Working register and login forms and functions and corresponding extr…

…a functions
hcuk94 · Sep 21, 2012 · 080863c · 080863c
1 parent 282354e
commit 080863c
Show file tree

Hide file tree

Showing 7 changed files with 137 additions and 17 deletions.
diff --git a/admin/login.php b/admin/login.php
@@ -9,6 +9,9 @@
 require_once("../includes/config.php");
 require_once("../includes/functions.php");
 db_connect();
+if (is_login()) {
+	header('Location: '.get_phurl_option('site_url').'/admin/');
+}
 
 //require_once("header.php");
 $WORKING_DIR = '../';
@@ -22,7 +25,39 @@
 ?>
 <?php
 if (isset($_POST['form']) && $_POST['form'] == "login") {
-
+	// Remove some unwanted characters
+	$uname = mysql_real_escape_string(trim($_POST['uname']));
+	$password = mysql_real_escape_string(trim($_POST['password']));
+
+	if (
+	(!isset($uname) || $uname == "") || 
+	(!isset($password) || $password == "")) {
+		if (!isset($uname) || $uname == "") {
+			$_ERROR[] = "Please enter your username.<br />";
+		} 
+		if (!isset($password) || $password == "") {
+			$_ERROR[] = "Please enter your password.<br />";
+		}
+	} else {
+		$password = hashPassword($password);
+		$db_result = mysql_query("SELECT id,uname,email FROM ".DB_PREFIX."users WHERE `uname`='".$uname."' AND `password`='".$password."';");
+		if ($db_result != false && mysql_num_rows($db_result) == 1) {
+			$db_row = mysql_fetch_assoc($db_result);
+			$dbId = $db_row['id'];
+			$dbUname = $db_row['uname'];
+			$dbEmail = $db_row['email'];
+			$_ERROR[] = "Login complete";
+			$session = hash('sha256', hash('sha256', time().SALT3.$dbId.hash('sha1',uniqid().hash('sha1', $password))).$dbUname.SALT4.$dbEmail.time());
+			echo $session;
+			$_SESSION[base64_encode('user')] = $session;
+			$ipAddr = $_SERVER['REMOTE_ADDR'];
+			clean_old_sessions();
+			mysql_query("INSERT INTO ".DB_PREFIX."session (session, uId, ip, time) VALUES ('".$session."', '".$dbId."', '".$ipAddr."', '".time()."')") or die(mysql_error());
+		} else {
+			$_ERROR[] = "There was an error with your username/password.<br />";
+		}
+	}
+
 } elseif (isset($_POST['form']) && $_POST['form'] == "register") {
 
 	// Remove some unwanted characters
@@ -38,8 +73,13 @@
 	(!isset($email) || $email == "") || 
 	(!isset($fname) || $fname == "") || 
 	(!isset($lname) || $lname == "") || 
-	(!isset($password) || $password == "")) {
-		$_ERROR[] = "Please complete the whole form<br />";
+	(!isset($password) || $password == "") ||
+	(!filter_var($email, FILTER_VALIDATE_EMAIL))) {
+		if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+			$_ERROR[] = "Please enter a valid email.<br />";
+		} else {
+			$_ERROR[] = "Please complete the whole form.<br />";
+		}
 	} else {
 		//$_ERROR[]
 		// Check if the username or email is already know to us
@@ -56,7 +96,12 @@
 				}
 			}
 		} else {
-			$passwordNew = hash('sha256', hash('sha256', $password.).SITE_SALT);
+			$passwordNew = hashPassword($password);
+//			echo $password."-".$passwordNew."\n";
+			$db_result = mysql_query("INSERT INTO ".DB_PREFIX."users (uname, fname, lname, email, password) VALUES ('".$uname."', '".$fname."', '".$lname."', '".$email."', '".$passwordNew."')") or db_die(__FILE__, __LINE__, mysql_error());
+			$_ERROR[] = "Your account has been created, you can now login.";
+?>
+<?php
 		}
 	}
 } 
@@ -127,5 +172,4 @@
 } else {
         die ("<h2>Could not load theme</h2>");
 }
-//require_once("footer.php");
 ?>
diff --git a/admin/session.php b/admin/session.php
@@ -0,0 +1,11 @@
+<?php
+//$_SESSION[base64_encode('user')] = $session;
+include "../includes/config.php";
+include "../includes/functions.php";
+db_connect();
+//echo is_login();
+var_dump(is_login());
+//echo is_admin_login();
+var_dump(is_admin_login());
+//print_r($_SESSION);
+?>
diff --git a/includes/config.php b/includes/config.php
@@ -16,7 +16,10 @@
 
 // Do *NOT* mess with anything below
 define('URL_PROTOCOLS', 'http|https|ftp|ftps|mailto|news|mms|rtmp|rtmpt|e2dk');
-define('SITE_SALT', '');
+define('SALT1', '{7A(|/End@2#o%C#[,96IfM^U*35;!AH57/=37^*>+(K40Gfh2D2:Z1,u|9~z9L9');
+define('SALT2', 'IF9E%/<~2,F(h&K{2@=Y)V01u.U$/D.?;SF>dl=-9>%|$He22d(3aLP24^1*d)bI');
+define('SALT3', '2lMw?r1Vfk9.w(mH%mJdYN}FpH^e@+O2}+*eU$9!&DY09~&CP)=7Uy1##a+*t8<T');
+define('SALT4', 'i$m?r{U6OENyY.7@}.CXJ[Q?).*{.qOnVv~1{H~g[(F&?$|E<}S-[0@3X-<2Ir@');
 error_reporting(E_ALL);
 $_ERROR = array();
 

diff --git a/includes/functions.php b/includes/functions.php
@@ -1,4 +1,5 @@
 <?php
+session_start();
 $mysql = array();
 
 function db_die($filename, $line, $message) {
@@ -147,13 +148,65 @@ function print_errors() {
         echo "</span>\n";
     }
 }
+function hashPassword ($password) {
+	$password = hash('sha256', hash('sha256', SALT2.$password.hash('sha1',SALT1.$password)).SALT3);
+	return $password;
+}
 function is_admin_login() {
-    if (@$_SESSION['admin'] == 1) {
-        return true;
-    }
-
-    return false;
-    }
+	global $_USER;
+	if ($_USER['type'] == 'a' && is_login()) {
+		return true;
+	} else {
+		return false;
+	}
+}
+function require_admin() {
+	if (is_admin_login() == false) {
+		if (!is_login()) {
+			header("Location: ".get_phurl_option("site_url")."/admin/login.php");
+		} else {
+			header("Location: ".get_phurl_option("site_url")."/admin/");
+		}
+		exit();
+	} else {
+		return true;
+	}
+}
 function is_login() {
-return false;
+	if (isset($_SESSION[base64_encode('user')])) {
+		$session = $_SESSION[base64_encode('user')];
+		$session = mysql_real_escape_string(trim($session));
+		clean_old_sessions();
+		$db_result = mysql_query("SELECT uId,ip,time FROM ".DB_PREFIX."session WHERE session='".$session."'");
+		if (mysql_num_rows($db_result) != 1) {
+			// User's session has expired.
+			return false;
+		} else {
+			$db_row = mysql_fetch_assoc($db_result);
+			$db_result = mysql_query("SELECT * FROM ".DB_PREFIX."users WHERE id='".$db_row['uId']."'");
+			$db_row = mysql_fetch_assoc($db_result);
+			global $_USER;
+			$_USER = array();
+			$_USER['id'] = $db_row['id'];
+			$_USER['uname'] = $db_row['uname'];
+			$_USER['fname'] = $db_row['fname'];
+			$_USER['lname'] = $db_row['lname'];
+			$_USER['type'] = $db_row['type'];
+			return true;
+		}
+	} else {
+		// No client side session
+		return false;
+	}
+}
+function require_login() {
+	if (is_login() == false) {
+		header("Location: ".get_phurl_option("site_url")."/admin/login.php");
+		exit();
+	} else {
+		return true;
+	}
+}
+function clean_old_sessions() {
+	$db_results = mysql_query("DELETE FROM ".DB_PREFIX."session WHERE time<='".strtotime("-2 weeks")."'");
 }
diff --git a/includes/saltgen.php b/includes/saltgen.php
@@ -1,5 +1,7 @@
 <?php
-echo generate_salt(32)."\n";
+echo generate_salt(64)."\n";
+echo generate_salt(64)."\n";
+echo generate_salt(64)."\n";
 
 function generate_salt($len) {
 	$salt = "";

diff --git a/includes/themes/default/header.php b/includes/themes/default/header.php
@@ -97,9 +97,16 @@ function showPage() {
  	<div id="menu">
  		<ul>
  			<li><a href="/">Home</a></li>
-<li><a href="/api/create.php?url=http://example.org/">API</a></li>
+<?php //<li><a href="/api/create.php?url=http://example.org/">API</a></li> ?>
 	<?php if (is_login()) { ?>
- 			<li><a href="/admin/">Panel</a></li>
+ 			<li><a href="/admin/">My URLs</a></li>
+ 			<li><a href="/admin/">My Account</a></li>
+ 			<li><a href="/admin/">Developer</a></li>
+ 			<li><a href="/admin/">Site URLs</a></li>
+	<?php if (is_admin_login()) { ?>
+ 			<li><a href="/admin/">Site Administration</a></li>
+	<?php } ?>
+ 			<li><a href="/admin/logout.php">Logout</a></li>
 	<?php } else { ?>
  			<li><a href="/admin/login.php">Login/Signup</a></li>
 	<?php } ?>

diff --git a/phurl3db.sql b/phurl3db.sql
@@ -50,6 +50,6 @@ CREATE TABLE IF NOT EXISTS `phurl_users` (
   `fname` varchar(45) NOT NULL,
   `lname` varchar(45) NOT NULL,
   `email` varchar(45) NOT NULL,
-  `password` varchar(32) NOT NULL,
+  `password` varchar(64) NOT NULL,
   PRIMARY KEY (`id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;