Changeset 1620

Timestamp:

12/13/2006 12:06:11 AM (2 years ago)

Author:

jeena

Message:

hint by false password added

Location:

trunk

Files:

• admin/login.php (modified) (3 diffs)
• lang/lang-admin.inc.php (modified) (1 diff)

trunk/admin/login.php

@@ -10 +10 @@
  define("JLOG_LOGIN", true);
  require_once('..'.DIRECTORY_SEPARATOR.'personal'.DIRECTORY_SEPARATOR.'settings.inc.php');
+ $false_password = "";
+ $get = strip($_GET);
+ $post = strip($_POST);
 
-    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-      session_start();
-
-      $passwort = $_POST['password'];
-      $url = !empty($_POST['url']) ? $_POST['url'] : "";
-
-      $hostname = $_SERVER['HTTP_HOST'];
-      $path = dirname($_SERVER['PHP_SELF']) . "/";
-
-      // password verification
-      if ( md5( $passwort ) == JLOG_ADMIN_PASSWORD) {
-        $_SESSION['logged_in'] = true;
-
-        // go to admin index page
-        if ($_SERVER['SERVER_PROTOCOL'] == 'HTTP/1.1') {
-          if (php_sapi_name() == 'cgi') {
-           header('Status: 303 See Other');
-          }
-          else {
-           header('HTTP/1.1 303 See Other');
-          }
-        }
-        if(!empty($url)) $path = $url;
-        header('Location: http://'.$hostname.$path);
-        exit;
-       }
+        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                session_start();
+                $passwort = $post['password'];
+                $url = !empty($post['url']) ? $post['url'] : "";
+                $hostname = $_SERVER['HTTP_HOST'];
+                $path = dirname($_SERVER['PHP_SELF']) . "/";
+                
+                if ( md5( $passwort ) == JLOG_ADMIN_PASSWORD) {
+                $_SESSION['logged_in'] = true;
+                if ($_SERVER['SERVER_PROTOCOL'] == 'HTTP/1.1') {
+                        if (php_sapi_name() == 'cgi') header('Status: 303 See Other');
+                        else header('HTTP/1.1 303 See Other');
+                }
+                        if(!empty($url)) $path = $url;
+                        header('Location: http://'.$hostname.$path);
+                        exit;
+                }
+                else {
+                        $false_password = "  <p class='error'>".$l['admin']['login_false_pw']."</p>\n";
+                }
     }
       
@@ -42 +39 @@
  $c['main'] = '
   <h2>'.$l['admin']['login_headline'].'</h2>
+  '.$false_password.'
   <form action="login.php" method="post">
    <p><label for="password">'.$l['admin']['login_password'].'</label>
@@ -47 +45 @@
       <input style="display: none;" name="username" type="text" value="do-not-change" /></p>
    <p>'.$l['admin']['login_cookies'].'</p>
-   <p><input type="hidden" name="url" value="'.$_GET['url'].'" />
+   <p><input type="hidden" name="url" value="'.(!empty($get['url']) ? $get['url'] : $post['url']).'" />
       <input type="submit" value="'.$l['admin']['login_send'].'" /></p>
   </form>

trunk/lang/lang-admin.inc.php

@@ -216 +216 @@
 "login_send"               => "Einloggen",
 "login_cookies"            => "Hinweis! Cookies müssen aktiv sein.",
+"login_false_pw"           => "Es wurde ein falsches Passwort eingegeben.",
 
 "cat_name"                 => "Name der Kategorie",