public function Start()
{
// Try to login using existing session
if (isset($_COOKIE[Session::COOKIE])) {
$this->Load();
if (!empty($this->hash)) {
// First two parts of IP and user agent string must match and session must not have expired
if (!$this->MatchIP($this->fields['userip'], $this->changes['userip'], 16) || $this->fields['useragent'] != $this->changes['useragent'] || $this->fields['last_activity'] < time() - self::TIMEOUT) {
// No match = Force logout + Session hash change (as userid is changed)
$this->userid = 0;
$this->user = null;
static::$is_member = null;
static::$is_staff = null;
static::$is_admin = null;
}
} else {
// Session not found in database, so make sure sessionhash is regenerated
unset($_COOKIE[Session::COOKIE]);
}
}
// Try to login using session token
if (!$this->IsLoggedIn() && isset($_COOKIE[Token::COOKIE])) {
try {
$token = Token::FindByHash($_COOKIE[Token::COOKIE]);
$staff = array_merge(static::$config['usergroup']['staff'], static::$config['usergroup']['admin']);
// Check if token has expired (for staff IP range and browser must also match)
if (!in_array($token->userid, $staff) && $token->created < time() - Token::TTL) {
Token::Delete($token);
} elseif (in_array($token->userid, $staff) && ($token->created < time() - Token::TTL || !$this->MatchIP($this->userip, $token->userip, 16) || $this->useragent != $token->useragent)) {
Token::Delete($token);
} else {
try {
// Find & Update user
$this->user = User::FindByID($token->userid);
$this->user->last_login = time();
$this->user->Save();
// Verify user
if (!$this->IsMember()) {
Token::Delete($token);
$this->user = null;
} else {
// Update session
$this->userid = $this->user->id;
// Regenerate token hash and reset created time
$token->Save();
}
} catch (ActiveRecord_NotFoundException $e) {
Token::Delete($token);
$this->user = null;
static::$is_member = null;
static::$is_staff = null;
static::$is_admin = null;
}
}
} catch (ActiveRecord_NotFoundException $e) {
// Delete token on error (cookie mainly in this case)
Token::Delete($_COOKIE[Token::COOKIE]);
}
}
if ($this->IsLoggedIn() && !empty($this->timezone)) {
try {
$this->dtz = new DateTimeZone($this->timezone);
} catch (Exception $e) {
// Ignore errors
}
}
// Determine country code
if (empty($this->usercc)) {
$this->usercc = strtolower(trim(@geoip_country_code_by_name($this->userip)));
}
// Save session
$this->Save();
}
