about summary refs log tree commit diff stats
path: root/series/trunk/admin/login.php
blob: fe394a10cb379f9c47ab893b28e2f5214a3d30b6 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
<?php

/* InstaDisc Series - A Four Island Project */

/** 
 * require_once() is used to ensure
 * the ACP files are being called by
 * admin.php instead of their actual
 * locations admin/.
 * The _once() part ensures no problem
 * arises as includes/instadisc.php has
 * already been included from admin.php
 */
require_once('includes/instadisc.php');

if (!isset($_GET['submit']))
{
	showForm('','',array());
} else {
	$numOfErrors = 0;
	$errors = array();

	if (instaDisc_verifyUser($_POST['username'], $_POST['password']))
	{
		$_SESSION['username'] = $_POST['username'];

		$template = new FITemplate('loggedin');
		$template->add('SITENAME', instaDisc_getConfig('siteName'));
		$template->display();
	} else {
		addError($numOfErrors, $errors, '', 'Account could not be found');
		showForm($_POST['username'], $_POST['password'], $errors);
	}
}

function showForm($username, $password, $errors)
{
	$template = new FITemplate('login');
	$template->add('SITENAME', instaDisc_getConfig('siteName'));

	if (isset($errors[1]))
	{
		$template->adds_block('ERROR', array('ex'=>'1'));

		foreach ($errors as $name => $value)
		{
			$template->adds_block('ERRORS', array(	'NAME' => $name,
								'MSG' => $value['msg']));
		}
	}

	$template->add('USERNAME_ERR', ifErrors($errors, 'username'));
	$template->add('PASSWORD_ERR', ifErrors($errors, 'password'));

	doErrors($template, $errors, 'username');
	doErrors($template, $errors, 'password');

	$template->add('USERNAME', $username);
	$template->add('PASSWORD', $password);

	$template->display();
}

function ifErrors($errors, $id)
{
        foreach ($errors as $name => $value)
        {
                if ($value['field'] == $id)
                {
                        return ' error';
                }
        }

	return '';
}

function doErrors($template, $errors, $id)
{
        foreach ($errors as $name => $value)
        {
                if ($value['field'] == $id)
                {
			$template->adds_block(strtoupper($id) . '_ERRS', array(	'NAME' => $name,
										'VALUE' => $value['msg']));
                }
        }
}

function addError(&$numOfErrors, &$errors, $field, $msg)
{
        $numOfErrors++;
        $errors[$numOfErrors] = array('field' => $field, 'msg' => $msg);
}

?>
"p">; $insverid2 = mysql_query($insverid); if (($table == 'users') && ($getitem3['ip'] != $_SERVER['REMOTE_ADDR'])) { $setuser = "UPDATE users SET ip = \"" . $_SERVER['REMOTE_ADDR'] . "\" WHERE id = " . $getitem3['id']; $setuser2 = mysql_query($setuser); } return true; } } } return false; } function instaDisc_sendItem($username, $id) { $getitem = "SELECT * FROM inbox WHERE username = \"" . mysql_real_escape_string($username) . "\" AND itemID = " . $id; $getitem2 = mysql_query($getitem); $getitem3 = mysql_fetch_array($getitem2); if ($getitem3['username'] == $username) { $getuser = "SELECT * FROM users WHERE username = \"" . mysql_real_escape_string($username) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); $fp = @fsockopen($getuser3['ip'], 1204, $errno, $errstr); if ($fp) { $verID = rand(1,2147483647); $title = str_replace(': ', '__INSTADISC__', $getitem3['title']); $out = 'ID: ' . $id . "\r\n"; $out .= 'Verification: ' . md5($username . ':' . $getuser3['password'] . ':' . $verID) . "\r\n"; $out .= 'Verification-ID: ' . $verID . "\r\n"; $out .= 'Subscription: ' . $getitem3['subscription'] . "\r\n"; $out .= 'Title: ' . $title . "\r\n"; $out .= 'Author: ' . $getitem3['author'] . "\r\n"; $out .= 'URL: ' . $getitem3['url'] . "\r\n"; $semantics = unserialize($getitem3['semantics']); foreach ($semantics as $name => $value) { $value = str_replace(': ', '__INSTADISC__', $value); $out .= $name . ': ' . $value . "\r\n"; } if ($getitem3['encryptionID'] != 0) { $out .= 'Encryption-ID: ' . $getitem3['encryptionID'] . "\r\n"; } $out .= "\r\n\r\n"; fwrite($fp, $out); fclose($fp); return true; } else { return false; } } } function instaDisc_addItem($username, $subscription, $title, $author, $url, $semantics, $encryptionID = 0) { $getuser = "SELECT * FROM users WHERE username = \"" . mysql_real_escape_string($username) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); if ($getuser3['username'] == $username) { $itemID = $getuser3['nextItemID']; $setuser = "UPDATE users SET nextItemID = nextItemID+1 WHERE username = \"" . mysql_real_escape_string($username) . "\""; $setuser2 = mysql_query($setuser); $insitem = "INSERT INTO inbox (username, itemID, subscription, title, author, url, semantics, encryptionID) VALUES (\"" . mysql_real_escape_string($username) . "\", " . $itemID . ", \"" . mysql_real_escape_string($subscription) . "\", \"" . mysql_real_escape_string($title) . "\", \"" . mysql_real_escape_string($author) . "\", \"" . mysql_real_escape_string($url) . "\", \"" . mysql_real_escape_string($semantics) . "\"," . $encryptionID . ")"; $insitem2 = mysql_query($insitem); instaDisc_sendItem($username, $itemID); } } function instaDisc_phpMailer() { $mail = new PHPMailer(); $mail->IsSMTP(); $mail->From = 'instadisc@' . instaDisc_getConfig('mailDomain'); $mail->FromName = 'InstaDisc'; $mail->Host = instaDisc_getConfig('smtpHost'); if (instaDisc_getConfig('smtpAuth') == 'true') { $mail->SMTPAuth = true; $mail->Username = instaDisc_getConfig('smtpUser'); $mail->Password = instaDisc_getConfig('smtpPass'); } $mail->Helo = $_SERVER['SERVER_NAME']; $mail->ClearAddresses(); return $mail; } function instaDisc_sendActivationEmail($username, $password, $email) { $penKey = md5(rand(1,2147483647)); $inspending = "INSERT INTO pending (username, password, email, code) VALUES (\"" . mysql_real_escape_string($username) . "\", \"" . mysql_real_escape_string(md5($password)) . "\", \"" . mysql_real_escape_string($email) . "\", \"" . mysql_real_escape_string($penKey) . "\")"; $inspending2 = mysql_query($inspending); $mail = instaDisc_phpMailer(); $mail->AddAddress($email, $username); $mail->Subject = 'InstaDisc Account Verification'; $mail->Body = "Hello, someone has recently registered an account at " . $_SERVER['SERVER_NAME'] . " with your email address. If that was you, and your chosen username IS " . $username . ", then copy the account verification code below to our Account Verification page, enter your username and press Activate!\r\n\r\n" . $penKey . "\r\n\r\nIf that was not you, copy the above code to our Account Verification page, enter the above username, and click Delete."; $mail->Send(); return ($mail->IsError() ? $mail->ErrorInfo : true); } function instaDisc_activateAccount($username, $penKey) { $getuser = "SELECT * FROM pending WHERE username = \"" . mysql_real_escape_string($username) . "\" AND code = \"" . mysql_real_escape_string($penKey) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); if ($getuser3['username'] == $username) { $insuser = "INSERT INTO users (username, password, email) VALUES (\"" . mysql_real_escape_string($username) . "\", \"" . mysql_real_escape_string($getuser3['password']) . "\", \"" . mysql_real_escape_string($getuser3['email']) . "\")"; $insuser2 = mysql_query($insuser); $delpending = "DELETE FROM pending WHERE username = \"" . mysql_real_escape_string($username) . "\""; $delpending2 = mysql_query($delpending); $mail = instaDisc_phpMailer(); $mail->AddAddress($getuser3['email'], $username); $mail->Subject = 'Welcome to InstaDisc!'; $mail->Body = "Welcome to InstaDisc! Thank you for registering at " . instaDisc_getConfig('siteName') . " Central Server, we hope you enjoy our service! Now, when you download an InstaDisc Client, it will ask you for the following information which you will need to enter into it for it to work:\r\n\r\nUsername: " . $username . "\r\nPassword: (you should know this, it's not displayed here for security reasons)\r\nCentral Server URL: " . instaDisc_getConfig("xmlrpcURL") . "\r\n\r\nOnce again, thank you for choosing " . instaDisc_getConfig("siteName") . "!"; $mail->Send(); return ($mail->IsError() ? $mail->ErrorInfo : true); } else { return false; } } function instaDisc_deactivateAccount($username, $penKey) { $getuser = "SELECT * FROM pending WHERE username = \"" . mysql_real_escape_string($username) . "\" AND code = \"" . mysql_real_escape_string($penKey) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); if ($getuser3['username'] == $username) { $delpending = "DELETE FROM pending WHERE username = \"" . mysql_real_escape_string($username) . "\""; $delpending2 = mysql_query($delpending); return true; } else { return false; } } function instaDisc_verifyUser($username, $password) { $getuser = "SELECT * FROM users WHERE username = \"" . mysql_real_escape_string($username). "\" AND password = \"" . mysql_real_escape_string(md5($password)) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); return ($getuser3['username'] == $username); } function instaDisc_deleteAccount($username) { $getuser = "SELECT * FROM users WHERE username = \"" . mysql_real_escape_string($username) . "\""; $getuser2 = mysql_query($getuser); $getuser3 = mysql_fetch_array($getuser2); if ($getuser3['username'] == $username) { $deluser = "DELETE FROM users WHERE username = \"" . mysql_real_escape_string($username) . "\""; $deluser2 = mysql_query($deluser); $delsubs = "DELETE FROM subscriptions WHERE username = \"" . mysql_real_escape_string($username) . "\""; $delsubs2 = mysql_query($delsubs); $delitems = "DELETE FROM inbox WHERE username = \"" . mysql_real_escape_string($username) . "\""; $delitems2 = mysql_query($delitems); return true; } return false; } function instaDisc_getConfig($key) { $getconfig = "SELECT * FROM config WHERE name = \"" . mysql_real_escape_string($key) . "\""; $getconfig2 = mysql_query($getconfig); $getconfig3 = mysql_fetch_array($getconfig2); return $getconfig3['value']; } function instaDisc_changePassword($username, $password) { $setpass = "UPDATE users WHERE username = \"" . mysql_real_escape_string($username) . "\" SET password = \"" . mysql_real_escape_string(md5($password)) . "\""; $setpass2 = mysql_query($setpass); } ?>