Subversion Repositories Applications.papyrus

<?php

////////////////////////////////////////////////////////////////////////////////
//                                                                            //
//   Copyright (C) 2006  Phorum Development Team                              //
//   http://www.phorum.org                                                    //
//                                                                            //
//   This program is free software. You can redistribute it and/or modify     //
//   it under the terms of either the current Phorum License (viewable at     //
//   phorum.org) or the Phorum License that was distributed with this file    //
//                                                                            //
//   This program is distributed in the hope that it will be useful,          //
//   but WITHOUT ANY WARRANTY, without even the implied warranty of           //
//   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.                     //
//                                                                            //
//   You should have received a copy of the Phorum License                    //
//   along with this program.                                                 //
////////////////////////////////////////////////////////////////////////////////
define('phorum_page','login');

include_once( "./common.php" );
include_once( "./include/users.php" );
include_once( "./include/email_functions.php" );

// ----------------------------------------------------------------------------
// Handle logout
// ----------------------------------------------------------------------------

if ($PHORUM['DATA']['LOGGEDIN'] && !empty($PHORUM["args"]["logout"])) {

    // killing long-term cookie
    phorum_user_clear_session(PHORUM_SESSION_LONG_TERM);
    // killing short-term (write) cookie
    phorum_user_clear_session(PHORUM_SESSION_SHORT_TERM);

    // reset the sessid if not using cookies
    if(!$PHORUM['use_cookies']) {

        $new_sessid=md5($_POST['username'].microtime().$_POST['password']);

        $user=array(
        'user_id'=>$PHORUM['user']['user_id'],
        'sessid_st'=>$new_sessid
        );
        phorum_user_save_simple($user);
    }


    // Determine the URL to redirect the user to. The hook "after_logout"
    // can be used by module writers to set a custom redirect URL.
    if (isset($_SERVER["HTTP_REFERER"]) && !empty($_SERVER['HTTP_REFERER'])) {
        $url = $_SERVER["HTTP_REFERER"];
    } else {
        $url = phorum_get_url(PHORUM_LIST_URL);
    }

    // Strip the session id from the URL in case URI auth is in use.
    if (stristr($url, PHORUM_SESSION_LONG_TERM)){
        $url = str_replace(PHORUM_SESSION_LONG_TERM."=".urlencode($PHORUM["args"][PHORUM_SESSION_LONG_TERM]), "", $url);
    }

    $url = phorum_hook("after_logout", $url);

    phorum_redirect_by_url($url);
    exit();
}

// ----------------------------------------------------------------------------
// Handle login and password reminder
// ----------------------------------------------------------------------------

// Set all our URLs.
phorum_build_common_urls();

$template = "login";
$error = "";
$okmsg = "";
$username = "";

// Handle posted form data.
if (count($_POST) > 0) {

    // The user wants to retrieve a new password.
    if (isset($_POST["lostpass"])) {

        // Trim the email address.
        $_POST["lostpass"] = trim($_POST["lostpass"]);

        // Did the user enter an email address?
        if (empty($_POST["lostpass"])) {
            $error = $PHORUM["DATA"]["LANG"]["LostPassError"];
        }

        // Is the email address available in the database?
        elseif ($uid = phorum_user_check_email($_POST["lostpass"])) {

            // An existing user id was found for the entered email
            // address. Retrieve the user.
            $user = phorum_user_get($uid);

            $tmp_user=array();

            // User registration not yet approved by a moderator.
            if($user["active"] == PHORUM_USER_PENDING_MOD) {
                $template = "message";
                $PHORUM["DATA"]["MESSAGE"] = $PHORUM["DATA"]["LANG"]["RegVerifyMod"];
            // User registration still need email verification.
            } elseif ($user["active"] == PHORUM_USER_PENDING_EMAIL ||
                      $user["active"] == PHORUM_USER_PENDING_BOTH) {

                // Generate and store a new email confirmation code.
                $tmp_user["user_id"] = $uid;
                $tmp_user["password_temp"] = substr(md5(microtime()), 0, 8);
                phorum_user_save( $tmp_user );

                // Mail the new confirmation code to the user.
                $verify_url = phorum_get_url(PHORUM_REGISTER_URL, "approve=".$tmp_user["password_temp"]."$uid");
                $maildata["mailsubject"] = $PHORUM["DATA"]["LANG"]["VerifyRegEmailSubject"];
                $maildata["mailmessage"] =
                   wordwrap($PHORUM["DATA"]["LANG"]["VerifyRegEmailBody1"],72).
                   "\n\n$verify_url\n\n".
                   wordwrap($PHORUM["DATA"]["LANG"]["VerifyRegEmailBody2"],72);
                phorum_email_user(array($user["email"]), $maildata);

                $PHORUM["DATA"]["MESSAGE"] = $PHORUM["DATA"]["LANG"]["RegVerifyEmail"];
                $template="message";

            // The user is active.
            } else {

                // Generate and store a new password for the user.
                include_once( "./include/profile_functions.php" );
                $newpass = phorum_gen_password();
                $tmp_user["user_id"] = $uid;
                $tmp_user["password_temp"] = $newpass;
                phorum_user_save($tmp_user);

                // Mail the new password.
                $user = phorum_user_get( $uid );
                $maildata = array();
                $maildata['mailmessage'] =
                   wordwrap($PHORUM["DATA"]["LANG"]["LostPassEmailBody1"],72).
                   "\n\n".
                   $PHORUM["DATA"]["LANG"]["Username"] .": $user[username]\n".
                   $PHORUM["DATA"]["LANG"]["Password"] .": $newpass".
                   "\n\n".
                   wordwrap($PHORUM["DATA"]["LANG"]["LostPassEmailBody2"],72);
                $maildata['mailsubject'] = $PHORUM["DATA"]["LANG"]["LostPassEmailSubject"];
                phorum_email_user(array( 0 => $user['email'] ), $maildata);

                $okmsg = $PHORUM["DATA"]["LANG"]["LostPassSent"];

            }
        }

        // The entered email address was not found.
        else {
            $error = $PHORUM["DATA"]["LANG"]["LostPassError"];
        }
    }

    // The user wants to login.
    else {

        // Check if the phorum_tmp_cookie was set. If not, the user's
        // browser does not support cookies.
        if($PHORUM["use_cookies"] && !isset($_COOKIE["phorum_tmp_cookie"])) {
            $PHORUM["use_cookies"] = false;
        }

        $username = trim($_POST["username"]);
        $password = trim($_POST["password"]);

        // Check if the login credentials are right.
        if (phorum_user_check_login($username, $password)) {

            // Destroy the temporary cookie.
            if(isset($_COOKIE["phorum_tmp_cookie"])){
                setcookie( "phorum_tmp_cookie", "", 0, $PHORUM["session_path"], $PHORUM["session_domain"] );
            }

            // Create an URI session id if cookies are not used..
            if(!$PHORUM["use_cookies"]) {
                $uri_session_id = md5($_POST['username'].microtime().$_POST['password']);
                $user = array(
                    'user_id'  => $PHORUM['user']['user_id'],
                    'sessid_st'=> $uri_session_id
                );
                phorum_user_save_simple($user);
                phorum_user_create_session(PHORUM_SESSION_LONG_TERM,true,$uri_session_id);
            // Create cookie session(s).
            } else {
                if (!$PHORUM["DATA"]["LOGGEDIN"]) {
                    phorum_user_create_session(PHORUM_SESSION_LONG_TERM, false);
                }
                if($PHORUM["tight_security"]){
                    phorum_user_create_session(PHORUM_SESSION_SHORT_TERM, true);
                }
            }

            // Determine the URL to redirect the user to.
            // If redir is a number, it is a URL constant.
            if(is_numeric($_POST["redir"])){
                $redir = phorum_get_url($_POST["redir"]);
            }

            // Redirecting to the registration or login page is a little weird,
            // so we just go to the list page if we came from one of those.
            elseif (isset($PHORUM['use_cookies']) && $PHORUM["use_cookies"] && !strstr($_POST["redir"], "register." . PHORUM_FILE_EXTENSION) && !strstr($_POST["redir"], "login." . PHORUM_FILE_EXTENSION)) {
                $redir = $_POST["redir"];

            // By default, we redirect to the list page.
            } else {
                $redir = phorum_get_url( PHORUM_LIST_URL );
            }

            // The hook "after_login" can be used by module writers to
            // set a custom redirect URL.
            $redir =phorum_hook( "after_login", $redir );

            phorum_redirect_by_url($redir);
            exit();
        }

        // Login failed.
        else {
            $error = $PHORUM["DATA"]["LANG"]["InvalidLogin"];
        }
    }
}

// No data posted, so this is the first request. Here we set
// a temporary cookie, so we can check if the user's browser
// supports cookies.
elseif($PHORUM["use_cookies"]) {
    setcookie( "phorum_tmp_cookie", "this will be destroyed once logged in", 0, $PHORUM["session_path"], $PHORUM["session_domain"] );
}

// Determine to what URL the user must be redirected after login.
if (!empty( $PHORUM["args"]["redir"])) {
    $redir = htmlspecialchars(urldecode($PHORUM["args"]["redir"]));
} elseif (!empty( $_REQUEST["redir"])) {
    $redir = htmlspecialchars($_REQUEST["redir"]);
} elseif (!empty( $_SERVER["HTTP_REFERER"])) {
    $base = strtolower(phorum_get_url(PHORUM_BASE_URL));
    $len = strlen($base);
    if (strtolower(substr($_SERVER["HTTP_REFERER"],0,$len)) == $base) {
        $redir = htmlspecialchars($_SERVER["HTTP_REFERER"]);
    }
}
if (! isset($redir)) {
    $redir = phorum_get_url(PHORUM_LIST_URL);
}

// Setup template data.
$PHORUM["DATA"]["LOGIN"]["redir"] = $redir;
$PHORUM["DATA"]["URL"]["REGISTER"] = phorum_get_url( PHORUM_REGISTER_URL );
$PHORUM["DATA"]["URL"]["ACTION"] = phorum_get_url( PHORUM_LOGIN_ACTION_URL );
$PHORUM["DATA"]["LOGIN"]["forum_id"] = ( int )$PHORUM["forum_id"];
$PHORUM["DATA"]["LOGIN"]["username"] = htmlspecialchars( $username );
$PHORUM["DATA"]["ERROR"] = htmlspecialchars( $error );
$PHORUM["DATA"]["OKMSG"] = htmlspecialchars( $okmsg );

// Set the field to set the focus to after loading.
$PHORUM["DATA"]["FOCUS_TO_ID"] = empty($username) ? "username" : "password";

// Display the page.
include phorum_get_template( "header" );
phorum_hook( "after_header" );
include phorum_get_template( $template );
phorum_hook( "before_footer" );
include phorum_get_template( "footer" );

?>