function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Added by FAI
// Find Public Whip user id
$logged_into_pw = user_isloggedin();
global $user_name;
// Look it up in PHPBB user account list
$result = $db->sql_query("select user_id from phpbb_users where username = '******'");
if ($result) {
$row = $db->sql_fetchrow($result);
$user_id_for_phpbb = $row['user_id'];
}
$url = !empty($HTTP_POST_VARS['redirect']) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : str_replace("/forum/", "", $_SERVER['REQUEST_URI']);
if ($logged_into_pw) {
// If user id is wrong, log into it
if ($user_id_for_phpbb && $user_id_for_phpbb != $userdata['user_id']) {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
}
$session_id = session_begin($user_id_for_phpbb, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
// Otherwise make new account
if (!$user_id_for_phpbb) {
// Log out first if logged in
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
$sql = "SELECT MAX(user_id) AS total FROM " . USERS_TABLE;
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
if (!($row = $db->sql_fetchrow($result))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
$user_id = $row['total'] + 1;
$notifyreply = 1;
$sql = "INSERT INTO " . USERS_TABLE . "\t \nVALUES ('" . mysql_escape_string($user_id) . "',1,'" . mysql_escape_string($user_name) . "','NEVER***',0,0,0," . time() . ",0,0,0.00,1,'english','D M d, Y g:i a',0,0,0,NULL,0,1,1,1,1,1,1,1,1,1,1,0,'',0,'" . mysql_escape_string(user_getemail()) . "','','','','','','','','','','','',NULL,0,0)";
/* VALUES ($user_id, '" . str_replace("\'", "''", $user_name) . "', " . time() . ", '" . str_replace("\'", "''", "NOT VALID ***") . "', '" . str_replace("\'", "''", user_getemail()) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
*/
if (!($result = $db->sql_query($sql, BEGIN_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql);
}
$sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)\n\t\t\t\tVALUES ('', 'Personal User', 1, 0)";
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql);
}
$group_id = $db->sql_nextid();
$sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)\n\t\t\t\tVALUES ({$user_id}, {$group_id}, 0)";
if (!($result = $db->sql_query($sql, END_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql);
}
$session_id = session_begin($user_id, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
} else {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
}
// End added by FAI
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
$update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
$sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
$update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
$sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin} \n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
<?php
require_once 'func.php';
//$chapter = xss($_POST['c']);
session_begin();
if (!isset($_SESSION['user']) || !isset($_SESSION['pass'])) {
jump('unit.php');
}
require_once 'config.php';
$link = conn_db($hostname, $username, $password, $database);
if (!$link) {
echo "Mysql conncet ERROR";
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>错题回顾</title>
<link href="http://libs.baidu.com/bootstrap/3.0.3/css/bootstrap.min.css" rel="stylesheet">
<script src="http://libs.baidu.com/jquery/2.0.0/jquery.min.js"></script>
<script src="http://libs.baidu.com/bootstrap/3.0.3/js/bootstrap.min.js"></script>
</head>
<body>
<h1><center>信息论课程在线答题系统</center></h1>
<div align="right">
<table width="20%" style="margin-right:20px;margin_top:0px" border='0'>
<tr align="right">
<td>
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : '';
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = '';
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\r\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\r\n\t\t\tWHERE s.session_id = '{$session_id}'\r\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
$sql = "UPDATE " . SESSIONS_TABLE . " \r\n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id} \r\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \r\n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \r\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
//
// Delete expired sessions
//
$expiry_time = $current_time - $board_config['session_length'];
$sql = "DELETE FROM " . SESSIONS_TABLE . " \r\n\t\t\t\t\t\tWHERE session_time < {$expiry_time} \r\n\t\t\t\t\t\t\tAND session_id <> '{$session_id}'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql);
}
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
$user_id = $userdata['user_id'];
//
// Ban check against user id, IP and email address
//
preg_match('/(..)(..)(..)(..)/', $user_ip, $user_ip_parts);
$sql = "SELECT ban_ip, ban_userid, ban_email \r\n\t\t\t\t\tFROM " . BANLIST_TABLE . " \r\n\t\t\t\t\tWHERE ban_ip IN ('" . $user_ip_parts[1] . $user_ip_parts[2] . $user_ip_parts[3] . $user_ip_parts[4] . "', '" . $user_ip_parts[1] . $user_ip_parts[2] . $user_ip_parts[3] . "ff', '" . $user_ip_parts[1] . $user_ip_parts[2] . "ffff', '" . $user_ip_parts[1] . "ffffff')\r\n\t\t\t\t\t\tOR ban_userid = {$user_id}";
if ($user_id != ANONYMOUS) {
$sql .= " OR ban_email LIKE '" . str_replace("\\'", "''", $userdata['user_email']) . "' \r\n\t\t\t\t\t\tOR ban_email LIKE '" . substr(str_replace("\\'", "''", $userdata['user_email']), strpos(str_replace("\\'", "''", $userdata['user_email']), "@")) . "'";
}
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not obtain ban information', '', __LINE__, __FILE__, $sql);
}
if ($ban_info = $db->sql_fetchrow($result)) {
if ($ban_info['ban_ip'] || $ban_info['ban_userid'] || $ban_info['ban_email']) {
message_die(CRITICAL_MESSAGE, 'You_been_banned');
}
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
if ((isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login'])) && !$userdata['session_logged_in']) {
$username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';
$username = substr(str_replace("\\'", "'", $username), 0, 25);
$username = str_replace("'", "\\'", $username);
$password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';
$sql = "SELECT user_id, username, user_password, user_active, user_level\n\t\t\tFROM " . USERS_TABLE . "\n\t\t\tWHERE username = '******'", "''", $username) . "'";
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Error in obtaining userdata', '', __LINE__, __FILE__, $sql);
}
if ($row = $db->sql_fetchrow($result)) {
if ($row['user_level'] != ADMIN && $board_config['board_disable']) {
redirect(append_sid("index.{$phpEx}", true));
} else {
if (md5($password) == $row['user_password'] && $row['user_active']) {
$autologin = isset($HTTP_POST_VARS['autologin']) ? TRUE : 0;
$session_id = session_begin($row['user_id'], $user_ip, PAGE_INDEX, FALSE, $autologin);
if ($session_id) {
$url = !empty($HTTP_POST_VARS['redirect']) ? $HTTP_POST_VARS['redirect'] : "index.{$phpEx}";
redirect(append_sid($url, true));
} else {
message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
}
} else {
$redirect = !empty($HTTP_POST_VARS['redirect']) ? $HTTP_POST_VARS['redirect'] : '';
$redirect = str_replace('?', '&', $redirect);
$template->assign_vars(array('META' => "<meta http-equiv=\"refresh\" content=\"3;url=login.{$phpEx}?redirect={$redirect}\">"));
$message = $lang['Error_login'] . '<br /><br />' . sprintf($lang['Click_return_login'], "<a href=\"login.{$phpEx}?redirect={$redirect}\">", '</a>') . '<br /><br />' . sprintf($lang['Click_return_index'], '<a href="' . append_sid("index.{$phpEx}") . '">', '</a>');
message_die(GENERAL_MESSAGE, $message);
}
}
} else {
function session_show($sessid)
{
$john = new johnSession($sessid);
return $john->listCracked();
}
function unlink_sess($sessid)
{
$john = new johnSession($sessid);
return $john->delete();
}
function list_formats()
{
return johnSession::getFormats();
}
if (!empty($_POST['action']) && $_POST['action'] == 'crack') {
session_begin($_POST['sess_name'], $_POST['hashes'], $_POST['format'], $_POST['options'], $_POST['mode'], $_POST['dictionnary'], $_POST['rules']);
}
if (!empty($_POST['action']) && $_POST['action'] == 'delete') {
session_delete($_POST['sessionid']);
}
if (!empty($_POST['json']) && ($_POST['json'] = 1)) {
if (!empty($_POST['action']) && $_POST['action'] == 'list') {
print json_encode(list_sessions());
}
if (!empty($_POST['action']) && $_POST['action'] == 'resume') {
$result = FALSE;
if (!empty($_POST['sessionid'])) {
$result = session_resume($_POST['sessionid']);
}
print json_encode(array('result' => $result));
}
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$cookiesecure = $board_config['cookie_secure'] ? '; secure' : '';
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : '';
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$session_data = '';
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\r\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\r\n\t\t\tWHERE s.session_id = '{$session_id}'\r\n\t\t\t\tAND u.user_id = s.session_user_id \r\n\t\t\t\tAND s.session_ip = '{$user_ip}'";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch : session_pagestart', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
$SID = $sessionmethod == SESSION_METHOD_GET ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
$last_update = $userdata['user_id'] == ANONYMOUS ? $userdata['session_time'] : $userdata['user_session_time'];
if ($current_time - $last_update > 60) {
// || $userdata['user_session_page'] != $thispage_id
$sql = $userdata['user_id'] == ANONYMOUS ? "UPDATE " . SESSIONS_TABLE . " SET session_time = {$current_time}, session_page = {$thispage_id} WHERE session_id = '" . $userdata['session_id'] . "' AND session_ip = '{$user_ip}'" : "UPDATE " . USERS_TABLE . " SET user_session_time = {$current_time}, user_session_page = {$thispage_id} WHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table : session_pagestart', '', __LINE__, __FILE__, $sql);
}
//
// Delete expired sessions
//
$expiry_time = $current_time - $board_config['session_length'];
$sql = "DELETE FROM " . SESSIONS_TABLE . " \r\n\t\t\t\t\tWHERE session_time < {$expiry_time} \r\n\t\t\t\t\t\tAND session_id <> '{$session_id}'";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error clearing sessions table : session_pagestart', '', __LINE__, __FILE__, $sql);
}
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
// header('Set-cookie: ' . $cookiename . '_data=' . urlencode(serialize($sessiondata)) . '; expires=' . gmdate("l, d-M-Y H:i:s", $current_time + 31536000) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure);
// header('Set-cookie: ' . $cookiename . '_sid=' . $session_id . '; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure);
}
return $userdata;
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? $sessiondata['userid'] : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session : session_pagestart', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
function check_bit_user(&$p_user_data)
{
// We have a valid bitweaver user, however we do not have a phpBB user
global $db, $gBitSystem, $gBitUser, $userlib, $HTTP_GET_VARS;
$anon = $p_user_data['user_id'] == ANONYMOUS;
if (empty($p_user_data['user_id']) || $anon || $gBitUser->isRegistered() && $gBitUser->mUserId != $p_user_data['user_id']) {
if ($gBitUser->isRegistered()) {
//
// Try and pull the last time stored in a cookie, if it exists
//
$sql = "SELECT *\n\t\t\t\tFROM " . USERS_TABLE . "\n\t\t\t\tWHERE user_id = '" . $gBitUser->mUserId . "'";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not obtain bitweaver user from phpBB user table', '', __LINE__, __FILE__, $sql);
}
$user_row = $db->sql_fetchrow($result);
//vd( $user_row );
$md5 = $gBitSystem->isFeatureActive('users_clear_passwords');
$phpbb_password = $md5 ? $gBitUser->mInfo['password'] : md5($gBitUser->mInfo['password']);
// nuke their existing session cause it stores anonymous_id (-1) initially
$sql = "DELETE FROM " . SESSIONS_TABLE . "\n\t\t\t\t\tWHERE session_id = '" . $p_user_data['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql);
}
if (empty($user_row['user_id'])) {
$sql = "INSERT INTO " . USERS_TABLE . " (user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)\n\t\t\t\t\t\tVALUES ( " . $gBitUser->mInfo['user_id'] . ", " . $gBitSystem->mDb->qstr($gBitUser->mInfo['login'], get_magic_quotes_gpc()) . ", " . strtotime('now') . ", " . $gBitSystem->mDb->qstr($phpbb_password, get_magic_quotes_gpc()) . ", '" . $gBitUser->mInfo['email'] . "',\n\t\t\t\t\tNULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL, 0, 1, 0, 1, 1, 0, 1, 1, 0, 'd M Y h:i a', 'english', 1, " . (int) $gBitUser->isAdmin() . ", 0, 1, NULL)";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
}
} else {
// Has user data changed?
if ($user_row['user_email'] != $gBitUser->mInfo['email'] || $user_row['user_password'] != $phpbb_password || $user_row['username'] != $gBitUser->mInfo['login']) {
$sql = "UPDATE " . USERS_TABLE . " SET username="******", user_email = " . $gBitSystem->mDb->qstr($gBitUser->mInfo['email'], get_magic_quotes_gpc()) . ", user_password="******"\n\t\t\t\t\t\t\tWHERE user_id = " . $user_row['user_id'];
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
die;
}
}
}
// Restart the session because somehow we lost it.
$p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
} else {
// We have an anonymous session
$user_id = isset($p_user_data['user_id']) ? intval($p_user_data['user_id']) : ANONYMOUS;
if (!($p_user_data = session_begin($user_id, $p_user_data['user_ip'], $p_user_data['session_page'], TRUE, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
}
} elseif ($gBitUser->isRegistered()) {
if (empty($p_user_data['session_id'])) {
// we need a session
$p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
}
} else {
if ($p_user_data['session_logged_in']) {
//our Tiki session has ended before our phpBB session
session_end($p_user_data['session_id'], $p_user_data['user_id']);
$p_user_data = session_begin(ANONYMOUS, $p_user_data['session_ip'], $p_user_data['session_page']);
}
}
}
function bblogin($nukeuser, $session_id)
{
global $nukeuser, $userdata, $user_ip, $session_length, $session_id, $db, $nuke_file_path;
define("IN_LOGIN", true);
$cookie = explode(":", $nukeuser);
$nuid = $cookie[0];
$sql = "SELECT s.*\n FROM " . SESSIONS_TABLE . " s\n WHERE s.session_id = '{$session_id}'\n AND s.session_ip = '{$user_ip}'";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch : session_pagestar');
}
$logindata = $db->sql_fetchrow($result);
if ($nuid != $logindata['session_user_id']) {
$nusername = $cookie[1];
$sql = "SELECT user_id, username, user_password, user_active, user_level\n FROM " . USERS_TABLE . "\n WHERE username = '******'", "''", $nusername) . "'";
$result = $db->sql_query($sql);
if (!$result) {
message_die(GENERAL_ERROR, "Error in obtaining userdata : login", "", __LINE__, __FILE__, $sql);
}
$rowresult = $db->sql_fetchrow($result);
$password = $cookie[2];
if (count($rowresult)) {
if ($rowresult['user_level'] != ADMIN && $board_config['board_disable']) {
header("Location: " . append_sid("index.php", true));
} else {
if ($password == $rowresult['user_password'] && $rowresult['user_active']) {
$autologin = 0;
$userdata = session_begin($rowresult['user_id'], $user_ip, PAGE_INDEX, $session_length, FALSE, $autologin);
$session_id = $userdata['session_id'];
if (!$session_id) {
message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
} else {
}
} else {
$message = $lang['Error_login'] . "<br /><br />" . sprintf($lang['Click_return_login'], "<a href=\"" . append_sid("modules.php?name=Forums&file=login&{$redirect}") . "\">", "</a> ") . "<br /><br />" . sprintf($lang['Click_return_index'], "<a href=\"" . append_sid("index.php") . "\">", "</a> ");
message_die(GENERAL_MESSAGE, $message);
}
}
} else {
$message = $lang['Error_login'] . "<br /><br />" . sprintf($lang['Click_return_login'], "<a href=\"" . append_sid("modules.php?name=Forums&file=login&{$redirect}") . "\">", "</a> ") . "<br /><br />" . sprintf($lang['Click_return_index'], "<a href=\"" . append_sid("index.php") . "\">", "</a> ");
message_die(GENERAL_MESSAGE, $message);
}
}
}
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($_COOKIE[$cookiename . '_sid']) || isset($_COOKIE[$cookiename . '_data'])) {
$sessiondata = isset($_COOKIE[$cookiename . '_data']) ? unserialize(stripslashes($_COOKIE[$cookiename . '_data'])) : array();
$session_id = isset($_COOKIE[$cookiename . '_sid']) ? $_COOKIE[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($_GET['sid']) ? $_GET['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n WHERE s.session_id = '{$session_id}'\n AND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Begin PNphpBB2 Module
// OK we found a session, now determine if it should be logged in or not
// Fix by Allan (Poster on PNphpBB.com)
/* Adsense interferes with PNphpBB2 session handling.
* Adsense agent scans the page to find relevant words
* and appears as an anonymous user, forcing the expire
* of the session.
*/
$is_adsense = isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'Google');
if (!UserUtil::isLoggedIn() && $userdata['user_id'] != ANONYMOUS && !$is_adsense) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
unset($sessiondata['userid']);
if (!($userdata = session_begin(ANONYMOUS, $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
init_userprefs($userdata);
return $userdata;
}
if (UserUtil::isLoggedIn() && $userdata['user_id'] != UserUtil::getVar('uid')) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
if (!($userdata = session_begin(UserUtil::getVar('uid'), $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
}
// End PNphpBB2 Module
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
// Begin PNphpBB2 Module
// $update_admin = (!defined('IN_ADMIN') && $current_time - $userdata['session_time'] > ($board_config['session_length']+60)) ? ', session_admin = 0' : '';
// End PNphpBB2 Module
$sql = "UPDATE " . SESSIONS_TABLE . " \n SET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n WHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n SET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n WHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}