From d5b1c1be9e8dff671abab816efca302917bbdece Mon Sep 17 00:00:00 2001 From: nikrou Date: Wed, 4 Oct 2006 20:50:20 +0000 Subject: Fix bug 451: Auto login does not work properly svn merge r1492:1493 from trunk svn merge r1510:1511 from trunk svn merge r1521:1522 from trunk svn merge r1523:1524 from trunk svn merge r1525:1526 from trunk auto_login key add to users table: - add update script - update upgrade_1.5.0.php script (related to svn:1553) git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1554 68402e56-0260-453c-a942-63ccdbb3a9ee --- identification.php | 6 +++- include/config_default.inc.php | 6 ++-- include/functions_session.inc.php | 7 ++--- include/functions_user.inc.php | 62 ++++++++++++++++++++++++++++++++++--- include/menubar.inc.php | 2 +- include/user.inc.php | 59 +++++++++++++++++++++++++---------- install/db/22.7-database.php | 47 ++++++++++++++++++++++++++++ install/phpwebgallery_structure.sql | 3 +- install/upgrade_1.5.0.php | 5 +++ 9 files changed, 166 insertions(+), 31 deletions(-) create mode 100644 install/db/22.7-database.php diff --git a/identification.php b/identification.php index df2df9b87..9bfdef96f 100644 --- a/identification.php +++ b/identification.php @@ -63,7 +63,7 @@ SELECT '.$conf['user_fields']['id'].' AS id, { $remember_me = true; } - log_user( $row['id'], $remember_me); + log_user($row['id'], $remember_me); redirect(empty($redirect_to) ? make_index_url() : $redirect_to); } else @@ -71,6 +71,10 @@ SELECT '.$conf['user_fields']['id'].' AS id, array_push( $errors, $lang['invalid_pwd'] ); } } +elseif (!empty($_COOKIE[$conf['remember_me_name']])) +{ + auto_login(); +} //----------------------------------------------------- template initialization // // Start output of page diff --git a/include/config_default.inc.php b/include/config_default.inc.php index 1f228f729..2f573cc5a 100644 --- a/include/config_default.inc.php +++ b/include/config_default.inc.php @@ -318,13 +318,13 @@ $conf['session_save_handler'] = 'db'; // creates a cookie on client side. $conf['authorize_remembering'] = true; +// remember_me_name: specifies the name of the cookie used to stay logged +$conf['remember_me_name'] = 'pwg_remember'; + // remember_me_length : time of validity for "remember me" cookies, in // seconds. $conf['remember_me_length'] = 31536000; -// session_length : time of validity for normal session, in seconds. -$conf['session_length'] = 3600; - // +-----------------------------------------------------------------------+ // | debug | // +-----------------------------------------------------------------------+ diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php index 8765028ae..7fdf5dde8 100644 --- a/include/functions_session.inc.php +++ b/include/functions_session.inc.php @@ -71,11 +71,8 @@ if (isset($conf['session_save_handler']) ini_set('session.use_only_cookies', $conf['session_use_only_cookies']); ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid'])); } - session_name( $conf['session_name'] ); - session_set_cookie_params( - ini_get('session.cookie_lifetime'), - cookie_path() - ); + session_name($conf['session_name']); + session_set_cookie_params(0, cookie_path()); } // cookie_path returns the path to use for the PhpWebGallery cookie. diff --git a/include/functions_user.inc.php b/include/functions_user.inc.php index c3048d6b0..ba085127f 100644 --- a/include/functions_user.inc.php +++ b/include/functions_user.inc.php @@ -550,15 +550,69 @@ function get_language_filepath($filename) */ function log_user($user_id, $remember_me) { - global $conf; - $session_length = $conf['session_length']; + global $conf, $user; + if ($remember_me) { - $session_length = $conf['remember_me_length']; + // search for an existing auto_login_key + $query = ' +SELECT auto_login_key + FROM '.USERS_TABLE.' + WHERE '.$conf['user_fields']['id'].' = '.$user_id.' +;'; + + $auto_login_key = current(mysql_fetch_assoc(pwg_query($query))); + if (empty($auto_login_key)) + { + $auto_login_key = base64_encode(md5(uniqid(rand(), true))); + $query = ' +UPDATE '.USERS_TABLE.' + SET auto_login_key=\''.$auto_login_key.'\' + WHERE '.$conf['user_fields']['id'].' = '.$user_id.' +;'; + pwg_query($query); + } + $cookie = array('id' => $user_id, 'key' => $auto_login_key); + setcookie($conf['remember_me_name'], + serialize($cookie), + time()+$conf['remember_me_length'], + cookie_path() + ); } - session_set_cookie_params($session_length); session_start(); $_SESSION['pwg_uid'] = $user_id; + + $user['id'] = $_SESSION['pwg_uid']; + $user['is_the_guest'] = false; +} + +/* + * Performs auto-connexion when cookie remember_me exists + * @return void +*/ +function auto_login() { + global $conf; + + // must remove slash added in include/common.inc.php + $cookie = unserialize(stripslashes($_COOKIE[$conf['remember_me_name']])); + + $query = ' +SELECT auto_login_key + FROM '.USERS_TABLE.' + WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].' +;'; + + $auto_login_key = current(mysql_fetch_assoc(pwg_query($query))); + if ($auto_login_key == $cookie['key']) + { + log_user($cookie['id'], false); + redirect(make_index_url()); + } + else + { + setcookie($conf['remember_me_name'], '', 0, cookie_path()); + redirect(make_index_url()); + } } /* diff --git a/include/menubar.inc.php b/include/menubar.inc.php index 48f372d5a..822f19fec 100755 --- a/include/menubar.inc.php +++ b/include/menubar.inc.php @@ -44,7 +44,7 @@ $template->assign_vars( 'U_HOME' => make_index_url(), 'U_REGISTER' => get_root_url().'register.php', 'U_LOST_PASSWORD' => get_root_url().'password.php', - 'U_LOGOUT' => add_url_params(make_index_url(), array('act'=>'logout') ), + 'U_LOGOUT' => get_root_url().'?act=logout', 'U_ADMIN'=> get_root_url().'admin.php', 'U_PROFILE'=> get_root_url().'profile.php', ) diff --git a/include/user.inc.php b/include/user.inc.php index b1ec2f879..b2001fa23 100644 --- a/include/user.inc.php +++ b/include/user.inc.php @@ -25,26 +25,52 @@ // | USA. | // +-----------------------------------------------------------------------+ -// retrieving connected user informations if (isset($_COOKIE[session_name()])) { - session_start(); - if (isset($_SESSION['pwg_uid'])) - { - $user['id'] = $_SESSION['pwg_uid']; - $user['is_the_guest'] = false; - } - else - { - // session timeout - $user['id'] = $conf['guest_id']; - $user['is_the_guest'] = true; - } + session_start(); + if (isset($_GET['act']) and $_GET['act'] == 'logout') + { + // logout + $_SESSION = array(); + session_unset(); + session_destroy(); + setcookie(session_name(),'',0, + ini_get('session.cookie_path'), + ini_get('session.cookie_domain') + ); + setcookie($conf['remember_me_name'], '', 0, cookie_path()); + redirect(make_index_url()); + } + elseif (empty($_SESSION['pwg_uid'])) + { + // timeout + setcookie(session_name(),'',0, + ini_get('session.cookie_path'), + ini_get('session.cookie_domain') + ); + } + else + { + $user['id'] = $_SESSION['pwg_uid']; + $user['is_the_guest'] = false; + } +} +elseif (!empty($_COOKIE[$conf['remember_me_name']])) +{ + auto_login(); } -else +else { - $user['id'] = $conf['guest_id']; - $user['is_the_guest'] = true; + $user['id'] = $conf['guest_id']; + $user['is_the_guest'] = true; +} + +if ($user['is_the_guest'] and !$conf['guest_access'] + and (basename($_SERVER['PHP_SELF'])!='identification.php') + and (basename($_SERVER['PHP_SELF'])!='password.php') + and (basename($_SERVER['PHP_SELF'])!='register.php')) +{ + redirect (get_root_url().'identification.php'); } // using Apache authentication override the above user search @@ -58,6 +84,7 @@ if ($conf['apache_authentication'] and isset($_SERVER['REMOTE_USER'])) $user['is_the_guest'] = false; } + $user = array_merge( $user, getuserdata( diff --git a/install/db/22.7-database.php b/install/db/22.7-database.php new file mode 100644 index 000000000..fb0f291a5 --- /dev/null +++ b/install/db/22.7-database.php @@ -0,0 +1,47 @@ + diff --git a/install/phpwebgallery_structure.sql b/install/phpwebgallery_structure.sql index c71896dfb..43bf6128b 100644 --- a/install/phpwebgallery_structure.sql +++ b/install/phpwebgallery_structure.sql @@ -1,4 +1,4 @@ --- MySQL dump 9.11 +1-- MySQL dump 9.11 -- -- Host: localhost Database: pwg-1_6 -- ------------------------------------------------------ @@ -345,6 +345,7 @@ CREATE TABLE `phpwebgallery_users` ( `username` varchar(100) binary NOT NULL default '', `password` varchar(32) default NULL, `mail_address` varchar(255) default NULL, + `auto_login_key` varchar(64) default NULL, PRIMARY KEY (`id`), UNIQUE KEY `users_ui1` (`username`) ) TYPE=MyISAM; diff --git a/install/upgrade_1.5.0.php b/install/upgrade_1.5.0.php index a1acc6f64..8707c981f 100644 --- a/install/upgrade_1.5.0.php +++ b/install/upgrade_1.5.0.php @@ -468,4 +468,9 @@ ALTER TABLE '.PREFIX_TABLE.'users } } +$query = ' +ALTER TABLE '.PREFIX_TABLE.'users + ADD auto_login_key varchar(64) NOT NULL +;'; +pwg_query($query); ?> -- cgit v1.2.3