expire);
  80  
  81      redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']);
  82  }
  83  
  84  
  85  else if ($action == 'out')
  86  {
  87      if ($pun_user['is_guest'] || !isset($_GET['id']) || $_GET['id'] != $pun_user['id'])
  88      {
  89          header('Location: index.php');
  90          exit;
  91      }
  92  
  93      // Remove user from "users online" list.

  94      $db->query('DELETE FROM '.$db->prefix.'online WHERE user_id='.$pun_user['id']) or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());
  95  
  96      // Update last_visit (make sure there's something to update it with)

  97      if (isset($pun_user['logged']))
  98          $db->query('UPDATE '.$db->prefix.'users SET last_visit='.$pun_user['logged'].' WHERE id='.$pun_user['id']) or error('Unable to update user visit data', __FILE__, __LINE__, $db->error());
  99  
 100      pun_setcookie(1, random_pass(8), time() + 31536000);
 101  
 102      redirect('index.php', $lang_login['Logout redirect']);
 103  }
 104  
 105  
 106  else if ($action == 'forget' || $action == 'forget_2')
 107  {
 108      if (!$pun_user['is_guest'])
 109          header('Location: index.php');
 110  
 111      if (isset($_POST['form_sent']))
 112      {
 113          require  PUN_ROOT.'include/email.php';
 114  
 115          // Validate the email-address

 116          $email = strtolower(trim($_POST['req_email']));
 117          if (!is_valid_email($email))
 118              message($lang_common['Invalid e-mail']);
 119  
 120          $result = $db->query('SELECT id, username FROM '.$db->prefix.'users WHERE email=\''.$db->escape($email).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
 121  
 122          if ($db->num_rows($result))
 123          {
 124              // Load the "activate password" template

 125              $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_password.tpl'));
 126  
 127              // The first row contains the subject

 128              $first_crlf = strpos($mail_tpl, "\n");
 129              $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8));
 130              $mail_message = trim(substr($mail_tpl, $first_crlf));
 131  
 132              // Do the generic replacements first (they apply to all e-mails sent out here)

 133              $mail_message = str_replace('<base_url>', $pun_config['o_base_url'].'/', $mail_message);
 134              $mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message);
 135  
 136              // Loop through users we found

 137              while ($cur_hit = $db->fetch_assoc($result))
 138              {
 139                  // Generate a new password and a new password activation code

 140                  $new_password = random_pass(8);
 141                  $new_password_key = random_pass(8);
 142  
 143                  $db->query('UPDATE '.$db->prefix.'users SET activate_string=\''.pun_hash($new_password).'\', activate_key=\''.$new_password_key.'\' WHERE id='.$cur_hit['id']) or error('Unable to update activation data', __FILE__, __LINE__, $db->error());
 144  
 145                  // Do the user specific replacements to the template

 146                  $cur_mail_message = str_replace('<username>', $cur_hit['username'], $mail_message);
 147                  $cur_mail_message = str_replace('<activation_url>', $pun_config['o_base_url'].'/profile.php?id='.$cur_hit['id'].'&action=change_pass&key='.$new_password_key, $cur_mail_message);
 148                  $cur_mail_message = str_replace('<new_password>', $new_password, $cur_mail_message);
 149  
 150                  pun_mail($email, $mail_subject, $cur_mail_message);
 151              }
 152  
 153              message($lang_login['Forget mail'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.');
 154          }
 155          else
 156              message($lang_login['No e-mail match'].' '.htmlspecialchars($email).'.');
 157      }
 158  
 159  
 160      $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_login['Request pass'];
 161      $required_fields = array('req_email' => $lang_common['E-mail']);
 162      $focus_element = array('request_pass', 'req_email');
 163      require  PUN_ROOT.'header.php';
 164  
 165  ?>
 166  <div class="blockform">
 167      <h2><span><?php echo $lang_login['Request pass'] ?></span></h2>
 168      <div class="box">
 169          <form id="request_pass" method="post" action="login.php?action=forget_2" onsubmit="this.request_pass.disabled=true;if(process_form(this)){return true;}else{this.request_pass.disabled=false;return false;}">
 170              <div class="inform">
 171                  <fieldset>
 172                      <legend><?php echo $lang_login['Request pass legend'] ?></legend>
 173                      <div class="infldset">
 174                          <input type="hidden" name="form_sent" value="1" />
 175                          <input id="req_email" type="text" name="req_email" size="50" maxlength="50" />
 176                          <p><?php echo $lang_login['Request pass info'] ?></p>
 177                      </div>
 178                  </fieldset>
 179              </div>
 180              <p><input type="submit" name="request_pass" value="<?php echo $lang_common['Submit'] ?>" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p>
 181          </form>
 182      </div>
 183  </div>
 184  <?php
 185  
 186      require  PUN_ROOT.'footer.php';
 187  }
 188  
 189  
 190  if (!$pun_user['is_guest'])
 191      header('Location: index.php');
 192  
 193  // Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to index.php after login)

 194  $redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : 'index.php';
 195  
 196  $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Login'];
 197  $required_fields = array('req_username' => $lang_common['Username'], 'req_password' => $lang_common['Password']);
 198  $focus_element = array('login', 'req_username');
 199  require  PUN_ROOT.'header.php';
 200  
 201  ?>
 202  <div class="blockform">
 203      <h2><span><?php echo $lang_common['Login'] ?></span></h2>
 204      <div class="box">
 205          <form id="login" method="post" action="login.php?action=in" onsubmit="return process_form(this)">
 206              <div class="inform">
 207                  <fieldset>
 208                      <legend><?php echo $lang_login['Login legend'] ?></legend>
 209                          <div class="infldset">
 210                              <input type="hidden" name="form_sent" value="1" />
 211                              <input type="hidden" name="redirect_url" value="<?php echo $redirect_url ?>" />
 212                              <label class="conl"><strong><?php echo $lang_common['Username'] ?></strong><br /><input type="text" name="req_username" size="25" maxlength="25" tabindex="1" /><br /></label>
 213                              <label class="conl"><strong><?php echo $lang_common['Password'] ?></strong><br /><input type="password" name="req_password" size="16" maxlength="16" tabindex="2" /><br /></label>
 214                              <p class="clearb"><?php echo $lang_login['Login info'] ?></p>
 215                              <p><a href="register.php" tabindex="4"><?php echo $lang_login['Not registered'] ?></a>&nbsp;&nbsp;
 216                              <a href="login.php?action=forget" tabindex="5"><?php echo $lang_login['Forgotten pass'] ?></a></p>
 217                          </div>
 218                  </fieldset>
 219              </div>
 220              <p><input type="submit" name="login" value="<?php echo $lang_common['Login'] ?>" tabindex="3" /></p>
 221          </form>
 222      </div>
 223  </div>
 224  <?php
 225  
 226  require  PUN_ROOT.'footer.php';