$this->show_form();
}
}
-
+
function check_login() {
# XXX: form token in $_SESSION to prevent XSS
# XXX: login throttle
if (common_check_user($nickname, $password)) {
# success!
if (!common_set_user($nickname)) {
- common_server_error(_t('Error setting user.'));
+ common_server_error(_('Error setting user.'));
return;
}
common_real_login(true);
}
common_redirect($url);
} else {
- $this->show_form(_t('Incorrect username or password.'));
+ $this->show_form(_('Incorrect username or password.'));
+ return;
+ }
+
+ # success!
+ if (!common_set_user($user)) {
+ common_server_error(_('Error setting user.'));
+ return;
}
-
+
common_real_login(true);
-
+
if ($this->boolean('rememberme')) {
common_debug('Adding rememberme cookie for ' . $nickname);
common_rememberme($user);
}
function get_instructions() {
- return _t('Login with your username and password. ' .
- 'Don\'t have a username yet? ' .
- '[Register](%%action.register%%) a new account, or ' .
- 'try [OpenID](%%action.openidlogin%%). ');
+ if (common_logged_in() &&
+ !common_is_real_login() &&
+ common_get_returnto())
+ {
+ # rememberme logins have to reauthenticate before
+ # changing any profile settings (cookie-stealing protection)
+ return _('For security reasons, please re-enter your ' .
+ 'user name and password ' .
+ 'before changing your settings.');
+ } else {
+ return _('Login with your username and password. ' .
+ 'Don\'t have a username yet? ' .
+ '[Register](%%action.register%%) a new account, or ' .
+ 'try [OpenID](%%action.openidlogin%%). ');
+ }
}
function show_top($error=NULL) {
}
}
}
-#
\ No newline at end of file