source: trunk/identification.php @ 1004

Last change on this file since 1004 was 1004, checked in by nikrou, 18 years ago

Improve security of sessions:

  • use only cookies to store session id on client side
  • use default php session system with database handler to store sessions on server side
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 4.3 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | PhpWebGallery - a PHP based picture gallery                           |
4// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
5// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
6// +-----------------------------------------------------------------------+
7// | branch        : BSF (Best So Far)
8// | file          : $RCSfile$
9// | last update   : $Date: 2006-01-15 13:45:42 +0000 (Sun, 15 Jan 2006) $
10// | last modifier : $Author: nikrou $
11// | revision      : $Revision: 1004 $
12// +-----------------------------------------------------------------------+
13// | This program is free software; you can redistribute it and/or modify  |
14// | it under the terms of the GNU General Public License as published by  |
15// | the Free Software Foundation                                          |
16// |                                                                       |
17// | This program is distributed in the hope that it will be useful, but   |
18// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
19// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
20// | General Public License for more details.                              |
21// |                                                                       |
22// | You should have received a copy of the GNU General Public License     |
23// | along with this program; if not, write to the Free Software           |
24// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
25// | USA.                                                                  |
26// +-----------------------------------------------------------------------+
27
28//--------------------------------------------------------------------- include
29define('PHPWG_ROOT_PATH','./');
30include_once( PHPWG_ROOT_PATH.'include/common.inc.php' );
31
32//-------------------------------------------------------------- identification
33$errors = array();
34if (isset($_POST['login']))
35{
36  $username = mysql_escape_string($_POST['username']);
37  // retrieving the encrypted password of the login submitted
38  $query = '
39SELECT '.$conf['user_fields']['id'].' AS id,
40       '.$conf['user_fields']['password'].' AS password
41  FROM '.USERS_TABLE.'
42  WHERE '.$conf['user_fields']['username'].' = \''.$username.'\'
43;';
44  $row = mysql_fetch_array(pwg_query($query));
45  if ($row['password'] == $conf['pass_convert']($_POST['password']))
46  {
47    $session_length = $conf['session_length'];
48    if ($conf['authorize_remembering']
49        and isset($_POST['remember_me'])
50        and $_POST['remember_me'] == 1)
51    {
52      $session_length = $conf['remember_me_length'];
53    }
54    session_start();
55    $_SESSION['id'] = $row['id'];
56    redirect('category.php');
57  }
58  else
59  {
60    array_push( $errors, $lang['invalid_pwd'] );
61  }
62}
63//----------------------------------------------------- template initialization
64//
65// Start output of page
66//
67$title = $lang['identification'];
68$page['body_id'] = 'theIdentificationPage';
69include(PHPWG_ROOT_PATH.'include/page_header.php');
70
71$template->set_filenames( array('identification'=>'identification.tpl') );
72
73$template->assign_vars(
74  array(
75    'L_TITLE' => $lang['identification'],
76    'L_USERNAME' => $lang['login'],
77    'L_PASSWORD' => $lang['password'],
78    'L_LOGIN' => $lang['submit'],
79    'L_GUEST' => $lang['ident_guest_visit'],
80    'L_REGISTER' => $lang['ident_register'],
81    'L_FORGET' => $lang['ident_forgotten_password'],
82    'L_REMEMBER_ME'=>$lang['remember_me'],
83
84    'U_REGISTER' => PHPWG_ROOT_PATH.'register.php',
85    'U_LOST_PASSWORD' => PHPWG_ROOT_PATH.'password.php',
86    'U_HOME' => PHPWG_ROOT_PATH.'category.php',
87   
88    'F_LOGIN_ACTION' => PHPWG_ROOT_PATH.'identification.php'
89    ));
90
91if ($conf['authorize_remembering'])
92{
93  $template->assign_block_vars('remember_me',array());
94}
95//-------------------------------------------------------------- errors display
96if ( sizeof( $errors ) != 0 )
97{
98  $template->assign_block_vars('errors',array());
99  for ( $i = 0; $i < sizeof( $errors ); $i++ )
100  {
101    $template->assign_block_vars('errors.error',array('ERROR'=>$errors[$i]));
102  }
103}
104//-------------------------------------------------------------- visit as guest
105$template->assign_block_vars('free_access',array());
106//----------------------------------------------------------- html code display
107$template->parse('identification');
108include(PHPWG_ROOT_PATH.'include/page_tail.php');
109?>
Note: See TracBrowser for help on using the repository browser.