2013-06-19 13:27:14 +02:00
|
|
|
<?php
|
2017-01-30 21:36:44 +01:00
|
|
|
/* μlogger
|
2013-06-19 13:27:14 +02:00
|
|
|
*
|
2017-01-30 21:36:44 +01:00
|
|
|
* Copyright(C) 2017 Bartek Fabiszewski (www.fabiszewski.net)
|
2013-06-19 13:27:14 +02:00
|
|
|
*
|
|
|
|
|
* This is free software; you can redistribute it and/or modify it under
|
2017-04-07 00:05:28 +02:00
|
|
|
* the terms of the GNU General Public License as published by
|
|
|
|
|
* the Free Software Foundation; either version 3 of the License, or
|
2013-06-19 13:27:14 +02:00
|
|
|
* (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful, but
|
|
|
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* General Public License for more details.
|
|
|
|
|
*
|
2017-04-07 00:05:28 +02:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, see <http://www.gnu.org/licenses/>.
|
2013-06-19 13:27:14 +02:00
|
|
|
*/
|
2017-04-09 23:35:55 +02:00
|
|
|
|
2017-05-09 15:25:16 +02:00
|
|
|
if (defined('headless')) {
|
2017-06-24 11:58:40 +02:00
|
|
|
if (ob_get_level()) {
|
|
|
|
|
ob_end_clean();
|
|
|
|
|
}
|
2017-05-09 15:25:16 +02:00
|
|
|
error_reporting(0);
|
|
|
|
|
}
|
|
|
|
|
define('ROOT_DIR', __DIR__);
|
2017-04-11 17:00:40 +02:00
|
|
|
require_once(ROOT_DIR . "/helpers/config.php");
|
|
|
|
|
require_once(ROOT_DIR . "/lang.php");
|
|
|
|
|
require_once(ROOT_DIR . "/helpers/user.php");
|
2016-10-29 14:05:13 +02:00
|
|
|
|
2017-03-16 14:11:01 +01:00
|
|
|
session_name('ulogger');
|
|
|
|
|
session_start();
|
|
|
|
|
$sid = session_id();
|
|
|
|
|
|
|
|
|
|
// check for forced login to authorize admin in case of public access
|
2017-05-19 10:59:27 +02:00
|
|
|
$force_login = isset($_REQUEST['force_login']) ? $_REQUEST['force_login'] : false;
|
2017-03-16 14:11:01 +01:00
|
|
|
if ($force_login) {
|
2017-04-18 09:25:21 +02:00
|
|
|
uConfig::$require_authentication = true;
|
2017-03-16 14:11:01 +01:00
|
|
|
}
|
|
|
|
|
|
2017-04-06 18:07:15 +02:00
|
|
|
$user = new uUser();
|
|
|
|
|
$user->getFromSession();
|
2017-05-09 21:54:43 +02:00
|
|
|
if (!$user->isValid && (uConfig::$require_authentication || defined('client'))) {
|
2017-03-16 14:11:01 +01:00
|
|
|
/* authentication */
|
2017-05-19 10:59:27 +02:00
|
|
|
$login = isset($_REQUEST['user']) ? $_REQUEST['user'] : NULL;
|
|
|
|
|
$pass = isset($_REQUEST['pass']) ? $_REQUEST['pass'] : NULL;
|
|
|
|
|
$ssl = (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == "" || $_SERVER['HTTPS'] == "off") ? "http" : "https";
|
|
|
|
|
$auth_error = isset($_REQUEST['auth_error']) ? $_REQUEST['auth_error'] : false;
|
2016-10-29 14:05:13 +02:00
|
|
|
|
2017-04-10 22:46:56 +02:00
|
|
|
if (!$login) {
|
2017-04-06 18:07:15 +02:00
|
|
|
// not authenticated and username not submited
|
2017-04-09 23:35:55 +02:00
|
|
|
// load form
|
2017-01-30 21:36:44 +01:00
|
|
|
if (defined('headless')) {
|
2017-04-24 14:47:25 +02:00
|
|
|
header('WWW-Authenticate: OAuth realm="users@ulogger"');
|
2017-01-30 21:36:44 +01:00
|
|
|
header('HTTP/1.1 401 Unauthorized', true, 401);
|
|
|
|
|
} else {
|
|
|
|
|
print
|
|
|
|
|
'<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
2017-04-10 22:46:56 +02:00
|
|
|
<title>' . $lang["title"] . '</title>
|
|
|
|
|
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
|
|
|
|
|
<meta name="viewport" content="initial-scale=1.0, user-scalable=no">
|
2017-04-13 08:58:40 +02:00
|
|
|
<link rel="apple-touch-icon" sizes="180x180" href="icons/apple-touch-icon.png">
|
|
|
|
|
<link rel="icon" type="image/png" href="icons/favicon-32x32.png" sizes="32x32">
|
|
|
|
|
<link rel="icon" type="image/png" href="icons/favicon-16x16.png" sizes="16x16">
|
|
|
|
|
<link rel="manifest" href="manifest.json">
|
|
|
|
|
<link rel="mask-icon" href="icons/safari-pinned-tab.svg" color="#5bbad5">
|
|
|
|
|
<link rel="shortcut icon" href="icons/favicon.ico">
|
2017-04-15 13:41:21 +02:00
|
|
|
<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,400i,700,700i&subset=cyrillic" rel="stylesheet">
|
2017-04-13 08:58:40 +02:00
|
|
|
<meta name="msapplication-config" content="browserconfig.xml">
|
|
|
|
|
<meta name="theme-color" content="#ffffff">
|
2017-04-11 17:00:40 +02:00
|
|
|
<link rel="stylesheet" type="text/css" href="css/main.css">
|
2017-01-30 21:36:44 +01:00
|
|
|
<script type="text/javascript">
|
|
|
|
|
function focus() {
|
|
|
|
|
document.forms[0].elements[0].focus();
|
|
|
|
|
}
|
|
|
|
|
</script>
|
|
|
|
|
</head>
|
|
|
|
|
<body onload="focus()">
|
|
|
|
|
<div id="login">
|
2017-04-10 22:46:56 +02:00
|
|
|
<div id="title">' . $lang["title"] . '</div>
|
|
|
|
|
<div id="subtitle">' . $lang["private"] . '</div>
|
2017-01-30 21:36:44 +01:00
|
|
|
<form action="index.php" method="post">
|
2017-04-10 22:46:56 +02:00
|
|
|
' . $lang["username"] . ':<br>
|
|
|
|
|
<input type="text" name="user"><br>
|
|
|
|
|
' . $lang["password"] . ':<br>
|
|
|
|
|
<input type="password" name="pass"><br>
|
|
|
|
|
<br>
|
|
|
|
|
<input type="submit" value="' . $lang["login"] . '">
|
2017-05-19 10:59:27 +02:00
|
|
|
' . (($force_login) ? '<input type="hidden" name="force_login" value="1">
|
|
|
|
|
<div id="cancel"><a href="index.php">' . $lang["cancel"] . '</a></div>' : '') . '
|
2017-01-30 21:36:44 +01:00
|
|
|
</form>
|
2017-05-19 10:59:27 +02:00
|
|
|
<div id="error">' . (($auth_error) ? $lang["authfail"] : "") . '</div>
|
2017-01-30 21:36:44 +01:00
|
|
|
</div>
|
|
|
|
|
</body>
|
|
|
|
|
</html>';
|
|
|
|
|
}
|
|
|
|
|
exit();
|
2017-04-06 18:07:15 +02:00
|
|
|
} else {
|
|
|
|
|
// username submited
|
|
|
|
|
$user = new uUser($login);
|
2014-04-01 17:28:27 +11:00
|
|
|
|
2013-06-19 13:27:14 +02:00
|
|
|
//correct pass
|
2017-04-06 18:07:15 +02:00
|
|
|
if ($user->isValid && $user->validPassword($pass)) {
|
2013-06-19 13:27:14 +02:00
|
|
|
// login successful
|
|
|
|
|
//delete old session
|
|
|
|
|
$_SESSION = NULL;
|
2016-10-29 14:05:13 +02:00
|
|
|
session_destroy();
|
2013-06-19 13:27:14 +02:00
|
|
|
// start new session
|
2017-01-30 21:36:44 +01:00
|
|
|
session_name('ulogger');
|
2013-06-19 13:27:14 +02:00
|
|
|
session_start();
|
2017-04-06 18:07:15 +02:00
|
|
|
$user->storeInSession();
|
2017-04-10 22:46:56 +02:00
|
|
|
$url = str_replace("//", "/", $_SERVER['HTTP_HOST'] . dirname($_SERVER['SCRIPT_NAME']) . "/index.php");
|
2017-02-17 16:41:39 +01:00
|
|
|
header("Location: $ssl://$url");
|
2013-06-19 13:27:14 +02:00
|
|
|
} else {
|
|
|
|
|
// unsuccessful
|
|
|
|
|
$error = "?auth_error=1";
|
2017-05-19 10:59:27 +02:00
|
|
|
if ($force_login) { $error .= "&force_login=1"; }
|
2013-06-19 13:27:14 +02:00
|
|
|
// destroy session
|
|
|
|
|
$_SESSION = NULL;
|
2017-01-30 21:36:44 +01:00
|
|
|
if (isset($_COOKIE[session_name('ulogger')])) {
|
2017-04-10 22:46:56 +02:00
|
|
|
setcookie(session_name('ulogger'), '', time() - 42000, '/');
|
2013-06-19 13:27:14 +02:00
|
|
|
}
|
2016-10-29 14:05:13 +02:00
|
|
|
session_destroy();
|
2017-01-30 21:36:44 +01:00
|
|
|
if (defined('headless')) {
|
2017-04-24 14:47:25 +02:00
|
|
|
header('WWW-Authenticate: OAuth realm="users@ulogger"');
|
2017-01-30 21:36:44 +01:00
|
|
|
header('HTTP/1.1 401 Unauthorized', true, 401);
|
|
|
|
|
} else {
|
2017-04-10 22:46:56 +02:00
|
|
|
$url = str_replace("//", "/", $_SERVER['HTTP_HOST'] . dirname($_SERVER['SCRIPT_NAME']) . "/index.php");
|
2017-01-30 21:36:44 +01:00
|
|
|
header("Location: $ssl://$url$error");
|
|
|
|
|
}
|
2013-06-19 13:27:14 +02:00
|
|
|
}
|
2017-04-06 18:07:15 +02:00
|
|
|
exit();
|
2014-04-01 17:28:27 +11:00
|
|
|
}
|
2013-06-19 13:27:14 +02:00
|
|
|
/* end of authentication */
|
|
|
|
|
}
|
|
|
|
|
?>
|
