X-Git-Url: https://jasonwoof.com/gitweb/?a=blobdiff_plain;f=admin_login.php;h=e68f86eaedc5379e701a0461062bc969cb589513;hb=36753e2ffb06df7098fbe0e8f1760870f75741e5;hp=92d3ab60c9e877ad65b22b79454888569abbb791;hpb=be246293072b9e3b10aa10219dbfcb575cc955a8;p=wfpl-cms.git

diff --git a/admin_login.php b/admin_login.php
index 92d3ab6..e68f86e 100644
--- a/admin_login.php
+++ b/admin_login.php
@@ -1,13 +1,13 @@
 <?php
 
-# This form requires wfpl. See: http://jasonwoof.org/wfpl
+# This form requires wfpl. See: http://sametwice.com/wfpl
 
 function admin_login_get_fields() {
 	$data = array();
 
 	$data['url'] = format_oneline($_REQUEST['url']);
 	$data['username'] = format_oneline($_REQUEST['username']);
-	$data['password'] = format_oneline($_REQUEST['password']);
+	$data['password'] = sha1(format_oneline($_REQUEST['password']));
 
 	return $data;
 }
@@ -18,14 +18,17 @@ function admin_login_main() {
 	$data = admin_login_get_fields();
 
 	if(strlen($data['username'])) {
-		if($data['username'] == CMS_ADMIN_USER &&
-		   sha1($data['password']) == CMS_ADMIN_PASS) {
+		$row = db_get_assoc('admins', 'privs', 'where username=%" && password=%"', $data['username'], $data['password']);
+		if($row) {
 			session_new();
-			session_set('auth_username', $username);
-			session_set('auth_admin', 'yes');
-			require_once('code/wfpl/http.php');
+			session_set('auth_username', $data['username']);
+			session_set('auth_' . $row['privs'], 'yes');
 			if(!$data['url']) {
-				$data['url'] = './admin';
+				if ($row['privs'] == 'admin') {
+					$data['url'] = './admin';
+				} else {
+					$data['url'] = './';
+				}
 			} elseif(strpos(':', $data['url']) !== false) {
 				$data['url'] = "./$data[url]";
 			}
@@ -37,7 +40,7 @@ function admin_login_main() {
 		}
 	}
 
-	# Don't put (even failed) password back into the form
+	# make sure the hashed password doesn't make it back to the front end
 	$data['password'] = '';
 
 	# display the form [again]