login.php (3022B)
1 <?php 2 /* 3 UserCake Version: 2.0.2 4 http://usercake.com 5 */ 6 7 require_once("models/config.php"); 8 if (!securePage($_SERVER['PHP_SELF'])){die();} 9 10 //Prevent the user visiting the logged in page if he/she is already logged in 11 if(isUserLoggedIn()) { header("Location: account.php"); die(); } 12 13 //Forms posted 14 if(!empty($_POST)) 15 { 16 $errors = array(); 17 $username = sanitize(trim($_POST["username"])); 18 $password = trim($_POST["password"]); 19 20 //Perform some validation 21 //Feel free to edit / change as required 22 if($username == "") 23 { 24 $errors[] = lang("ACCOUNT_SPECIFY_USERNAME"); 25 } 26 if($password == "") 27 { 28 $errors[] = lang("ACCOUNT_SPECIFY_PASSWORD"); 29 } 30 31 if(count($errors) == 0) 32 { 33 //A security note here, never tell the user which credential was incorrect 34 if(!usernameExists($username)) 35 { 36 $errors[] = lang("ACCOUNT_USER_OR_PASS_INVALID"); 37 } 38 else 39 { 40 $userdetails = fetchUserDetails($username); 41 //See if the user's account is activated 42 if($userdetails["active"]==0) 43 { 44 $errors[] = lang("ACCOUNT_INACTIVE"); 45 } 46 else 47 { 48 //Hash the password and use the salt from the database to compare the password. 49 $entered_pass = generateHash($password,$userdetails["password"]); 50 51 if($entered_pass != $userdetails["password"]) 52 { 53 //Again, we know the password is at fault here, but lets not give away the combination incase of someone bruteforcing 54 $errors[] = lang("ACCOUNT_USER_OR_PASS_INVALID"); 55 } 56 else 57 { 58 //Passwords match! we're good to go' 59 60 //Construct a new logged in user object 61 //Transfer some db data to the session object 62 $loggedInUser = new loggedInUser(); 63 $loggedInUser->email = $userdetails["email"]; 64 $loggedInUser->user_id = $userdetails["id"]; 65 $loggedInUser->hash_pw = $userdetails["password"]; 66 $loggedInUser->title = $userdetails["title"]; 67 $loggedInUser->displayname = $userdetails["display_name"]; 68 $loggedInUser->username = $userdetails["user_name"]; 69 70 //Update last sign in 71 $loggedInUser->updateLastSignIn(); 72 $_SESSION["userCakeUser"] = $loggedInUser; 73 74 //Redirect to user account page 75 header("Location: account.php"); 76 die(); 77 } 78 } 79 } 80 } 81 } 82 83 require_once("models/header.php"); 84 85 echo " 86 <body> 87 <div id='wrapper'> 88 <div id='top'><div id='logo'></div></div> 89 <div id='content'> 90 <h1>UserCake</h1> 91 <h2>Login</h2> 92 <div id='left-nav'>"; 93 94 include("left-nav.php"); 95 96 echo " 97 </div> 98 <div id='main'>"; 99 100 echo resultBlock($errors,$successes); 101 102 echo " 103 <div id='regbox'> 104 <form name='login' action='".$_SERVER['PHP_SELF']."' method='post'> 105 <p> 106 <label>Username:</label> 107 <input type='text' name='username' /> 108 </p> 109 <p> 110 <label>Password:</label> 111 <input type='password' name='password' /> 112 </p> 113 <p> 114 <label> </label> 115 <input type='submit' value='Login' class='submit' /> 116 </p> 117 </form> 118 </div> 119 </div> 120 <div id='bottom'></div> 121 </div> 122 </body> 123 </html>"; 124 125 ?>