tim
00829a0c0d
Replace the short open tags and the removed functions (mcrypt, mysql_error, salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli exceptions, drop stripslashes(), and default missing input values. Fix the misplaced continue in prune_images().
112 lines
3.3 KiB
PHP
112 lines
3.3 KiB
PHP
<?php
|
|
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
|
|
|
|
$is_admin = FALSE;
|
|
|
|
if (isset($_SERVER['HTTPS'])) {
|
|
session_cache_limiter('private');
|
|
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
session_start();
|
|
|
|
if (isset($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} elseif (check_persistent_login()) {
|
|
// Note that check_persistent_login() sets $_SESSION['editor']
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
// Don't cache if $is_admin is set
|
|
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
|
|
header( 'Cache-Control: post-check=0, pre-check=0', false );
|
|
header( 'Pragma: no-cache' );
|
|
}
|
|
|
|
function check_persistent_login() {
|
|
if (!array_key_exists('PersistentAuth', $_COOKIE)) {
|
|
return false;
|
|
}
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
|
|
list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
|
|
$username = $db->real_escape_string($username);
|
|
$key = $db->real_escape_string($key);
|
|
|
|
$query = "SELECT * FROM $table WHERE ".
|
|
"username LIKE '".$username."' ".
|
|
"LIMIT 1;";
|
|
$getid = $db->query($query) or die("Query failed: ".$db->error);
|
|
$row = $getid->fetch_assoc();
|
|
open_db('close');
|
|
|
|
if (isset($row)) {
|
|
// Set up session, and delete old cookie, and create new persistent cookie
|
|
$stored_session = $row['session'];
|
|
if ($stored_session == $key) {
|
|
// login
|
|
$_SESSION['editor'] = $username;
|
|
// delete cookie
|
|
delete_persistent_login();
|
|
// create new cookie
|
|
create_persistent_login($username);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function create_persistent_login($username) {
|
|
$validity = strtotime('+1 year'); // Time to keep the session valid
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$username = $db->real_escape_string($username);
|
|
$key = bin2hex(random_bytes(100));
|
|
|
|
// Add session key to database
|
|
$query = "INSERT INTO $table " . "(username, session) VALUES ('" . $username."', '" . $key . "');";
|
|
$db->query($query) or die("Query failed: ".$db->error);
|
|
open_db('close');
|
|
|
|
// Create cookie with key
|
|
setcookie('PersistentAuth', "$username|$key", $validity, '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|
|
|
|
function delete_persistent_login() {
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth'] ?? '');
|
|
list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
|
|
$username = $db->real_escape_string($username);
|
|
$key = $db->real_escape_string($key);
|
|
|
|
// Add session key to database
|
|
$query = "DELETE FROM $table " .
|
|
" WHERE username LIKE '" . $username . "'" .
|
|
" AND session LIKE '" . $key . "';";
|
|
$db->query($query) or die("Query failed: ".$db->error);
|
|
|
|
// Reap old sessions
|
|
$query = "DELETE FROM $table " .
|
|
" WHERE created < DATE_SUB(now(), INTERVAL 1 YEAR);";
|
|
$db->query($query) or die("Query failed: ".$db->error);
|
|
|
|
open_db('close');
|
|
|
|
// Delete cookie
|
|
setcookie("PersistentAuth", false, strtotime('-1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|