function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Added by FAI
// Find Public Whip user id
$logged_into_pw = user_isloggedin();
global $user_name;
// Look it up in PHPBB user account list
$result = $db->sql_query("select user_id from phpbb_users where username = '******'");
if ($result) {
$row = $db->sql_fetchrow($result);
$user_id_for_phpbb = $row['user_id'];
}
$url = !empty($HTTP_POST_VARS['redirect']) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : str_replace("/forum/", "", $_SERVER['REQUEST_URI']);
if ($logged_into_pw) {
// If user id is wrong, log into it
if ($user_id_for_phpbb && $user_id_for_phpbb != $userdata['user_id']) {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
}
$session_id = session_begin($user_id_for_phpbb, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
// Otherwise make new account
if (!$user_id_for_phpbb) {
// Log out first if logged in
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
$sql = "SELECT MAX(user_id) AS total FROM " . USERS_TABLE;
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
if (!($row = $db->sql_fetchrow($result))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
$user_id = $row['total'] + 1;
$notifyreply = 1;
$sql = "INSERT INTO " . USERS_TABLE . "\t \nVALUES ('" . mysql_escape_string($user_id) . "',1,'" . mysql_escape_string($user_name) . "','NEVER***',0,0,0," . time() . ",0,0,0.00,1,'english','D M d, Y g:i a',0,0,0,NULL,0,1,1,1,1,1,1,1,1,1,1,0,'',0,'" . mysql_escape_string(user_getemail()) . "','','','','','','','','','','','',NULL,0,0)";
/* VALUES ($user_id, '" . str_replace("\'", "''", $user_name) . "', " . time() . ", '" . str_replace("\'", "''", "NOT VALID ***") . "', '" . str_replace("\'", "''", user_getemail()) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
*/
if (!($result = $db->sql_query($sql, BEGIN_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql);
}
$sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)\n\t\t\t\tVALUES ('', 'Personal User', 1, 0)";
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql);
}
$group_id = $db->sql_nextid();
$sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)\n\t\t\t\tVALUES ({$user_id}, {$group_id}, 0)";
if (!($result = $db->sql_query($sql, END_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql);
}
$session_id = session_begin($user_id, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
} else {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
}
// End added by FAI
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
$update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
$sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
}
}
}
if (!$error) {
if ($avatar_sql == '') {
$avatar_sql = $mode == 'editprofile' ? '' : "'', " . USER_AVATAR_NONE;
}
if ($mode == 'editprofile') {
if ($email != $userdata['user_email'] && $board_config['require_activation'] != USER_ACTIVATION_NONE && $userdata['user_level'] != ADMIN) {
$user_active = 0;
$user_actkey = gen_rand_string(true);
$key_len = 54 - strlen($server_url);
$key_len = $key_len > 6 ? $key_len : 6;
$user_actkey = substr($user_actkey, 0, $key_len);
if ($userdata['session_logged_in']) {
session_end($userdata['sid'], $userdata['user_id']);
}
} else {
$user_active = 1;
$user_actkey = '';
}
$sql = "UPDATE " . USERS_TABLE . "\n SET " . $username_sql . $passwd_sql . "user_email = '" . str_replace("\\'", "''", $email) . "', user_icq = '" . str_replace("\\'", "''", $icq) . "', user_website = '" . str_replace("\\'", "''", $website) . "', user_occ = '" . str_replace("\\'", "''", $occupation) . "', user_from = '" . str_replace("\\'", "''", $location) . "', user_interests = '" . str_replace("\\'", "''", $interests) . "', user_sig = '" . str_replace("\\'", "''", $signature) . "', user_sig_bbcode_uid = '{$signature_bbcode_uid}', user_viewemail = '{$viewemail}', user_aim = '" . str_replace("\\'", "''", str_replace(' ', '+', $aim)) . "', user_yim = '" . str_replace("\\'", "''", $yim) . "', user_msnm = '" . str_replace("\\'", "''", $msn) . "', user_attachsig = '{$attachsig}', user_allowsmile = '{$allowsmilies}', user_allowhtml = '{$allowhtml}', user_allowbbcode = '{$allowbbcode}', user_allow_viewonline = '{$allowviewonline}', user_notify = '{$notifyreply}', user_notify_pm = '{$notifypm}', user_popup_pm = '{$popup_pm}', user_timezone = '{$user_timezone}', user_dateformat = '" . str_replace("\\'", "''", $user_dateformat) . "', user_lang = '" . str_replace("\\'", "''", $user_lang) . "', user_style = '{$user_style}', user_active = '{$user_active}', user_actkey = '" . str_replace("\\'", "''", $user_actkey) . "'" . $avatar_sql . "\n WHERE user_id = '{$user_id}'";
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not update users table', '', __LINE__, __FILE__, $sql);
} else {
getusrinfo($user);
docookie($userinfo[user_id], $userinfo[username], $userinfo[user_password], $userinfo[storynum], $userinfo[umode], $userinfo[uorder], $userinfo[thold], $userinfo[noscore], $userinfo[ublockon], $userinfo[theme], $userinfo[commentmax]);
}
if (!$user_active) {
//
// The users account has been deactivated, send them an email with a new activation key
function check_bit_user(&$p_user_data)
{
// We have a valid bitweaver user, however we do not have a phpBB user
global $db, $gBitSystem, $gBitUser, $userlib, $HTTP_GET_VARS;
$anon = $p_user_data['user_id'] == ANONYMOUS;
if (empty($p_user_data['user_id']) || $anon || $gBitUser->isRegistered() && $gBitUser->mUserId != $p_user_data['user_id']) {
if ($gBitUser->isRegistered()) {
//
// Try and pull the last time stored in a cookie, if it exists
//
$sql = "SELECT *\n\t\t\t\tFROM " . USERS_TABLE . "\n\t\t\t\tWHERE user_id = '" . $gBitUser->mUserId . "'";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not obtain bitweaver user from phpBB user table', '', __LINE__, __FILE__, $sql);
}
$user_row = $db->sql_fetchrow($result);
//vd( $user_row );
$md5 = $gBitSystem->isFeatureActive('users_clear_passwords');
$phpbb_password = $md5 ? $gBitUser->mInfo['password'] : md5($gBitUser->mInfo['password']);
// nuke their existing session cause it stores anonymous_id (-1) initially
$sql = "DELETE FROM " . SESSIONS_TABLE . "\n\t\t\t\t\tWHERE session_id = '" . $p_user_data['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql);
}
if (empty($user_row['user_id'])) {
$sql = "INSERT INTO " . USERS_TABLE . " (user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)\n\t\t\t\t\t\tVALUES ( " . $gBitUser->mInfo['user_id'] . ", " . $gBitSystem->mDb->qstr($gBitUser->mInfo['login'], get_magic_quotes_gpc()) . ", " . strtotime('now') . ", " . $gBitSystem->mDb->qstr($phpbb_password, get_magic_quotes_gpc()) . ", '" . $gBitUser->mInfo['email'] . "',\n\t\t\t\t\tNULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL, 0, 1, 0, 1, 1, 0, 1, 1, 0, 'd M Y h:i a', 'english', 1, " . (int) $gBitUser->isAdmin() . ", 0, 1, NULL)";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
}
} else {
// Has user data changed?
if ($user_row['user_email'] != $gBitUser->mInfo['email'] || $user_row['user_password'] != $phpbb_password || $user_row['username'] != $gBitUser->mInfo['login']) {
$sql = "UPDATE " . USERS_TABLE . " SET username="******", user_email = " . $gBitSystem->mDb->qstr($gBitUser->mInfo['email'], get_magic_quotes_gpc()) . ", user_password="******"\n\t\t\t\t\t\t\tWHERE user_id = " . $user_row['user_id'];
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
die;
}
}
}
// Restart the session because somehow we lost it.
$p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
} else {
// We have an anonymous session
$user_id = isset($p_user_data['user_id']) ? intval($p_user_data['user_id']) : ANONYMOUS;
if (!($p_user_data = session_begin($user_id, $p_user_data['user_ip'], $p_user_data['session_page'], TRUE, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
}
} elseif ($gBitUser->isRegistered()) {
if (empty($p_user_data['session_id'])) {
// we need a session
$p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
}
} else {
if ($p_user_data['session_logged_in']) {
//our Tiki session has ended before our phpBB session
session_end($p_user_data['session_id'], $p_user_data['user_id']);
$p_user_data = session_begin(ANONYMOUS, $p_user_data['session_ip'], $p_user_data['session_page']);
}
}
}
<?php
# ---------------------------------------------------------------------
# rth is a requirement, test, and bugtracking system
# Copyright (C) 2005 George Holbrook - rth@lists.sourceforge.net
# This program is distributed under the terms and conditions of the GPL
# See the README and LICENSE files for details
#----------------------------------------------------------------------
# ------------------------------------
# Logout Page
#
# $RCSfile: logout.php,v $ $Revision: 1.1.1.1 $
# ------------------------------------
include "./api/include_api.php";
##################################################################################
# Destroy the session and reload the login page #
##################################################################################
session_end();
##################################################################################
# Destroy the cookie login information #
##################################################################################
util_set_cookie(USER_COOKIE_NAME, "");
util_set_cookie(PWD_COOKIE_NAME, "");
html_redirect('login.php');
# ------------------------------------
# $Log: logout.php,v $
# Revision 1.1.1.1 2005/11/30 23:00:57 gth2
# importing initial version - gth
#
# ------------------------------------
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($_COOKIE[$cookiename . '_sid']) || isset($_COOKIE[$cookiename . '_data'])) {
$sessiondata = isset($_COOKIE[$cookiename . '_data']) ? unserialize(stripslashes($_COOKIE[$cookiename . '_data'])) : array();
$session_id = isset($_COOKIE[$cookiename . '_sid']) ? $_COOKIE[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($_GET['sid']) ? $_GET['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n WHERE s.session_id = '{$session_id}'\n AND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Begin PNphpBB2 Module
// OK we found a session, now determine if it should be logged in or not
// Fix by Allan (Poster on PNphpBB.com)
/* Adsense interferes with PNphpBB2 session handling.
* Adsense agent scans the page to find relevant words
* and appears as an anonymous user, forcing the expire
* of the session.
*/
$is_adsense = isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'Google');
if (!UserUtil::isLoggedIn() && $userdata['user_id'] != ANONYMOUS && !$is_adsense) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
unset($sessiondata['userid']);
if (!($userdata = session_begin(ANONYMOUS, $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
init_userprefs($userdata);
return $userdata;
}
if (UserUtil::isLoggedIn() && $userdata['user_id'] != UserUtil::getVar('uid')) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
if (!($userdata = session_begin(UserUtil::getVar('uid'), $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
}
// End PNphpBB2 Module
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
// Begin PNphpBB2 Module
// $update_admin = (!defined('IN_ADMIN') && $current_time - $userdata['session_time'] > ($board_config['session_length']+60)) ? ', session_admin = 0' : '';
// End PNphpBB2 Module
$sql = "UPDATE " . SESSIONS_TABLE . " \n SET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n WHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n SET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n WHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
