From 3047a39acd52aca2b0343dde4f6fadeee2c2ffc7 Mon Sep 17 00:00:00 2001 From: Phyks Date: Thu, 26 Dec 2013 00:13:54 +0100 Subject: [PATCH] Updated stay signed in system for a real (working) system Thanks to Sbgodin for his work on Shaarli and Leed, which I adapted. Please note that if you already have a working instance of BouffeATUlm, you have to update manually your database. You have to set a new field for User database (at the end of the database). This field has to be called "stay_signed_in_token" and to be VARCHAR(32). --- inc/User.class.php | 19 +++++++++--- inc/functions.php | 6 ++++ index.php | 73 +++++++++++++++++++++++++++++----------------- install.php | 2 +- 4 files changed, 69 insertions(+), 31 deletions(-) diff --git a/inc/User.class.php b/inc/User.class.php index 313a74c..ce1a263 100644 --- a/inc/User.class.php +++ b/inc/User.class.php @@ -3,7 +3,7 @@ require_once('data/config.php'); require_once('Storage.class.php'); class User extends Storage { - protected $id = 0, $login, $email, $display_name, $password, $admin, $json_token, $notifications; + protected $id = 0, $login, $email, $display_name, $password, $admin, $json_token, $notifications, $stay_signed_in_token; protected $TABLE_NAME = "Users"; protected $fields = array( 'id'=>'key', @@ -13,11 +13,13 @@ class User extends Storage { 'password'=>'password', 'admin'=>'bool', 'json_token'=>'string', - 'notifications'=>'int' + 'notifications'=>'int', + 'stay_signed_in_token'=>'string' ); public function __construct() { parent::__construct(); + $stay_signed_in_token = 0; } // Getters @@ -50,6 +52,10 @@ class User extends Storage { return $this->notifications; } + public function getStaySignedInToken() { + return $this->stay_signed_in_token; + } + // Setters // ======= public function setId($id) { @@ -106,6 +112,10 @@ class User extends Storage { } } + public function setStaySignedInToken($token) { + $this->stay_signed_in_token = $token; + } + // Password functions // ================== public function encrypt($text) { @@ -139,10 +149,10 @@ class User extends Storage { // =============== public function sessionStore($serialize = true) { if($serialize) { - return serialize(array('id'=>$this->id, 'login'=>$this->login, 'email'=>$this->email, 'display_name'=>$this->display_name, 'password'=>$this->password, 'admin'=>$this->admin, 'json_token'=>$this->json_token, 'notifications'=>$this->notifications)); + return serialize(array('id'=>$this->id, 'login'=>$this->login, 'email'=>$this->email, 'display_name'=>$this->display_name, 'password'=>$this->password, 'admin'=>$this->admin, 'json_token'=>$this->json_token, 'notifications'=>$this->notifications, 'stay_signed_in_token'=>$this->stay_signed_in_token)); } else { - return array('id'=>$this->id, 'login'=>$this->login, 'email'=>$this->email, 'display_name'=>$this->display_name, 'password'=>$this->password, 'admin'=>$this->admin, 'json_token'=>$this->json_token, 'notifications'=>$this->notifications); + return array('id'=>$this->id, 'login'=>$this->login, 'email'=>$this->email, 'display_name'=>$this->display_name, 'password'=>$this->password, 'admin'=>$this->admin, 'json_token'=>$this->json_token, 'notifications'=>$this->notifications, 'stay_signed_in_token'=>$this->stay_signed_in_token); } } @@ -160,6 +170,7 @@ class User extends Storage { $this->setAdmin($user_data['admin']); $this->setJsonToken($user_data['json_token']); $this->setNotifications($user_data['notifications']); + $this->setStaySignedInToken($user_data['stay_signed_in_token']); } // Check wether a user already exists or not diff --git a/inc/functions.php b/inc/functions.php index 7118f6c..804d35b 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1,4 +1,10 @@ assign('currency', htmlspecialchars(CURRENCY)); $tpl->assign('email_webmaster', htmlspecialchars(EMAIL_WEBMASTER)); - // Set sessions parameters - ini_set('session.use_cookies', 1); - ini_set('session.use_only_cookies', 1); - ini_set('session.use_trans_sid', false); - session_name('bouffeatulm'); - - // Regenerate session if needed - $cookie = session_get_cookie_params(); - $cookie_dir = ''; if(dirname($_SERVER['SCRIPT_NAME']) != '/') $cookie_dir = dirname($_SERVER['SCRIPT_NAME']); - session_set_cookie_params($cookie['lifetime'], $cookie_dir, $_SERVER['HTTP_HOST']); - session_regenerate_id(true); - - // Handle current user status - if(session_id() == '') session_start(); - $current_user = new User(); if(isset($_SESSION['current_user'])) { $current_user->sessionRestore($_SESSION['current_user'], true); } else { - $current_user = false; + if(!empty($_COOKIE['bouffeatulm_staySignedIn']) && !empty($_COOKIE['bouffeatulm_login'])) { + // Connect back + $user = new User(); + $user->setLogin($_COOKIE['bouffeatulm_login']); + + if(ban_canLogin() == false) { + setcookie('bouffeatulm_login', $_COOKIE['bouffeatulm_login'], 0, WEB_PATH); + setcookie('bouffeatulm_staySignedIn', STAY_SIGNED_IN_TOKEN, 0, WEB_PATH); + exit($errors['unknown_username_password'][LANG]); + } + else { + $user = $user->exists($_COOKIE['bouffeatulm_login']); + if($_COOKIE['bouffeatulm_staySignedIn'] === md5($user->getStaySignedInToken().$_SERVER['REMOTE_ADDR'])) { + ban_loginOk(); + $_SESSION['current_user'] = $user->sessionStore(); + $_SESSION['ip'] = user_ip(); + setcookie('bouffeatulm_login', $_COOKIE['bouffeatulm_login'], time()+31536000, WEB_PATH); + setcookie('bouffeatulm_staySignedIn', STAY_SIGNED_IN_TOKEN, time()+31536000, WEB_PATH); + header('location: index.php?'.$get_redir); + exit(); + } + else { + ban_loginFailed(); + setcookie('bouffeatulm_login', $_COOKIE['bouffeatulm_login'], 0, WEB_PATH); + setcookie('bouffeatulm_staySignedIn', STAY_SIGNED_IN_TOKEN, 0, WEB_PATH); + exit($errors['unknown_username_password'][LANG]); + } + } + } + else { + $current_user = false; + } } + $tpl->assign('current_user', secureDisplay($current_user)); if(!empty($_GET['json_token'])) { @@ -96,7 +120,7 @@ // If IP has changed, logout if($current_user !== false && user_ip() != $_SESSION['ip']) { - session_destroy(); + logout(); header('location: index.php?do=connect&'.$get_redir); exit(); } @@ -128,15 +152,12 @@ $_SESSION['ip'] = user_ip(); if(!empty($_POST['remember_me'])) { // Handle remember me cookie - $_SESSION['remember_me'] = 31536000; + $token = md5(uniqid(mt_rand(), true)); + $user->setStaySignedInToken($token); + $user->save(); + setcookie('bouffeatulm_login', $_POST['login'], time()+31536000, WEB_PATH); + setcookie('bouffeatulm_staySignedIn', md5($token.$_SERVER['REMOTE_ADDR']), time()+31536000, WEB_PATH); } - else { - $_SESSION['remember_me'] = 0; - } - - $cookie_dir = ''; if(dirname($_SERVER['SCRIPT_NAME']) != '/') $cookie_dir = dirname($_SERVER['SCRIPT_NAME']); - session_set_cookie_params($_SESSION['remember_me'], $cookie_dir, $_SERVER['HTTP_HOST']); - session_regenerate_id(true); header('location: index.php?'.$get_redir); exit(); @@ -157,7 +178,7 @@ case 'disconnect': $current_user = false; - session_destroy(); + logout(); header('location: index.php?do=connect&'.$get_redir); exit(); break; diff --git a/install.php b/install.php index 198b56c..a76a134 100755 --- a/install.php +++ b/install.php @@ -29,7 +29,7 @@ $db = new PDO('mysql:host='.$mysql_host.';dbname='.$mysql_db, $mysql_login, $mysql_password); //Create table "Users" - $db->query('CREATE TABLE IF NOT EXISTS '.$mysql_prefix.'Users (id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY, login VARCHAR(255), email VARCHAR(255), display_name VARCHAR(255), password VARCHAR(130), admin TINYINT(1), json_token VARCHAR(32), notifications TINYINT(1)) DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci'); + $db->query('CREATE TABLE IF NOT EXISTS '.$mysql_prefix.'Users (id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY, login VARCHAR(255), email VARCHAR(255), display_name VARCHAR(255), password VARCHAR(130), admin TINYINT(1), json_token VARCHAR(32), notifications TINYINT(1), stay_signed_in_token VARCHAR(32)) DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci'); //Create table "Invoices" $db->query('CREATE TABLE IF NOT EXISTS '.$mysql_prefix.'Invoices (id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY, date DATETIME, buyer INT(11), amount INT(11), what TEXT) DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci');