login.php

   1 <?php
   2 /*=====================================================================*\
   3 || ###################################################################
   4 || # Bugdar [#]version[#]
   5 || # Copyright 2002-[#]year[#] Blue Static
   6 || #
   7 || # This program is free software; you can redistribute it and/or modify
   8 || # it under the terms of the GNU General Public License as published by
   9 || # the Free Software Foundation; version [#]gpl[#] of the License.
  10 || #
  11 || # This program is distributed in the hope that it will be useful, but
  12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  14 || # more details.
  15 || #
  16 || # You should have received a copy of the GNU General Public License along
  17 || # with this program; if not, write to the Free Software Foundation, Inc.,
  18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19 || ###################################################################
  20 \*=====================================================================*/
  21
  22 $fetchtemplates = array(
  23         'login',
  24         'lostpassword',
  25         'passwordreset'
  26 );
  27
  28 define('SVN', '$Id$');
  29
  30 $focus['user'] = 'focus';
  31
  32 require_once('./global.php');
  33 require_once('./includes/api_user.php');
  34 require_once('./includes/class_api_error.php');
  35
  36 APIError(array(new API_Error_Handler($message), 'user_cumulative'));
  37
  38 // ###################################################################
  39
  40 if ($bugsys->userinfo['userid'] AND $_REQUEST['do'] != 'logout' AND $_POST['do'] != 'cplogin' AND $_REQUEST['do'] != 'cplogout')
  41 {
  42         $message->error(_('You are already logged in.'));
  43 }
  44
  45 // ###################################################################
  46
  47 if (empty($_REQUEST['do']))
  48 {
  49         eval('$template->flush("' . $template->fetch('login') . '");');
  50 }
  51
  52 // ###################################################################
  53
  54 if ($_POST['do'] == 'login' OR $_POST['do'] == 'cplogin')
  55 {
  56         $keeplogin = $bugsys->input_clean('rememberme', TYPE_BOOL);
  57         if ($_POST['cplogin'])
  58         {
  59                 $keeplogin = 0;
  60         }
  61
  62         if ($_SERVER['HTTP_REFERER'] AND !$_POST['goindex'])
  63         {
  64                 $url = $_SERVER['HTTP_REFERER'];
  65         }
  66         else
  67         {
  68                 $url = 'index.php';
  69         }
  70
  71         $userinfo = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "user WHERE email = '" . $bugsys->input_escape('email') . "'");
  72         if (md5(md5($bugsys->in['password']) . md5($userinfo['salt'])) == $userinfo['password'])
  73         {
  74                 if (!$bugsys->userinfo['userid'])
  75                 {
  76                         $funct->cookie(COOKIE_PREFIX . 'userid', $userinfo['userid'], $keeplogin);
  77                         $funct->cookie(COOKIE_PREFIX . 'authkey', $userinfo['authkey'], $keeplogin);
  78                 }
  79
  80                 if ($_POST['do'] == 'cplogin')
  81                 {
  82                         $funct->cookie(COOKIE_PREFIX . 'adminsession', md5(md5($userinfo['authkey']) . md5(gmdate('F j, Y @ H'))), false);
  83                 }
  84         }
  85         else
  86         {
  87                 if (!$bugsys->userinfo['userid'])
  88                 {
  89                         $funct->cookie(COOKIE_PREFIX . 'userid');
  90                         $funct->cookie(COOKIE_PREFIX . 'authkey');
  91                 }
  92
  93                 $message->error(_('Invalid email or password.'));
  94         }
  95
  96         $message->redirect(_('Welcome back! You are now logged in.'), $url);
  97 }
  98
  99 // ###################################################################
 100
 101 if ($_REQUEST['do'] == 'logout')
 102 {
 103         if ($bugsys->userinfo['userid'])
 104         {
 105                 $funct->cookie(COOKIE_PREFIX . 'userid');
 106                 $funct->cookie(COOKIE_PREFIX . 'authkey');
 107                 $funct->cookie(COOKIE_PREFIX . 'adminsession');
 108                 $message->redirect(_('You have been logged out.'), ($_SERVER['HTTP_REFERER'] ? $_SERVER['HTTP_REFERER'] : 'index.php'));
 109         }
 110         else
 111         {
 112                 $message->error(_('You need to be logged in to access this feature.'));
 113         }
 114 }
 115
 116 // ###################################################################
 117
 118 if ($_POST['do'] == 'sendpw')
 119 {
 120         $user = new UserAPI($bugsys);
 121         $user->set('email', $bugsys->in['email'], true, false); // don't verify so we don't get errors about existing emails
 122         $user->set_condition(array('email'));
 123         $user->fetch();
 124
 125         if ($message->items)
 126         {
 127                 $show['lostpwerror'] = true;
 128                 $_REQUEST['do'] = 'lostpw';
 129         }
 130         else
 131         {
 132                 $activator = $funct->rand(25);
 133                 $db->query("INSERT INTO " . TABLE_PREFIX . "passwordreset (activatorid, dateline, userid) VALUES ('" . $activator . "', " . TIMENOW . ", " . $user->objdata['userid'] . ")");
 134
 135                 $mail->setSubject(sprintf(_('%1$s Password Reset'), $bugsys->options['trackertitle']));
 136                 $mail->setBodyText(sprintf(_('Hi %1$s,
 137
 138 You requested this lost password email at the %2$s bug tracker. To reset your password, simply click the link below (or paste it into your browser window exactly) and enter a new password.
 139
 140 %3$s/login.php?do=recoverpw&activator=%4$s
 141
 142 If you did not request this, do not worry as this notice will expire in 24 hours.'),
 143
 144                                                                 $user->objdata['displayname'],
 145                                                                 $bugsys->options['trackertitle'],
 146                                                                 $bugsys->options['trackerurl'],
 147                                                                 $activator
 148                 ));
 149
 150                 $mail->send($user->objdata['email'], $user->objdata['displayname']);
 151
 152                 $message->message(sprintf(_('An email has been dispatched to %1$s that contains instructions on how to reset your password.'), $user->objdata['email']));
 153         }
 154 }
 155
 156 // ###################################################################
 157
 158 if ($_REQUEST['do'] == 'lostpw')
 159 {
 160         eval('$template->flush("' . $template->fetch('lostpassword') . '");');
 161 }
 162
 163 // ###################################################################
 164
 165 if ($_POST['do'] == 'resetpw')
 166 {
 167         // remove old activators
 168         $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE dateline < " . (TIMENOW - 86400));
 169
 170         // now look for ours
 171         $activation = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "passwordreset WHERE activatorid = '" . $bugsys->input_escape('activator') . "'");
 172         if (!$activation)
 173         {
 174                 $message->error(L_INVALID_ID);
 175         }
 176
 177         $user = new UserAPI($bugsys);
 178         $user->set('userid', $activation['userid']);
 179         $user->set_condition();
 180
 181         if ($bugsys->in['fix_password'] != $bugsys->in['confirm_password'])
 182         {
 183                 $message->add_error(_('The passwords you entered do not patch.'));
 184         }
 185         if (empty($bugsys->in['fix_password']))
 186         {
 187                 $message->add_error(_('Your new password cannot be empty.'));
 188         }
 189
 190         $user->set('password', $bugsys->in['fix_password']);
 191
 192         if (!$message->items)
 193         {
 194                 // remove old other activators for this user
 195                 $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE userid = " . $activation['userid']);
 196
 197                 $user->update();
 198                 $message->redirect(_('Your password has been changed successfully. You will now be redirected to the login page.'), 'login.php');
 199         }
 200         else
 201         {
 202                 $show['errors'] = true;
 203                 $_REQUEST['do'] = 'recoverpw';
 204                 $message->error_list_process();
 205         }
 206 }
 207
 208 // ###################################################################
 209
 210 if ($_REQUEST['do'] == 'recoverpw')
 211 {
 212         // remove old activators
 213         $db->query("DELETE FROM " . TABLE_PREFIX . "passwordreset WHERE dateline < " . (TIMENOW - 86400));
 214
 215         // now look for ours
 216         $activation = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "passwordreset WHERE activatorid = '" . $bugsys->input_escape('activator') . "'");
 217         if (!$activation)
 218         {
 219                 $message->error(_('Invalid activation reset key. Please make sure you copied the URL exactly as it appeared in the email.'));
 220         }
 221
 222         eval('$template->flush("' . $template->fetch('passwordreset') . '");');
 223 }
 224
 225 // ###################################################################
 226
 227 if ($_REQUEST['do'] == 'cplogout')
 228 {
 229         if ($_COOKIE[COOKIE_PREFIX . 'adminsession'])
 230         {
 231                 $funct->cookie(COOKIE_PREFIX . 'adminsession');
 232                 $message->redirect(_('You have been logged out.'), 'admin/');
 233         }
 234         else
 235         {
 236                 $message->error(_('You are not logged in.'));
 237         }
 238 }
 239
 240 /*=====================================================================*\
 241 || ###################################################################
 242 || # $HeadURL$
 243 || # $Id$
 244 || ###################################################################
 245 \*=====================================================================*/
 246 ?>