summaryrefslogtreecommitdiff
path: root/auth.php
blob: ab4729c46107d5244f00f289413811b271f4959a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
<?php
/* phpTrackme
 *
 * Copyright(C) 2013 Bartek Fabiszewski (www.fabiszewski.net)
 *
 * This is free software; you can redistribute it and/or modify it under
 * the terms of the GNU Library General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
require_once("config.php");
require_once("lang.php");
$mysqli = new mysqli($dbhost, $dbuser, $dbpass, $dbname);
if ($mysqli->connect_errno) {
    printf("Connect failed: %s\n", $mysqli->connect_error);
    exit();
}
$auth = NULL;
if ($require_authentication) {
  /* authentication */
  session_name('trackme');
  session_start();
  $sid = session_id();
  
  $auth = (isset($_SESSION['auth']) ? $_SESSION['auth'] : "");
  $user = (isset($_REQUEST['user']) ? $_REQUEST['user'] : "");
  $pass = (isset($_REQUEST['pass']) ? md5($salt.$_REQUEST['pass']) : "");
  @$ssl = ($_SERVER['HTTPS'] == "" ? "http" : "https");
  $auth_error = (isset($_REQUEST['auth_error']) ? $_REQUEST['auth_error'] : 0);
  
  // not authenticated and username not submited
  // load form
  if ((!$auth) && (!$user)){  
    print 
  '<!DOCTYPE html>
  <html>
    <head>
      <title>'.$lang_title.'</title>
      <meta http-equiv="Content-type" content="text/html;charset=UTF-8" />
      <meta name="viewport" content="initial-scale=1.0, user-scalable=no" />
      <link rel="stylesheet" type="text/css" href="main.css">
      <script type="text/javascript">
      function focus() {
        document.forms[0].elements[0].focus();
      }
      </script>
    </head>
    <body onload="focus()">
      <div id="login">
        <div id="title">'.$lang_title.'</div>
        <div id="subtitle">'.$lang_private.'</div>
        <form action="index.php" method="post">
        '.$lang_username.':<br />
        <input type="text" name="user"><br />
        '.$lang_password.':<br />
        <input type="password" name="pass"><br />
        <br />
        <input type="submit" value="'.$lang_login.'">
        </form>
        <div id="error">'.(($auth_error==1) ? $lang_authfail : "").'</div>
      </div>
      
    </body>
  </html>';
    $mysqli->close();
    exit;
  }
  
  // username submited
  if ((!$auth) && ($user)){
    $query = $mysqli->prepare("SELECT ID,username,password FROM users WHERE username=? LIMIT 1");
    $query->bind_param('s', $user);
    $query->execute();
    $query->bind_result($rec_ID, $rec_user, $rec_pass);
    $query->fetch();
    $query->free_result();
    //correct pass
    if (($user==$rec_user) && ($pass==$rec_pass)) { 
      // login successful
      //delete old session
      $_SESSION = NULL;
      session_destroy();  
      // start new session
      session_name('trackme');    
      session_start();
      $_SESSION['auth'] = $rec_ID;
    
      $url = str_replace("//", "/", $_SERVER['HTTP_HOST'].dirname($_SERVER['SCRIPT_NAME'])."/index.php");
      header("Location: $ssl://$url");
      exit;    
    } else {
      // unsuccessful
      $error = "?auth_error=1";
      // destroy session
      $_SESSION = NULL;
      if (isset($_COOKIE[session_name('trackme')])) {
        setcookie(session_name('trackme'),'',time()-42000,'/');
      }
      session_destroy();  
      $mysqli->close();    
      $url = str_replace("//", "/", $_SERVER['HTTP_HOST'].dirname($_SERVER['SCRIPT_NAME'])."/index.php");
      header("Location: $ssl://$url$error");
      exit;
    }
  }  
  /* end of authentication */
}
?>