aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authornikrou <nikrou@piwigo.org>2006-10-04 20:50:20 +0000
committernikrou <nikrou@piwigo.org>2006-10-04 20:50:20 +0000
commitd5b1c1be9e8dff671abab816efca302917bbdece (patch)
treeb5832b0b653fca7da44412f24bff93ce188aefd5 /include
parentcbf63ed4e20aa32ba7c3c5b58d1112cc4dcfef11 (diff)
Fix bug 451: Auto login does not work properly
svn merge r1492:1493 from trunk svn merge r1510:1511 from trunk svn merge r1521:1522 from trunk svn merge r1523:1524 from trunk svn merge r1525:1526 from trunk auto_login key add to users table: - add update script - update upgrade_1.5.0.php script (related to svn:1553) git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1554 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/config_default.inc.php6
-rw-r--r--include/functions_session.inc.php7
-rw-r--r--include/functions_user.inc.php62
-rwxr-xr-xinclude/menubar.inc.php2
-rw-r--r--include/user.inc.php59
5 files changed, 107 insertions, 29 deletions
diff --git a/include/config_default.inc.php b/include/config_default.inc.php
index 1f228f729..2f573cc5a 100644
--- a/include/config_default.inc.php
+++ b/include/config_default.inc.php
@@ -318,13 +318,13 @@ $conf['session_save_handler'] = 'db';
// creates a cookie on client side.
$conf['authorize_remembering'] = true;
+// remember_me_name: specifies the name of the cookie used to stay logged
+$conf['remember_me_name'] = 'pwg_remember';
+
// remember_me_length : time of validity for "remember me" cookies, in
// seconds.
$conf['remember_me_length'] = 31536000;
-// session_length : time of validity for normal session, in seconds.
-$conf['session_length'] = 3600;
-
// +-----------------------------------------------------------------------+
// | debug |
// +-----------------------------------------------------------------------+
diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php
index 8765028ae..7fdf5dde8 100644
--- a/include/functions_session.inc.php
+++ b/include/functions_session.inc.php
@@ -71,11 +71,8 @@ if (isset($conf['session_save_handler'])
ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
}
- session_name( $conf['session_name'] );
- session_set_cookie_params(
- ini_get('session.cookie_lifetime'),
- cookie_path()
- );
+ session_name($conf['session_name']);
+ session_set_cookie_params(0, cookie_path());
}
// cookie_path returns the path to use for the PhpWebGallery cookie.
diff --git a/include/functions_user.inc.php b/include/functions_user.inc.php
index c3048d6b0..ba085127f 100644
--- a/include/functions_user.inc.php
+++ b/include/functions_user.inc.php
@@ -550,15 +550,69 @@ function get_language_filepath($filename)
*/
function log_user($user_id, $remember_me)
{
- global $conf;
- $session_length = $conf['session_length'];
+ global $conf, $user;
+
if ($remember_me)
{
- $session_length = $conf['remember_me_length'];
+ // search for an existing auto_login_key
+ $query = '
+SELECT auto_login_key
+ FROM '.USERS_TABLE.'
+ WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
+;';
+
+ $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
+ if (empty($auto_login_key))
+ {
+ $auto_login_key = base64_encode(md5(uniqid(rand(), true)));
+ $query = '
+UPDATE '.USERS_TABLE.'
+ SET auto_login_key=\''.$auto_login_key.'\'
+ WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
+;';
+ pwg_query($query);
+ }
+ $cookie = array('id' => $user_id, 'key' => $auto_login_key);
+ setcookie($conf['remember_me_name'],
+ serialize($cookie),
+ time()+$conf['remember_me_length'],
+ cookie_path()
+ );
}
- session_set_cookie_params($session_length);
session_start();
$_SESSION['pwg_uid'] = $user_id;
+
+ $user['id'] = $_SESSION['pwg_uid'];
+ $user['is_the_guest'] = false;
+}
+
+/*
+ * Performs auto-connexion when cookie remember_me exists
+ * @return void
+*/
+function auto_login() {
+ global $conf;
+
+ // must remove slash added in include/common.inc.php
+ $cookie = unserialize(stripslashes($_COOKIE[$conf['remember_me_name']]));
+
+ $query = '
+SELECT auto_login_key
+ FROM '.USERS_TABLE.'
+ WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].'
+;';
+
+ $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
+ if ($auto_login_key == $cookie['key'])
+ {
+ log_user($cookie['id'], false);
+ redirect(make_index_url());
+ }
+ else
+ {
+ setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ redirect(make_index_url());
+ }
}
/*
diff --git a/include/menubar.inc.php b/include/menubar.inc.php
index 48f372d5a..822f19fec 100755
--- a/include/menubar.inc.php
+++ b/include/menubar.inc.php
@@ -44,7 +44,7 @@ $template->assign_vars(
'U_HOME' => make_index_url(),
'U_REGISTER' => get_root_url().'register.php',
'U_LOST_PASSWORD' => get_root_url().'password.php',
- 'U_LOGOUT' => add_url_params(make_index_url(), array('act'=>'logout') ),
+ 'U_LOGOUT' => get_root_url().'?act=logout',
'U_ADMIN'=> get_root_url().'admin.php',
'U_PROFILE'=> get_root_url().'profile.php',
)
diff --git a/include/user.inc.php b/include/user.inc.php
index b1ec2f879..b2001fa23 100644
--- a/include/user.inc.php
+++ b/include/user.inc.php
@@ -25,26 +25,52 @@
// | USA. |
// +-----------------------------------------------------------------------+
-// retrieving connected user informations
if (isset($_COOKIE[session_name()]))
{
- session_start();
- if (isset($_SESSION['pwg_uid']))
- {
- $user['id'] = $_SESSION['pwg_uid'];
- $user['is_the_guest'] = false;
- }
- else
- {
- // session timeout
- $user['id'] = $conf['guest_id'];
- $user['is_the_guest'] = true;
- }
+ session_start();
+ if (isset($_GET['act']) and $_GET['act'] == 'logout')
+ {
+ // logout
+ $_SESSION = array();
+ session_unset();
+ session_destroy();
+ setcookie(session_name(),'',0,
+ ini_get('session.cookie_path'),
+ ini_get('session.cookie_domain')
+ );
+ setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ redirect(make_index_url());
+ }
+ elseif (empty($_SESSION['pwg_uid']))
+ {
+ // timeout
+ setcookie(session_name(),'',0,
+ ini_get('session.cookie_path'),
+ ini_get('session.cookie_domain')
+ );
+ }
+ else
+ {
+ $user['id'] = $_SESSION['pwg_uid'];
+ $user['is_the_guest'] = false;
+ }
+}
+elseif (!empty($_COOKIE[$conf['remember_me_name']]))
+{
+ auto_login();
}
-else
+else
{
- $user['id'] = $conf['guest_id'];
- $user['is_the_guest'] = true;
+ $user['id'] = $conf['guest_id'];
+ $user['is_the_guest'] = true;
+}
+
+if ($user['is_the_guest'] and !$conf['guest_access']
+ and (basename($_SERVER['PHP_SELF'])!='identification.php')
+ and (basename($_SERVER['PHP_SELF'])!='password.php')
+ and (basename($_SERVER['PHP_SELF'])!='register.php'))
+{
+ redirect (get_root_url().'identification.php');
}
// using Apache authentication override the above user search
@@ -58,6 +84,7 @@ if ($conf['apache_authentication'] and isset($_SERVER['REMOTE_USER']))
$user['is_the_guest'] = false;
}
+
$user = array_merge(
$user,
getuserdata(