From 5d06d4354144066a39bca1c28b7a326b2de5283c Mon Sep 17 00:00:00 2001 From: nikrou Date: Sun, 23 Jul 2006 15:25:49 +0000 Subject: bug 451 fixed: problem with auto login - add an auto_login_key in users_table - $conf['session_length'] is no more useful and sessions length will be 0 (until browser closed) - add $conf['remember_me_name'] for cookie remember name git-svn-id: http://piwigo.org/svn/trunk@1493 68402e56-0260-453c-a942-63ccdbb3a9ee --- identification.php | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) (limited to 'identification.php') diff --git a/identification.php b/identification.php index df2df9b87..eba8834c0 100644 --- a/identification.php +++ b/identification.php @@ -71,6 +71,34 @@ SELECT '.$conf['user_fields']['id'].' AS id, array_push( $errors, $lang['invalid_pwd'] ); } } +elseif (!empty($_COOKIE[$conf['remember_me_name']])) +{ + $cookie = unserialize(pwg_stripslashes($_COOKIE[$conf['remember_me_name']])); + $query = ' +SELECT auto_login_key + FROM '.USERS_TABLE.' + WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].' +;'; + + $auto_login_key = current(mysql_fetch_assoc(pwg_query($query))); + if ($auto_login_key == $cookie['key']) + { + log_user($cookie['id'], false); + redirect(empty($redirect_to) ? make_index_url() : $redirect_to); + } + else + { + // Hacking attempt! + $query = ' +UPDATE '.USERS_TABLE.' + SET auto_login_key=\''.$auto_login_key.'\' + WHERE '.$conf['user_fields']['id'].' = '.$user_id.' +;'; + pwg_query($query); + setcookie($conf['remember_me_name'], '', 0, cookie_path()); + redirect(empty($redirect_to) ? make_index_url() : $redirect_to); + } +} //----------------------------------------------------- template initialization // // Start output of page -- cgit v1.2.3