X-Git-Url: https://jasonwoof.com/gitweb/?p=wfpl-cms.git;a=blobdiff_plain;f=login.php;fp=login.php;h=4ec1344222c5f9a7a2c9053282a11fab12239300;hp=0000000000000000000000000000000000000000;hb=981eb0d01458cebf032955ef788c8c88a3a99428;hpb=abf27e3dd23a8fb52d766be615ebaa19a9dfc389

diff --git a/login.php b/login.php
new file mode 100644
index 0000000..4ec1344
--- /dev/null
+++ b/login.php
@@ -0,0 +1,67 @@
+<?php
+
+
+function login_get_fields() {
+	$data = array();
+
+	$data['after_login_url'] = format_oneline(_REQUEST_cut('after_login_url'));
+	$data['username'] = format_oneline(trim(_REQUEST_cut('username')));
+	$data['password'] = format_oneline(trim(_REQUEST_cut('password')));
+
+	return $data;
+}
+
+function login_main() {
+	$data = login_get_fields();
+	if (strlen($data['username']) && strlen($data['password'])) {
+		$row = db_get_assoc('users', 'id,name,role,password', 'where username=%"', format_auth_username($data['username']));
+		if ($row) # &&
+		if (strlen($row['password'])) {
+			$needs_rehash = false;
+			$password_good = false;
+			if (substr($row['password'], 0, 5) === 'sha1:') {
+				if (sha1($data['password']) === substr($row['password'], 5)) {
+					$password_good = true;
+					$needs_rehash = true;
+				}
+			} else {
+				if (!function_exists('password_hash')) {
+					require_once(DOCROOT . 'inc/password_funcs_backported.php');
+				}
+				if (password_verify($data['password'], $row['password'])) {
+					$password_good = true;
+					if (password_needs_rehash($row['password'], PASSWORD_DEFAULT)) {
+						$needs_rehash = true;
+					}
+				}
+			}
+			if ($password_good) {
+				if ($needs_rehash) {
+					$hash = password_hash($data['password'], PASSWORD_DEFAULT);
+					db_update('users', 'password', $hash, 'where id=%i', $row['id']);
+				}
+
+				session_new();
+				session_set('auth_id', $row['id']);
+				# we're about to http redirect, so no need to update session_auth now
+				db_update('users', 'last_login', time(), 'where id=%i', $row['id']);
+				message("You are now logged in.");
+				if(!$data['after_login_url']) {
+					if ($row['role'] == 'admin') {
+						$data['after_login_url'] = './admin';
+					} else {
+						$data['after_login_url'] = './';
+					}
+				} elseif(strpos(':', $data['after_login_url']) !== false) {
+					$data['after_login_url'] = "./$data[url]";
+				}
+
+				# redirect to the page they were trying to access:
+				return $data['after_login_url'];
+			}
+		}
+		message("Incorrect username and/or password");
+	}
+	$data['password'] = '';
+	tem_set('form', $data);
+}