X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=include%2Fauth.php;h=1341f3bb8a7af7a26069ce7cabfc942f01f90195;hb=741a5dba578444e5fea547a87c48824a69c39840;hp=1f16b350479a9074da639249f35cb336eee229bc;hpb=5792b3d3580b9f09460305858293398d8d8a9abf;p=friendica.git diff --git a/include/auth.php b/include/auth.php index 1f16b35047..1341f3bb8a 100644 --- a/include/auth.php +++ b/include/auth.php @@ -1,6 +1,8 @@ module === 'logout')) { // process logout request - + call_hooks("logging_out"); nuke_session(); info( t('Logged out.') . EOL); goaway(z_root()); @@ -58,41 +60,7 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p goaway(z_root()); } - // initialise user environment - - $a->user = $r[0]; - $_SESSION['theme'] = $a->user['theme']; - $_SESSION['page_flags'] = $a->user['page-flags']; - - $member_since = strtotime($a->user['register_date']); - if(time() < ($member_since + ( 60 * 60 * 24 * 14))) - $_SESSION['new_member'] = true; - else - $_SESSION['new_member'] = false; - - if(strlen($a->user['timezone'])) { - date_default_timezone_set($a->user['timezone']); - $a->timezone = $a->user['timezone']; - } - - $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $a->user['nickname']; - - $r = q("SELECT `uid`,`username` FROM `user` WHERE `password` = '%s' AND `email` = '%s'", - dbesc($a->user['password']), - dbesc($a->user['email']) - ); - if(count($r)) - $a->identities = $r; - - $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1", - intval($_SESSION['uid'])); - if(count($r)) { - $a->contact = $r[0]; - $a->cid = $r[0]['id']; - $_SESSION['cid'] = $a->cid; - - } - header('X-Account-Management-Status: active; name="' . $a->user['username'] . '"; id="' . $a->user['nickname'] .'"'); + authenticate_success($r[0]); } } else { @@ -104,11 +72,12 @@ else { if((x($_POST,'password')) && strlen($_POST['password'])) $encrypted = hash('whirlpool',trim($_POST['password'])); else { - if((x($_POST,'openid_url')) && strlen($_POST['openid_url'])) { + if((x($_POST,'openid_url')) && strlen($_POST['openid_url']) || + (x($_POST,'username')) && strlen($_POST['username'])) { $noid = get_config('system','no_openid'); - $openid_url = trim($_POST['openid_url']); + $openid_url = trim((strlen($_POST['openid_url'])?$_POST['openid_url']:$_POST['username']) ); // validate_url alters the calling parameter @@ -125,43 +94,27 @@ else { // Otherwise it's probably an openid. + try { require_once('library/openid.php'); $openid = new LightOpenID; $openid->identity = $openid_url; $_SESSION['openid'] = $openid_url; $a = get_app(); - $openid->returnUrl = $a->get_baseurl() . '/openid'; - - $r = q("SELECT `uid` FROM `user` WHERE `openid` = '%s' LIMIT 1", - dbesc($openid_url) - ); - if(count($r)) { - // existing account - goaway($openid->authUrl()); - // NOTREACHED - } - else { - if($a->config['register_policy'] == REGISTER_CLOSED) { - $a = get_app(); - notice( t('Login failed.') . EOL); - goaway(z_root()); - // NOTREACHED - } - // new account - $_SESSION['register'] = 1; - $openid->required = array('namePerson/friendly', 'contact/email', 'namePerson'); - $openid->optional = array('namePerson/first','media/image/aspect11','media/image/default'); - goaway($openid->authUrl()); - // NOTREACHED - } + $openid->returnUrl = $a->get_baseurl(true) . '/openid'; + goaway($openid->authUrl()); + } catch (Exception $e) { + notice( t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.').'

'. t('The error message was:').' '.$e->getMessage()); + } + // NOTREACHED } } + if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') { $record = null; $addon_auth = array( - 'username' => trim($_POST['openid_url']), + 'username' => trim($_POST['username']), 'password' => trim($_POST['password']), 'authenticated' => 0, 'user_record' => null @@ -187,8 +140,8 @@ else { $r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey` FROM `user` WHERE ( `email` = '%s' OR `nickname` = '%s' ) AND `password` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `verified` = 1 LIMIT 1", - dbesc(trim($_POST['openid_url'])), - dbesc(trim($_POST['openid_url'])), + dbesc(trim($_POST['username'])), + dbesc(trim($_POST['username'])), dbesc($encrypted) ); if(count($r)) @@ -196,70 +149,14 @@ else { } if((! $record) || (! count($record))) { - logger('authenticate: failed login attempt: ' . trim($_POST['openid_url'])); + logger('authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR']); notice( t('Login failed.') . EOL ); goaway(z_root()); } - $_SESSION['uid'] = $record['uid']; - $_SESSION['theme'] = $record['theme']; - $_SESSION['authenticated'] = 1; - $_SESSION['page_flags'] = $record['page-flags']; - $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $record['nickname']; - $_SESSION['addr'] = $_SERVER['REMOTE_ADDR']; - - $a->user = $record; - - if($a->user['login_date'] === '0000-00-00 00:00:00') { - $_SESSION['return_url'] = 'profile_photo/new'; - $a->module = 'profile_photo'; - info( t("Welcome ") . $a->user['username'] . EOL); - info( t('Please upload a profile photo.') . EOL); - } - else - info( t("Welcome back ") . $a->user['username'] . EOL); - - - $member_since = strtotime($a->user['register_date']); - if(time() < ($member_since + ( 60 * 60 * 24 * 14))) - $_SESSION['new_member'] = true; - else - $_SESSION['new_member'] = false; - - if(strlen($a->user['timezone'])) { - date_default_timezone_set($a->user['timezone']); - $a->timezone = $a->user['timezone']; - } - - $r = q("SELECT `uid`,`username` FROM `user` WHERE `password` = '%s' AND `email` = '%s'", - dbesc($a->user['password']), - dbesc($a->user['email']) - ); - if(count($r)) - $a->identities = $r; - - - $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1", - intval($_SESSION['uid'])); - if(count($r)) { - $a->contact = $r[0]; - $a->cid = $r[0]['id']; - $_SESSION['cid'] = $a->cid; - } - - $l = get_language(); - - q("UPDATE `user` SET `login_date` = '%s', `language` = '%s' WHERE `uid` = %d LIMIT 1", - dbesc(datetime_convert()), - dbesc($l), - intval($_SESSION['uid']) - ); - - call_hooks('logged_in', $a->user); + // if we haven't failed up this point, log them in. - header('X-Account-Management-Status: active; name="' . $a->user['username'] . '"; id="' . $a->user['nickname'] .'"'); - if(($a->module !== 'home') && isset($_SESSION['return_url'])) - goaway($a->get_baseurl() . '/' . $_SESSION['return_url']); + authenticate_success($record, true, true); } }