-
Notifications
You must be signed in to change notification settings - Fork 0
/
login.php
115 lines (97 loc) · 3.11 KB
/
login.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
<?php
####################################################################
# Password Protect Avanced :: Login Form - v.1.2
####################################################################
# Visit http://www.zubrag.com/scripts/ for documentation and updates
####################################################################
// load settings
include_once('settings.php');
// list of users
$users = @file(USERS_LIST_FILE);
if (!$users) die('Cannot find users list!');
// remove php "die" statement (hackers protection)
unset($users[0]);
// prepare users list and redirects
$LOGIN_INFORMATION = array();
$REDIRECTS = array();
foreach ($users as $user) {
$u = explode(',',$user);
if (USE_USERNAME) {
$LOGIN_INFORMATION[trim($u[0])] = trim($u[1]);
$REDIRECTS[trim($u[0])] = isset($u[3]) ? trim($u[3]) : '';
}
else {
$LOGIN_INFORMATION[] = trim($u[0]);
}
}
// timeout in seconds
$timeout = (TIMEOUT_MINUTES == 0 ? 0 : time() + TIMEOUT_MINUTES * 60);
// logout?
if(isset($_GET['logout'])) {
setcookie("verify", '', $timeout, '/'); // clear password;
header('Location: ' . LOGOUT_URL);
exit();
}
if(!function_exists('showLoginPasswordProtect')) {
// show login form
function showLoginPasswordProtect($error_msg) {
include('login_header.php');
include('login_form.php');
include('login_footer.php');
// stop at this point
session_destroy();
die();
}
}
// user provided password
session_start();
if (isset($_POST['access_password'])) {
$login = isset($_POST['access_login']) ? $_POST['access_login'] : '';
$pass = $_POST['access_password'];
if (!USE_USERNAME && !in_array($pass, $LOGIN_INFORMATION)
|| (USE_USERNAME && ( !array_key_exists($login, $LOGIN_INFORMATION) || $LOGIN_INFORMATION[$login] != $pass ) )
) {
showLoginPasswordProtect("Incorrect password.");
}
else {
// set cookie if password was validated
setcookie("verify", md5($login.'%'.$pass), $timeout, '/');
// Some programs (like Form1 Bilder) check $_POST array to see if parameters passed
// So need to clear password protector variables
unset($_POST['access_login']);
unset($_POST['access_password']);
unset($_POST['Submit']);
// need to be redirected?
if (isset($REDIRECTS[$login]) && !empty($REDIRECTS[$login])) {
header('Location: '
. ((REDIRECT_PREFIX != '') && (strpos($REDIRECTS[$login], 'http') !== false) ? '' : REDIRECT_PREFIX)
. $REDIRECTS[$login]);
session_destroy();
exit();
}
}
}
else {
// check if password cookie is set
if (!isset($_COOKIE['verify'])) {
showLoginPasswordProtect("");
}
// check if cookie is good
$found = false;
foreach($LOGIN_INFORMATION as $key=>$val) {
$lp = (USE_USERNAME ? $key : '') .'%'.$val;
if ($_COOKIE['verify'] == md5($lp)) {
$found = true;
// prolong timeout
if (TIMEOUT_CHECK_ACTIVITY) {
setcookie("verify", md5($lp), $timeout, '/');
}
break;
}
}
if (!$found) {
showLoginPasswordProtect("");
}
}
session_destroy();
?>