<?php
$page_title = 'Welcome, Please Login...';
$isLoginPage = TRUE;
require_once 'utilities/general_includes.php'; //General-purpose includes.
$error = '';
$message = '';
if (isset($_GET['type'])){
if ($_GET['type'] == 'err') $error = $_GET['msg'];
else $message = $_GET['msg'];
}
show_header();
?>
<!--content-->
<form name="frm" id="frm" autocomplete="off" method="post" action="login/?action=login"
onSubmit="return checkRequired();">
<fieldset>
<label for="txtUser" class="required" >User Name:</label>
<input type="text" name="txtUser" id="txtUser" class="required"><br><br>
<label for="txtPassword" class="required">Password:</label>
<input type="password" name="txtPassword" id="txtPassword"
maxlength="255" class="required"><br><br>
<label> </label>
<input type="submit" id="btnLogin" value="Login" class="button">
</fieldset>
</form>
<!--Place where appropriate-->
<?php require_once 'utilities/messages.php'; ?>
<script type="text/javascript">
function checkRequired(){
var uid = frm.txtUser.value;
var pwd = frm.txtPassword.value;
if ((uid === '') || (pwd === '')) {
alert ('All fields are mandatory.');
return false;
}
return true;
}
</script>
<?php
show_footer();
?>
<?php
session_start();
//This include file includes all general-purpose includes.
if (!isset($isLoginPage)){
$isLoginPage = FALSE;
}
require_once 'configuration.php';
require_once 'checkSecurity.php';
require_once 'database.php';
require_once 'page_setup.php';
?>
<?php
//This is the controller file for the current module.
require_once 'login.php';
$action = 'list'; //<-DEFAULT ACTION
//Get Action
if (isset($_GET['action'])){
$action = $_GET['action'];
}
else if (isset($_POST['action'])){
$action = $_POST['action'];
}
if ($action == 'login') {
$isLoginPage = 1;
}
require_once '../utilities/general_includes.php'; //General-purpose includes.
$error = '';
$message = '';
echo '<br> from login isLogin = '. $isLoginPage;
echo '<br> from login sess = ' . $_SESSION['sess_id'];
switch ($action){
case 'login':
$user = $_POST['txtUser'];
$password = $_POST['txtPassword'];
$login_status = Login::verify_login($user, $password);
if ($login_status == 'admin') {
header('Location: index.php?action=list');
}
else if ($login_status == 'rs') {
header('Location: ../dispatch');
}
else if ($login_status == 'no_cookies') {
header('Location: ../?type=err&msg=Cookies must be enabled in your browser');
}
else {
header('Location: ../?type=err&msg=User Id / Password combination not found.');
}
break;
case 'logout':
Login::logout();
header('Location: ../?type=info&msg=Session successfully ended.');
break;
case 'list':
$users = Login::get_login_list();
$page_title = 'User List';
$message = 'Select a user to change their password.';
include 'view_list.php';
break;
case 'pw_change':
$uid = $_GET['user'];
$user = Login::get_login($uid);
$uid = $user['user'];
$pwSha = $user['password'];
$page_title = 'Change Login Password';
include 'view_password-change.php';
break;
case 'pw_save':
$uid = $_POST['txtUser'];
$pwOld = $_POST['txtPWold'];
$pwSha = $_POST['hidPWold'];
$pwNew = $_POST['txtPWnew1'];
if (sha1($pwOld) != $pwSha) {
$error = 'Old Password does not match database. <br> <br>'
. 'Please try again.';
$page_title = 'Change Login Password';
include 'view_password-change.php';
break;
}
else{
Login::set_password($uid, $pwNew);
$message = 'Password Successfully Changed.';
$users = Login::get_login_list();
include 'view_list.php';
}
break;
case 'pw_cancel':
$users = Login::get_login_list();
$message = 'Password change cancelled.';
include 'view_list.php';
break;
}
?>
<?php //This is the model file for the current module.
class Login {
public static function verify_login($login_user, $password){
//destroy previous session
self::logout();
$user = self::get_login($login_user);
if (count($user) == 0) return 'no_user';
if (sha1($password) != $user['password']) return 'wrong password';
//login success, start session
global $env;
$lifetime = 60 * 60 * 24; // 24h in seconds
session_set_cookie_params($lifetime, '/', $env['domain'], TRUE, FALSE);
if (session_start() == FALSE) return 'no_cookies';
$_SESSION['sess_id'] = session_id();
echo 'login sess = ' . $_SESSION['sess_id'];
if (($login_user == 'reservations') || ($login_user == 'aleks')) {
return 'rs';
}
else {
return 'admin';
}
}
public static function logout() {
//Destroy Session
$_SESSION = array();
if (isset($_SESSION['sess_id'])) session_destroy();
//Delete Sess cookie
$name = session_name();
$expire = strtotime('-1 year');
$params = session_get_cookie_params();
$path = $params['path'];
$domain = $params['domain'];
$secure = $params['secure'];
$httponly = $params['httponly'];
setcookie($name, '', $expire, $path, $domain, $secure, $httponly);
}
public static function get_login($user){
$db = Database::getDB();
$query = 'SELECT * FROM logins '
. 'WHERE user = :user';
$statement = $db->prepare($query);
$statement->bindValue(':user', $user);
$statement->execute();
$result = $statement->fetch();
$statement->closeCursor();
return $result;
}
public static function get_login_list() {
$db = Database::getDB();
$query = 'SELECT login_id, user FROM logins '
. 'WHERE show_user = 1 '
. 'ORDER By user';
$statement = $db->prepare($query);
$statement->execute();
$result = $statement->fetchAll();
$statement->closeCursor();
return $result;
}
public static function set_password($user, $newPassword){
$db = Database::getDB();
$newPassword = sha1($newPassword);
$query = 'UPDATE logins '
. 'SET password = :pw '
. 'WHERE user = :user';
$statement = $db->prepare($query);
$statement->bindValue(':pw', $newPassword);
$statement->bindValue(':user', $user);
$statement->execute();
$statement->closeCursor();
}
}
?>
<?php
//go to SSL (IIS and Linux)
if (($_SERVER['HTTPS'] == 'off') || (!isset($_SERVER['HTTPS']))) {
$url = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
header("Location: " . $url);
}
//Login Check
echo '<br> check sec sess = ' . $_SESSION['sess_id'];
echo '<br> isLoginPage = ' . ($isLoginPage == TRUE);
if ($isLoginPage == FALSE) {
if (!isset($_SESSION['sess_id']) || ($_SESSION['sess_id'] == '')){
echo '<br><br>not logged in';
/*header('Location:' . $env['url'] . '/?type=err&msg=Must Login First.');
exit();*/
}
//Referrer Check
$referrer = $_SERVER['HTTP_REFERER'];
$protocol_pos = strpos($referrer, '://') + 3;
$ref_domain = substr($referrer, $protocol_pos);
$domain_end = strpos($ref_domain, '/');
$ref_domain = substr($ref_domain, 0, $domain_end);
if ($ref_domain != $env['domain']){
Login::logout();
header('Location:' . $env['url'] . '/?type=err&msg=Referrer Check Failed.');
}
}
?>
Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.
When asked, what has been your best career decision?
Deciding to stick with EE.
Being involved with EE helped me to grow personally and professionally.
Connect with Certified Experts to gain insight and support on specific technology challenges including:
We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE