// login/logout
-if((x($_SESSION,'authenticated')) && (! ($_POST['auth-params'] === 'login'))) {
+if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
- if($_POST['auth-params'] === 'logout' || $a->module === 'logout') {
+ if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
// process logout request
unset($_SESSION['administrator']);
unset($_SESSION['cid']);
unset($_SESSION['theme']);
+ unset($_SESSION['page_flags']);
notice( t('Logged out.') . EOL);
goaway($a->get_baseurl());
}
$a->user = $r[0];
$_SESSION['theme'] = $a->user['theme'];
+ $_SESSION['page_flags'] = $a->user['page-flags'];
if(strlen($a->user['timezone']))
date_default_timezone_set($a->user['timezone']);
$_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $a->user['nickname'];
- $r = q("SELECT * FROM `contact` WHERE `uid` = %s AND `self` = 1 LIMIT 1",
+ $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1",
intval($_SESSION['uid']));
if(count($r)) {
$a->contact = $r[0];
}
else {
- unset($_SESSION['authenticated']);
- unset($_SESSION['uid']);
- unset($_SESSION['visitor_id']);
- unset($_SESSION['administrator']);
- unset($_SESSION['cid']);
- unset($_SESSION['theme']);
- unset($_SESSION['my_url']);
+ if(isset($_SESSION)) {
+ unset($_SESSION['authenticated']);
+ unset($_SESSION['uid']);
+ unset($_SESSION['visitor_id']);
+ unset($_SESSION['administrator']);
+ unset($_SESSION['cid']);
+ unset($_SESSION['theme']);
+ unset($_SESSION['my_url']);
+ unset($_SESSION['page_flags']);
+ }
- $encrypted = hash('whirlpool',trim($_POST['password']));
+ if(x($_POST,'password'))
+ $encrypted = hash('whirlpool',trim($_POST['password']));
if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') {
// process login request
$r = q("SELECT * FROM `user`
- WHERE `email` = '%s' AND `password` = '%s' AND `blocked` = 0 AND `verified` = 1 LIMIT 1",
+ WHERE ( `email` = '%s' OR `nickname` = '%s' ) AND `password` = '%s' AND `blocked` = 0 AND `verified` = 1 LIMIT 1",
+ dbesc(trim($_POST['login-name'])),
dbesc(trim($_POST['login-name'])),
dbesc($encrypted));
if(($r === false) || (! count($r))) {
$_SESSION['uid'] = $r[0]['uid'];
$_SESSION['theme'] = $r[0]['theme'];
$_SESSION['authenticated'] = 1;
+ $_SESSION['page_flags'] = $r[0]['page-flags'];
$_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $r[0]['nickname'];
notice( t("Welcome back ") . $r[0]['username'] . EOL);
$r = q("SELECT * FROM `contact` WHERE `uid` = %s AND `self` = 1 LIMIT 1",
intval($_SESSION['uid']));
if(count($r)) {
+ $a->contact = $r[0];
$a->cid = $r[0]['id'];
$_SESSION['cid'] = $a->cid;
}