| 1 | <?php |
|---|
| 2 | ### Loginscript taken form <http://aktuell.de.selfhtml.org/tippstricks/php/loginsystem/> |
|---|
| 3 | ### autor: Benjamin Wilfing |
|---|
| 4 | ### email: benjamin.wilfing@selfhtml.org |
|---|
| 5 | ### homepage: <http://wilfing-home.de> |
|---|
| 6 | ### |
|---|
| 7 | ### adapted for Jlog by Jeena Paradies |
|---|
| 8 | |
|---|
| 9 | ini_set("session.use_trans_sid", false); |
|---|
| 10 | |
|---|
| 11 | define("JLOG_ADMIN", true); |
|---|
| 12 | define("JLOG_LOGIN", true); |
|---|
| 13 | require_once('..'.DIRECTORY_SEPARATOR.'scripts'.DIRECTORY_SEPARATOR.'prepend.inc.php'); |
|---|
| 14 | require(JLOG_BASEPATH.'admin'.DIRECTORY_SEPARATOR.'blog.func.php'); |
|---|
| 15 | |
|---|
| 16 | $false_password = ""; |
|---|
| 17 | $get = strip($_GET); |
|---|
| 18 | $post = strip($_POST); |
|---|
| 19 | |
|---|
| 20 | ### Plugin Hook |
|---|
| 21 | $dispatch_login = $plugins->callHook('dispatchLogin', true); |
|---|
| 22 | |
|---|
| 23 | if ($_SERVER['REQUEST_METHOD'] == 'POST' AND $dispatch_login) { |
|---|
| 24 | session_start(); |
|---|
| 25 | $passwort = $post['password']; |
|---|
| 26 | $url = !empty($post['url']) ? $post['url'] : ''; |
|---|
| 27 | $hostname = $_SERVER['HTTP_HOST']; |
|---|
| 28 | $path = dirname($_SERVER['SCRIPT_NAME']) . '/'; |
|---|
| 29 | |
|---|
| 30 | if (strpos($url, "\n") !== false or strpos($url, "\r") !== false) { |
|---|
| 31 | die('Somebody tried to hack Jlog with Response-Splitting.'); |
|---|
| 32 | } |
|---|
| 33 | |
|---|
| 34 | if (md5($passwort) == JLOG_ADMIN_PASSWORD) { |
|---|
| 35 | $_SESSION['logged_in'] = true; |
|---|
| 36 | session_regenerate_id(); // neue SID |
|---|
| 37 | |
|---|
| 38 | if ($_SERVER['SERVER_PROTOCOL'] == 'HTTP/1.1') { |
|---|
| 39 | if (php_sapi_name() == 'cgi') header('Status: 303 See Other'); |
|---|
| 40 | else header('HTTP/1.1 303 See Other'); |
|---|
| 41 | } |
|---|
| 42 | |
|---|
| 43 | if ($path == $url) $url = $path . 'new.php'; |
|---|
| 44 | if (!empty($url)) $path = $url; |
|---|
| 45 | |
|---|
| 46 | header('Location: ' . add_session_id_to_url("http://".$hostname.$path)); |
|---|
| 47 | exit; |
|---|
| 48 | } |
|---|
| 49 | else { |
|---|
| 50 | $false_password = " <p class='error'>".$l['admin']['login_false_pw']."</p>\n"; |
|---|
| 51 | } |
|---|
| 52 | } |
|---|
| 53 | else { |
|---|
| 54 | setcookie("cookieallowed", "true", time() + 180); |
|---|
| 55 | } |
|---|
| 56 | |
|---|
| 57 | $c['meta']['title'] = $l['admin']['login_headline']; |
|---|
| 58 | $c['main'] = ' |
|---|
| 59 | <h2>'.$l['admin']['login_headline'].'</h2> |
|---|
| 60 | ' . $false_password . ' |
|---|
| 61 | <form action="login.php" method="post" accept-charset="UTF-8"> |
|---|
| 62 | <p><label for="password">' . $l['admin']['login_password'] . '</label> |
|---|
| 63 | <input class="userdata" id="password" type="password" name="password" /> |
|---|
| 64 | <input style="display: none;" name="username" type="text" value="do-not-change" /></p> |
|---|
| 65 | <p><input type="hidden" name="url" value="' . htmlspecialchars(!empty($get['url']) ? $get['url'] : '') . '" /> |
|---|
| 66 | <input type="submit" value="' . $l['admin']['login_send'] . '" /></p> |
|---|
| 67 | </form> |
|---|
| 68 | '; |
|---|
| 69 | |
|---|
| 70 | ### Plugin Hook |
|---|
| 71 | $c["main"] = $plugins->callHook('loginForm', $c["main"]); |
|---|
| 72 | |
|---|
| 73 | |
|---|
| 74 | require_once(JLOG_BASEPATH.'scripts'.DIRECTORY_SEPARATOR.'do_template.php'); |
|---|
| 75 | echo $body; |
|---|
