} else {
$theme_color = $cfg->USER_INITIAL_THEME;
}
$tpl = EasySCP_TemplateEngine::getInstance();
$tpl->assign(array('TR_PAGE_TITLE' => tr('EasySCP - Virtual Hosting Control System'), 'TR_WEBMAIL_SSL_LINK' => 'webmail', 'TR_FTP_SSL_LINK' => 'ftp', 'TR_PMA_SSL_LINK' => 'pma'));
// Key request has been triggered
if (isset($_GET['key']) && !empty($_GET['key'])) {
check_input($_GET['key']);
$template = 'lostpassword_message.tpl';
if (sendpassword($_GET['key'])) {
$tpl->assign(array('TR_MESSAGE' => tr('Your new password has been sent.'), 'TR_LINK' => '<a href="index.php" class="button">' . tr('Login') . '</a>'));
} else {
$tpl->assign(array('TR_MESSAGE' => tr('New password could not be sent.'), 'TR_LINK' => '<a href="index.php" class="button">' . tr('Login') . '</a>'));
}
} elseif (isset($_POST['uname'])) {
check_ipaddr(getipaddr(), 'captcha');
$template = 'lostpassword_message.tpl';
if (!empty($_POST['uname']) && isset($_SESSION['image']) && isset($_POST['capcode'])) {
check_input(trim($_POST['uname']));
check_input($_POST['capcode']);
if ($_SESSION['image'] == $_POST['capcode'] && requestpassword($_POST['uname'])) {
$tpl->assign(array('TR_MESSAGE' => tr('Your password request has been initiated. You will receive an email with instructions to complete the process. This reset request will expire in %s minutes.', $cfg->LOSTPASSWORD_TIMEOUT), 'TR_LINK' => '<a href="index.php" class="button">' . tr('Back') . '</a>'));
} else {
$tpl->assign(array('TR_MESSAGE' => tr('User or security code was incorrect!'), 'TR_LINK' => '<a href="lostpassword.php" class="button">' . tr('Retry') . '</a>'));
}
} else {
$tpl->assign(array('TR_MESSAGE' => tr('Please fill out all required fields!'), 'TR_LINK' => '<a href="lostpassword.php" class="button">' . tr('Retry') . '</a>'));
}
} else {
unblock($cfg->BRUTEFORCE_BLOCK_TIME, 'captcha');
is_ipaddr_blocked(null, 'captcha', true);
/**
* Should be documented
*
* @param $uname User account name
* @param $upass User account password
* @return boolean
* @todo use more secure hash algorithm (see PHP mcrypt extension)
*/
function register_user($uname, $upass)
{
$cfg = EasySCP_Registry::get('Config');
$baseServerVHostPrefix = isset($_SERVER['HTTPS']) ? "https://" : "http://";
$backButtonDestination = $baseServerVHostPrefix . $cfg->BASE_SERVER_VHOST;
check_ipaddr();
if (!username_exists($uname)) {
write_log("Login error, <strong><em>" . tohtml($uname) . "</em></strong> unknown username");
system_message(tr('You entered an incorrect username/password.'), 'warning', $backButtonDestination);
return false;
}
$udata = get_userdata($uname);
if ((EasySCP_Update_Database::getInstance()->checkUpdateExists() || $cfg->MAINTENANCEMODE) && $udata['admin_type'] != 'admin') {
write_log("Login error, <strong><em>" . $uname . "</em></strong> system currently in maintenance mode");
system_message(tr('System is currently under maintenance! Only administrators can log in.'), 'info');
return false;
}
if (crypt($upass, $udata['admin_pass']) == $udata['admin_pass'] || md5($upass) == $udata['admin_pass']) {
if (isset($_SESSION['user_logged'])) {
write_log(tr("%s user already logged or session sharing problem! Aborting...", $uname));
system_message(tr('User already logged or session sharing problem! Aborting...'), 'error');
unset_user_login_data();
return false;
}
if (!is_userdomain_ok($uname)) {
write_log(tr("%s's account status is not ok!", $uname));
system_message(tr("%s's account status is not ok!", $uname), 'error');
return false;
}
if ($udata['admin_type'] == 'user' && is_userdomain_expired($uname)) {
write_log(tr("%s's domain expired!", $uname));
system_message(tr("%s's domain expired!", $uname), 'info');
return false;
}
$sql_param = array(':user_name' => $uname, ':lastaccess' => time(), ':session_id' => session_id());
$sql_query = "\n\t\t\tUPDATE\n\t\t\t\tlogin\n\t\t\tSET\n\t\t\t\tuser_name = :user_name,\n\t\t\t\tlastaccess = :lastaccess\n\t\t\tWHERE\n\t\t\t\tsession_id = :session_id;\n\t\t";
DB::prepare($sql_query);
DB::execute($sql_param)->closeCursor();
$_SESSION['user_logged'] = $udata['admin_name'];
$_SESSION['user_pass'] = $udata['admin_pass'];
$_SESSION['user_type'] = $udata['admin_type'];
$_SESSION['user_id'] = $udata['admin_id'];
$_SESSION['user_email'] = $udata['email'];
$_SESSION['user_created_by'] = $udata['created_by'];
$_SESSION['user_login_time'] = time();
write_log($uname . " logged in.");
return true;
} else {
write_log($uname . ' entered incorrect password.');
system_message(tr('You entered an incorrect username/password.'), 'warning', $backButtonDestination);
return false;
}
}
