You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
326 lines
15 KiB
326 lines
15 KiB
<?php
|
|
// turn on warnings and notice during developement
|
|
include('initialize/PhpErrorSettings.inc.php');
|
|
|
|
// Project: Web Reference Database (refbase) <http://www.refbase.net>
|
|
// Copyright: Matthias Steffens <mailto:refbase@extracts.de> and the file's
|
|
// original author(s).
|
|
//
|
|
// This code is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY. Please see the GNU General Public
|
|
// License for more details.
|
|
//
|
|
// File: ./user_login.php
|
|
// Repository: $HeadURL: file:///svn/p/refbase/code/branches/bleeding-edge/user_login.php $
|
|
// Author(s): Matthias Steffens <mailto:refbase@extracts.de>
|
|
//
|
|
// Created: 05-Jan-03, 23:20
|
|
// Modified: $Date: 2017-04-13 02:00:18 +0000 (Thu, 13 Apr 2017) $
|
|
// $Author: karnesky $
|
|
// $Revision: 1416 $
|
|
|
|
// This script manages the login process. It should only be called when the user is not logged in.
|
|
// If the user is logged in, it will redirect back to the calling page.
|
|
// If the user is not logged in, it will show a login <form>.
|
|
// TODO: I18n
|
|
|
|
|
|
// Incorporate some include files:
|
|
include 'initialize/db.inc.php'; // 'db.inc.php' is included to hide username and password
|
|
include 'includes/header.inc.php'; // include header
|
|
include 'includes/footer.inc.php'; // include footer
|
|
include 'includes/include.inc.php'; // include common functions
|
|
include 'initialize/ini.inc.php'; // include common variables
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
// START A SESSION:
|
|
// call the 'start_session()' function (from 'include.inc.php') which will also read out available session variables:
|
|
start_session(true);
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
// Initialize preferred display language:
|
|
// (note that 'locales.inc.php' has to be included *after* the call to the 'start_session()' function)
|
|
include 'includes/locales.inc.php'; // include the locales
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
if (isset($_REQUEST["loginEmail"]))
|
|
$loginEmail = $_REQUEST["loginEmail"];
|
|
// $loginEmail = clean($_REQUEST["loginEmail"], 30); // using the clean function would be secure!
|
|
|
|
if (isset($_REQUEST["loginPassword"]))
|
|
$loginPassword = $_REQUEST["loginPassword"];
|
|
// $loginPassword = clean($_REQUEST["loginPassword"], 8); // using the clean function would be secure!
|
|
|
|
// Check if the user is already logged in
|
|
if (isset($_SESSION['loginEmail']))
|
|
{
|
|
if (!preg_match("#/(error|user_login|install)\.php#i", $referer)) // variable '$referer' is globally defined in function 'start_session()' in 'include.inc.php'
|
|
header("Location: " . $referer); // redirect the user to the calling page
|
|
else
|
|
header("Location: index.php"); // back to main page
|
|
}
|
|
|
|
// The user did submit the form but provided none or only one of the two required values: email address AND password:
|
|
if ((isset($loginEmail) && empty($loginEmail)) || (isset($loginPassword) && empty($loginPassword)))
|
|
// if ((empty($_REQUEST["loginEmail"]) && !empty($_REQUEST["loginPassword"])) || (!empty($_REQUEST["loginEmail"]) && empty($_REQUEST["loginPassword"])))
|
|
{
|
|
// Save an error message:
|
|
$HeaderString = $loc["InOrderToLoginYouMustSupplyBothEmailAddressAndPassword"];
|
|
|
|
// Write back session variables:
|
|
saveSessionVariable("HeaderString", $HeaderString); // function 'saveSessionVariable()' is defined in 'include.inc.php'
|
|
}
|
|
|
|
// Extract the view type requested by the user (either 'Mobile', 'Print', 'Web' or ''):
|
|
// ('' will produce the default 'Web' output style)
|
|
if (isset($_REQUEST['viewType']))
|
|
$viewType = $_REQUEST['viewType'];
|
|
else
|
|
$viewType = "";
|
|
|
|
// The user did not submit the form -OR- there was an error:
|
|
if (!isset($loginEmail) || !isset($loginPassword) || isset($_SESSION['HeaderString']))
|
|
login_page($referer);
|
|
else
|
|
// The user did submit the form AND provided values to both, email address AND password. Let's check if the info is valid:
|
|
check_login($referer, $loginEmail, $loginPassword);
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
function check_login($referer, $loginEmail, $loginPassword)
|
|
{
|
|
global $username;
|
|
global $password;
|
|
global $hostName;
|
|
global $databaseName;
|
|
global $connection;
|
|
global $HeaderString;
|
|
global $loginUserID;
|
|
global $loginFirstName;
|
|
global $loginLastName;
|
|
global $adminLoginEmail;
|
|
global $abbrevInstitution;
|
|
global $tableAuth, $tableUserData, $tableUsers; // defined in 'db.inc.php'
|
|
global $loc;
|
|
|
|
// Get the two character salt from the email address collected from the challenge
|
|
$salt = substr($loginEmail, 0, 2);
|
|
|
|
// Encrypt the loginPassword collected from the challenge (so that we can compare it to the encrypted passwords that are stored in the 'auth' table)
|
|
$crypted_password = crypt($loginPassword, $salt);
|
|
|
|
// CONSTRUCT SQL QUERY:
|
|
$query = "SELECT user_id FROM $tableAuth WHERE email = " . quote_smart($loginEmail) . " AND password = " . quote_smart($crypted_password);
|
|
|
|
// -------------------
|
|
|
|
// (1) OPEN CONNECTION, (2) SELECT DATABASE
|
|
connectToMySQLDatabase(); // function 'connectToMySQLDatabase()' is defined in 'include.inc.php'
|
|
|
|
// (3) RUN the query on the database through the connection:
|
|
$result = queryMySQLDatabase($query); // function 'queryMySQLDatabase()' is defined in 'include.inc.php'
|
|
|
|
// (4) EXTRACT results:
|
|
if (mysqli_num_rows($result) == 1) // Interpret query result: Do we have exactly one row?
|
|
{
|
|
$foundUser = true; // then we have found the user
|
|
$row = mysqli_fetch_array($result); // fetch the one row into the array '$row'
|
|
}
|
|
else
|
|
$foundUser = false;
|
|
|
|
// -------------------
|
|
|
|
if ($foundUser)
|
|
{
|
|
// Clear any other session variables:
|
|
if (isset($_SESSION['errors'])) // delete the 'errors' session variable:
|
|
deleteSessionVariable("errors"); // function 'deleteSessionVariable()' is defined in 'include.inc.php'
|
|
|
|
if (isset($_SESSION['formVars'])) // delete the 'formVars' session variable:
|
|
deleteSessionVariable("formVars"); // function 'deleteSessionVariable()' is defined in 'include.inc.php'
|
|
|
|
|
|
$userID = $row["user_id"]; // extract the user's userID from the last query
|
|
|
|
// Now we need to get the user's first name and last name (e.g., in order to display them within the login welcome message)
|
|
$query = "SELECT user_id, first_name, last_name, abbrev_institution, language, last_login FROM $tableUsers WHERE user_id = " . quote_smart($userID); // CONSTRUCT SQL QUERY
|
|
$result = queryMySQLDatabase($query); // RUN the query on the database through the connection (function 'queryMySQLDatabase()' is defined in 'include.inc.php')
|
|
$row2 = mysqli_fetch_array($result); // EXTRACT results: fetch the one row into the array '$row2'
|
|
|
|
// Save the fetched user details to the session file:
|
|
|
|
// Write back session variables:
|
|
saveSessionVariable("loginEmail", $loginEmail); // function 'saveSessionVariable()' is defined in 'include.inc.php'
|
|
saveSessionVariable("loginUserID", $row2["user_id"]);
|
|
saveSessionVariable("loginFirstName", $row2["first_name"]);
|
|
saveSessionVariable("loginLastName", $row2["last_name"]);
|
|
saveSessionVariable("abbrevInstitution", $row2["abbrev_institution"]);
|
|
saveSessionVariable("userLanguage", $row2["language"]);
|
|
saveSessionVariable("lastLogin", $row2["last_login"]);
|
|
|
|
// Get all user groups specified by the current user
|
|
// and (if some groups were found) save them as semicolon-delimited string to the session variable 'userGroups':
|
|
getUserGroups($tableUserData, $row2["user_id"]); // function 'getUserGroups()' is defined in 'include.inc.php'
|
|
|
|
if ($loginEmail == $adminLoginEmail) // ('$adminLoginEmail' is specified in 'ini.inc.php')
|
|
// Get all user groups specified by the admin
|
|
// and (if some groups were found) save them as semicolon-delimited string to the session variable 'adminUserGroups':
|
|
getUserGroups($tableUsers, $row2["user_id"]); // function 'getUserGroups()' is defined in 'include.inc.php'
|
|
|
|
// Get all user queries that were saved previously by the current user
|
|
// and (if some queries were found) save them as semicolon-delimited string to the session variable 'userQueries':
|
|
getUserQueries($row2["user_id"]); // function 'getUserQueries()' is defined in 'include.inc.php'
|
|
|
|
// Get all export formats that were selected previously by the current user
|
|
// and (if some formats were found) save them as semicolon-delimited string to the session variable 'user_export_formats':
|
|
getVisibleUserFormatsStylesTypes($row2["user_id"], "format", "export"); // function 'getVisibleUserFormatsStylesTypes()' is defined in 'include.inc.php'
|
|
|
|
// Get all citation formats that were selected previously by the current user
|
|
// and (if some formats were found) save them as semicolon-delimited string to the session variable 'user_cite_formats':
|
|
getVisibleUserFormatsStylesTypes($row2["user_id"], "format", "cite"); // function 'getVisibleUserFormatsStylesTypes()' is defined in 'include.inc.php'
|
|
|
|
// Get all citation styles that were selected previously by the current user
|
|
// and (if some styles were found) save them as semicolon-delimited string to the session variable 'user_styles':
|
|
getVisibleUserFormatsStylesTypes($row2["user_id"], "style", ""); // function 'getVisibleUserFormatsStylesTypes()' is defined in 'include.inc.php'
|
|
|
|
// Get all document types that were selected previously by the current user
|
|
// and (if some types were found) save them as semicolon-delimited string to the session variable 'user_types':
|
|
getVisibleUserFormatsStylesTypes($row2["user_id"], "type", ""); // function 'getVisibleUserFormatsStylesTypes()' is defined in 'include.inc.php'
|
|
|
|
// Get the user permissions for the current user
|
|
// and save all allowed user actions as semicolon-delimited string to the session variable 'user_permissions':
|
|
getPermissions($row2["user_id"], "user", true); // function 'getPermissions()' is defined in 'include.inc.php'
|
|
|
|
// Get the default view for the current user
|
|
// and save it to the session variable 'userDefaultView':
|
|
getDefaultView($row2["user_id"]); // function 'getDefaultView()' is defined in 'include.inc.php'
|
|
|
|
// Get the default number of records per page preferred by the current user
|
|
// and save it to the session variable 'userRecordsPerPage':
|
|
getDefaultNumberOfRecords($row2["user_id"]); // function 'getDefaultNumberOfRecords()' is defined in 'include.inc.php'
|
|
|
|
// Get the user's preference for displaying auto-completions
|
|
// and save it to the session variable 'userAutoCompletions':
|
|
getPrefAutoCompletions($row2["user_id"]); // function 'getPrefAutoCompletions()' is defined in 'include.inc.php'
|
|
|
|
// Get the list of "main fields" for the current user
|
|
// and save the list of fields as comma-delimited string to the session variable 'userMainFields':
|
|
getMainFields($row2["user_id"]); // function 'getMainFields()' is defined in 'include.inc.php'
|
|
|
|
|
|
// We also update the user's entry within the 'users' table:
|
|
$query = "UPDATE $tableUsers SET "
|
|
. "last_login = NOW(), " // set 'last_login' field to the current date & time in 'DATETIME' format (which is 'YYYY-MM-DD HH:MM:SS', e.g.: '2003-12-31 23:45:59')
|
|
. "logins = logins+1 " // increase the number of logins by 1
|
|
. "WHERE user_id = $userID";
|
|
|
|
// RUN the query on the database through the connection:
|
|
$result = queryMySQLDatabase($query); // function 'queryMySQLDatabase()' is defined in 'include.inc.php'
|
|
|
|
|
|
if (!preg_match("#/(error|user_login|install)\.php#i", $referer))
|
|
header("Location: " . $referer); // redirect the user to the calling page
|
|
else
|
|
header("Location: index.php"); // back to main page
|
|
}
|
|
else
|
|
{
|
|
// Ensure 'loginEmail' is not registered, so the user is not logged in
|
|
if (isset($_SESSION['loginEmail'])) // delete the 'loginEmail' session variable:
|
|
deleteSessionVariable("loginEmail"); // function 'deleteSessionVariable()' is defined in 'include.inc.php'
|
|
|
|
// Save an error message:
|
|
$HeaderString = $loc["LoginFailedYouProvidedAnIncorrectEmailAddressOrPassword"];
|
|
|
|
// Write back session variables:
|
|
saveSessionVariable("HeaderString", $HeaderString); // function 'saveSessionVariable()' is defined in 'include.inc.php'
|
|
|
|
login_page($referer);
|
|
}
|
|
|
|
// -------------------
|
|
|
|
// (5) CLOSE the database connection:
|
|
disconnectFromMySQLDatabase(); // function 'disconnectFromMySQLDatabase()' is defined in 'include.inc.php'
|
|
}
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
// Function that shows the HTML <form> that is used to collect the email address and password
|
|
function login_page($referer)
|
|
{
|
|
global $HeaderString;
|
|
global $viewType;
|
|
global $loginWelcomeMsg;
|
|
global $loginStatus;
|
|
global $loginLinks;
|
|
global $officialDatabaseName;
|
|
global $loc;
|
|
|
|
// Show login status (should be logged out!)
|
|
showLogin(); // (function 'showLogin()' is defined in 'include.inc.php')
|
|
|
|
// If there's no stored message available:
|
|
if (!isset($_SESSION['HeaderString']))
|
|
$HeaderString = $loc['YouNeedToLoginInOrderToMakeChangesToTheDatabase']; // Provide the default welcome message
|
|
else
|
|
{
|
|
$HeaderString = $_SESSION['HeaderString']; // extract 'HeaderString' session variable (only necessary if register globals is OFF!)
|
|
|
|
// Note: though we clear the session variable, the current message is still available to this script via '$HeaderString':
|
|
deleteSessionVariable("HeaderString"); // function 'deleteSessionVariable()' is defined in 'include.inc.php'
|
|
}
|
|
|
|
// Call the 'displayHTMLhead()' and 'showPageHeader()' functions (which are defined in 'header.inc.php'):
|
|
displayHTMLhead(encodeHTML($officialDatabaseName) . " -- User Login", "index,follow", "User login page. You must be logged in to the " . encodeHTML($officialDatabaseName) . " in order to add, edit or delete records", "", false, "", $viewType, array());
|
|
showPageHeader($HeaderString);
|
|
|
|
// Build the login form:
|
|
// Note: we use the fact here, that a page can have both, a GET and POST request.
|
|
// (if you POST, but add ?blah=foo to the end of the action URL, the client will GET, then POST)
|
|
?>
|
|
|
|
<form method="POST" action="user_login.php?referer=<?php echo rawurlencode($referer); ?>">
|
|
<table align="center" border="0" cellpadding="2" cellspacing="5" width="95%" summary="This table holds a login form for the <?php echo encodeHTML($officialDatabaseName); ?>">
|
|
<tr>
|
|
<td width="174" valign="bottom">
|
|
<b><?php echo $loc["EmailAddress"]; ?>:</b>
|
|
</td>
|
|
<td valign="bottom">
|
|
<input type="text" name="loginEmail" size="30">
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="bottom">
|
|
<b><?php echo $loc["EmailAdressPassword"]; ?>:</b>
|
|
</td>
|
|
<td valign="bottom">
|
|
<input type="password" name="loginPassword" size="30">
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="bottom">
|
|
|
|
</td>
|
|
<td valign="bottom">
|
|
<input type="submit" value="Login">
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</form><?php
|
|
|
|
// --------------------------------------------------------------------
|
|
|
|
// DISPLAY THE HTML FOOTER:
|
|
// call the 'showPageFooter()' and 'displayHTMLfoot()' functions (which are defined in 'footer.inc.php')
|
|
showPageFooter($HeaderString);
|
|
|
|
displayHTMLfoot();
|
|
|
|
// --------------------------------------------------------------------
|
|
}
|
|
?>
|