$this->show_form();
}
}
-
+
function check_login() {
# XXX: form token in $_SESSION to prevent XSS
# XXX: login throttle
$nickname = $this->arg('nickname');
$password = $this->arg('password');
- if (common_check_user($nickname, $password)) {
- # success!
- if (!common_set_user($nickname)) {
- common_server_error(_t('Error setting user.'));
- return;
- }
- common_real_login(true);
- if ($this->boolean('rememberme')) {
- common_rememberme();
- }
- # success!
- $url = common_get_returnto();
- if ($url) {
- # We don't have to return to it again
- common_set_returnto(NULL);
- } else {
- $url = common_local_url('all',
- array('nickname' =>
- $nickname));
- }
- common_redirect($url);
- } else {
+ $user = common_check_user($nickname, $password);
+
+ if (!$user) {
$this->show_form(_t('Incorrect username or password.'));
+ return;
+ }
+
+ # success!
+ if (!common_set_user($user)) {
+ common_server_error(_t('Error setting user.'));
+ return;
+ }
+
+ common_real_login(true);
+
+ if ($this->boolean('rememberme')) {
+ common_debug('Adding rememberme cookie for ' . $nickname);
+ common_rememberme($user);
}
+ # success!
+ $url = common_get_returnto();
+ if ($url) {
+ # We don't have to return to it again
+ common_set_returnto(NULL);
+ } else {
+ $url = common_local_url('all',
+ array('nickname' =>
+ $nickname));
+ }
+ common_redirect($url);
}
function show_form($error=NULL) {
common_show_header(_t('Login'), NULL, $error, array($this, 'show_top'));
- common_element_start('form', array('method' => 'POST',
+ common_element_start('form', array('method' => 'post',
'id' => 'login',
'action' => common_local_url('login')));
common_input('nickname', _t('Nickname'));
}
function get_instructions() {
- return _t('Login with your username and password. ' .
- 'Don\'t have a username yet? ' .
- '[Register](%%action.register%%) a new account, or ' .
- 'try [OpenID](%%action.openidlogin%%). ');
+ if (common_logged_in() &&
+ !common_is_real_login() &&
+ common_get_returnto())
+ {
+ # rememberme logins have to reauthenticate before
+ # changing any profile settings (cookie-stealing protection)
+ return _t('For security reasons, ' .
+ 'please re-enter your ' .
+ 'user name and password ' .
+ 'before changing your settings. ');
+ } else {
+ return _t('Login with your username and password. ' .
+ 'Don\'t have a username yet? ' .
+ '[Register](%%action.register%%) a new account, or ' .
+ 'try [OpenID](%%action.openidlogin%%). ');
+ }
}
function show_top($error=NULL) {
} else {
$instr = $this->get_instructions();
$output = common_markup_to_html($instr);
- common_element_start('p', 'instructions');
+ common_element_start('div', 'instructions');
common_raw($output);
common_element_end('p');
}
}
}
+#
\ No newline at end of file