login.php

   1 <?php
   2 /*=====================================================================*\
   3 || ###################################################################
   4 || # Bugdar [#]version[#]
   5 || # Copyright 2002-[#]year[#] Blue Static
   6 || #
   7 || # This program is free software; you can redistribute it and/or modify
   8 || # it under the terms of the GNU General Public License as published by
   9 || # the Free Software Foundation; version [#]gpl[#] of the License.
  10 || #
  11 || # This program is distributed in the hope that it will be useful, but
  12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  14 || # more details.
  15 || #
  16 || # You should have received a copy of the GNU General Public License along
  17 || # with this program; if not, write to the Free Software Foundation, Inc.,
  18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19 || ###################################################################
  20 \*=====================================================================*/
  21
  22 $fetchtemplates = array(
  23         'login',
  24         'lostpassword',
  25         'passwordreset'
  26 );
  27
  28 define('SVN', '$Id$');
  29
  30 $focus['user'] = 'focus';
  31
  32 require_once('./global.php');
  33 require_once('./includes/api_user.php');
  34 require_once('./includes/class_api_error.php');
  35
  36 APIError(array(new API_Error_Handler($message), 'user_cumulative'));
  37
  38 // ###################################################################
  39
  40 if ($bugsys->userinfo['userid'] AND $_REQUEST['do'] != 'logout' AND $_POST['do'] != 'cplogin' AND $_REQUEST['do'] != 'cplogout')
  41 {
  42         $message->error(_('You are already logged in.'));
  43 }
  44
  45 // ###################################################################
  46
  47 if (empty($_REQUEST['do']))
  48 {
  49         eval('$template->flush("' . $template->fetch('login') . '");');
  50 }
  51
  52 // ###################################################################
  53
  54 if ($_POST['do'] == 'login' OR $_POST['do'] == 'cplogin')
  55 {
  56         $keeplogin = $bugsys->input_clean('rememberme', TYPE_BOOL);
  57         if ($_POST['cplogin'])
  58         {
  59                 $keeplogin = 0;
  60         }
  61
  62         if ($_SERVER['HTTP_REFERER'] AND !$_POST['goindex'])
  63         {
  64                 $url = $_SERVER['HTTP_REFERER'];
  65         }
  66         else
  67         {
  68                 $url = 'index.php';
  69         }
  70
  71         if ($auth->authenticateLogin($bugsys->in['email'], $bugsys->in['password'], $keeplogin))
  72         {
  73                 if ($_POST['do'] == 'cplogin')
  74                 {
  75                         $hash = $funct->rand(90);
  76                         $db->query("DELETE FROM " . TABLE_PREFIX . "adminsession WHERE dateline < " . (TIMENOW - 3600));
  77                         $db->query("INSERT INTO " . TABLE_PREFIX . "adminsession (sessionid, userid, dateline) VALUES ('$hash', $userinfo[userid], " . TIMENOW . ")");
  78                         $funct->cookie(COOKIE_PREFIX . 'adminsession', $hash, false);
  79                 }
  80                 $message->redirect(_('Welcome back! You are now logged in.'), $url);
  81         }
  82         else
  83         {
  84                 $message->error(_('Invalid email or password.'));
  85         }
  86 }
  87
  88 // ###################################################################
  89
  90 if ($_REQUEST['do'] == 'logout')
  91 {
  92         if ($bugsys->userinfo['userid'])
  93         {
  94                 $db->query("DELETE FROM " . TABLE_PREFIX . "adminsession WHERE sessionid = '" . $bugsys->input_escape(COOKIE_PREFIX . 'adminsession') . "'");
  95                 $funct->cookie(COOKIE_PREFIX . 'userid');
  96                 $funct->cookie(COOKIE_PREFIX . 'authkey');
  97                 $funct->cookie(COOKIE_PREFIX . 'adminsession');
  98                 $message->redirect(_('You have been logged out.'), ($_SERVER['HTTP_REFERER'] ? $_SERVER['HTTP_REFERER'] : 'index.php'));
  99         }
 100         else
 101         {
 102                 $message->error(_('You need to be logged in to access this feature.'));
 103         }
 104 }
 105
 106 // ###################################################################
 107
 108 if ($_POST['do'] == 'sendpw')
 109 {
 110         $user = new UserAPI($bugsys);
 111         $user->set('email', $bugsys->in['email'], true, false); // don't verify so we don't get errors about existing emails
 112         $user->set_condition(array('email'));
 113         $user->fetch();
 114
 115         if ($message->items)
 116         {
 117                 $show['lostpwerror'] = true;
 118                 $_REQUEST['do'] = 'lostpw';
 119         }
 120         else
 121         {
 122                 $activator = $funct->rand(25);
 123                 $db->query("INSERT INTO " . TABLE_PREFIX . "passwordreset (activatorid, dateline, userid) VALUES ('" . $activator . "', " . TIMENOW . ", " . $user->objdata['userid'] . ")");
 124
 125                 eval('$email = "' . $template->fetch('email/passwordreset.xml') . '";');
 126                 $email = $bugsys->xml->parse($email);
 127
 128                 $mail->setSubject($email['email']['subject']['value']);
 129                 $mail->setBodyText($email['email']['bodyText']['value']);
 130
 131                 $mail->send($user->objdata['email'], $user->objdata['displayname']);
 132
 133                 $message->message(sprintf(_('An email has been dispatched to %1$s that contains instructions on how to reset your password.'), $user->objdata['email']));
 134         }
 135 }
 136
 137 // ###################################################################
 138
 139 if ($_REQUEST['do'] == 'lostpw')
 140 {
 141         eval('$template->flush("' . $template->fetch('lostpassword') . '");');
 142 }
 143
 144 // ###################################################################
 145
 146 if ($_POST['do'] == 'resetpw')
 147 {
 148         // remove old activators
 149         $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE dateline < " . (TIMENOW - 86400));
 150
 151         // now look for ours
 152         $activation = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "passwordreset WHERE activatorid = '" . $bugsys->input_escape('activator') . "'");
 153         if (!$activation)
 154         {
 155                 $message->error(L_INVALID_ID);
 156         }
 157
 158         $user = new UserAPI($bugsys);
 159         $user->set('userid', $activation['userid']);
 160         $user->set_condition();
 161
 162         if ($bugsys->in['fix_password'] != $bugsys->in['confirm_password'])
 163         {
 164                 $message->addError(_('The passwords you entered do not patch.'));
 165         }
 166         if (empty($bugsys->in['fix_password']))
 167         {
 168                 $message->addError(_('Your new password cannot be empty.'));
 169         }
 170
 171         $user->set('password', $bugsys->in['fix_password']);
 172
 173         if (!$message->hasErrors())
 174         {
 175                 // remove old other activators for this user
 176                 $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE userid = " . $activation['userid']);
 177
 178                 $user->update();
 179                 $message->redirect(_('Your password has been changed successfully. You will now be redirected to the login page.'), 'login.php');
 180         }
 181         else
 182         {
 183                 $show['errors'] = true;
 184                 $_REQUEST['do'] = 'recoverpw';
 185         }
 186 }
 187
 188 // ###################################################################
 189
 190 if ($_REQUEST['do'] == 'recoverpw')
 191 {
 192         // remove old activators
 193         $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE dateline < " . (TIMENOW - 86400));
 194
 195         // now look for ours
 196         $activation = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "passwordreset WHERE activatorid = '" . $bugsys->input_escape('activator') . "'");
 197         if (!$activation)
 198         {
 199                 $message->error(_('Invalid activation reset key. Please make sure you copied the URL exactly as it appeared in the email.'));
 200         }
 201
 202         eval('$template->flush("' . $template->fetch('passwordreset') . '");');
 203 }
 204
 205 // ###################################################################
 206
 207 if ($_REQUEST['do'] == 'cplogout')
 208 {
 209         if ($_COOKIE[COOKIE_PREFIX . 'adminsession'])
 210         {
 211                 $db->query("DELETE FROM " . TABLE_PREFIX . "adminsession WHERE sessionid = '" . $bugsys->input_escape(COOKIE_PREFIX . 'adminsession') . "'");
 212                 $funct->cookie(COOKIE_PREFIX . 'adminsession');
 213                 $message->redirect(_('You have been logged out.'), 'admin/');
 214         }
 215         else
 216         {
 217                 $message->error(_('You are not logged in.'));
 218         }
 219 }
 220
 221 /*=====================================================================*\
 222 || ###################################################################
 223 || # $HeadURL$
 224 || # $Id$
 225 || ###################################################################
 226 \*=====================================================================*/
 227 ?>