bug 451 fixed: problem with auto login

- add an auto_login_key in users_table
- $conf['session_length'] is no more useful 
    and sessions length will be 0 (until browser closed)
- add $conf['remember_me_name'] for cookie remember name


git-svn-id: http://piwigo.org/svn/trunk@1493 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 28 insertions, 0 deletions

diff --git a/identification.php b/identification.php
index df2df9b87..eba8834c0 100644
--- a/identification.php
+++ b/identification.php
@@ -71,6 +71,34 @@ SELECT '.$conf['user_fields']['id'].' AS id,
     array_push( $errors, $lang['invalid_pwd'] );
   }
 }
+elseif (!empty($_COOKIE[$conf['remember_me_name']]))
+{
+  $cookie = unserialize(pwg_stripslashes($_COOKIE[$conf['remember_me_name']]));
+  $query = '
+SELECT auto_login_key
+  FROM '.USERS_TABLE.'
+  WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].'
+;';
+
+  $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
+  if ($auto_login_key == $cookie['key'])
+  {
+    log_user($cookie['id'], false);
+    redirect(empty($redirect_to) ? make_index_url() : $redirect_to);
+  }
+  else
+  {
+    // Hacking attempt!
+    $query = '
+UPDATE '.USERS_TABLE.'
+  SET auto_login_key=\''.$auto_login_key.'\'
+  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
+;';
+    pwg_query($query);
+    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    redirect(empty($redirect_to) ? make_index_url() : $redirect_to);
+  }
+}
 //----------------------------------------------------- template initialization
 //
 // Start output of page