Пример #1
0
function login_handle_login($save_session = true)
{
    session_set_cookie_params(2592000);
    // 1 month
    session_name(SESSION_NAME);
    if (empty($_REQUEST["iframe"]) and empty($_REQUEST["export"]) and empty($_REQUEST["import"]) and !isset($_REQUEST["plain"]) and $save_session) {
        session_set_save_handler("_login_session_none", "_login_session_none", "_login_session_read", "_login_session_write", "_login_session_destroy", "_login_session_none");
        register_shutdown_function("session_write_close");
    } else {
        session_set_save_handler("_login_session_none", "_login_session_none", "_login_session_read", "_login_session_none", "_login_session_none", "_login_session_none");
    }
    session_start();
    header("Cache-Control: private, max-age=1, must-revalidate");
    header("Pragma: private");
    if (!empty($_COOKIE[SESSION_NAME]) and empty($_SESSION)) {
        session_regenerate_id();
    }
    if (!empty($_SESSION["timezone"])) {
        date_default_timezone_set($_SESSION["timezone"]);
    }
    if (file_exists(SIMPLE_STORE . "/maintenance.lck")) {
        $maintenance = true;
    } else {
        $maintenance = false;
    }
    if (!DISABLE_BASIC_AUTH and empty($_SESSION["username"]) and !empty($_SERVER["PHP_AUTH_USER"]) and !empty($_SERVER["PHP_AUTH_PW"])) {
        $_REQUEST["username"] = modify::strip_ntdomain($_SERVER["PHP_AUTH_USER"]);
        $_REQUEST["password"] = $_SERVER["PHP_AUTH_PW"];
    }
    $ip = _login_get_remoteaddr();
    if (!empty($_REQUEST["username"]) and !empty($_REQUEST["password"]) and (!$maintenance or sys_is_super_admin($_REQUEST["username"]))) {
        if (!isset($_COOKIE[SESSION_NAME]) and !empty($_REQUEST["loginform"])) {
            sys_die('{t}Please activate cookies.{/t} <a href="index.php?logout">{t}Back{/t}</a>');
        }
        $file = SIMPLE_CACHE . "/ip/" . str_replace(array(".", ":"), "-", $ip);
        if (file_exists($file . "_3") and $trials = file_get_contents($file . "_3") and strlen($trials) > 3 and filemtime($file . "_3") > time() - 900) {
            $_REQUEST["logout"] = true;
            sys_alert("{t}Too many wrong logins. Please wait 15 minutes.{/t}");
        } else {
            if (login::validate_login($_REQUEST["username"], $_REQUEST["password"])) {
                login::process_login($_REQUEST["username"], $_REQUEST["password"]);
            } else {
                touch($file, time() + 3);
                $_REQUEST["logout"] = true;
                if (file_exists($file . "_3") and filemtime($file . "_3") < time() - 1800) {
                    unlink($file . "_3");
                }
                sys_file_append($file . "_3", "1");
                sys_log_stat("wrong_login", 1);
            }
        }
    }
    if (!isset($_REQUEST["logout"]) and empty($_SESSION["username"]) and SETUP_AUTH == "htaccess" and !empty($_SERVER["REMOTE_USER"])) {
        $_SERVER["REMOTE_USER"] = modify::strip_ntdomain($_SERVER["REMOTE_USER"]);
        if (login::validate_login($_SERVER["REMOTE_USER"], "")) {
            login::process_login($_SERVER["REMOTE_USER"]);
        }
    }
    if ($maintenance and (empty($_SESSION["username"]) or !sys_is_super_admin($_SESSION["username"]))) {
        $_REQUEST["logout"] = true;
        sys_alert("{t}Maintenance mode{/t}: {t}Active{/t}.");
    }
    if (empty($_SESSION["username"]) and ENABLE_ANONYMOUS) {
        login_anonymous_session();
    }
    if (empty($_SESSION["username"]) and ENABLE_ANONYMOUS_CMS and MAIN_SCRIPT == "download.php") {
        login_anonymous_session();
    }
    if (isset($_REQUEST["logout"]) or empty($_SESSION["username"]) and !ENABLE_ANONYMOUS or isset($_SESSION["ip"]) and $_SESSION["ip"] != $ip and $ip != $_SERVER["SERVER_ADDR"]) {
        login::show_login();
    }
}