Session\open(BASE_URL_DIRECTORY, SESSION_SAVE_PATH, 0);
// Select the requested database either from post param database or from the
// session variable. If it fails, logout to destroy session and
// 'remember me' cookie
if (!is_null(Request\value('database')) && !Model\Database\select(Request\value('database'))) {
Model\User\logout();
Response\redirect('?action=login');
} elseif (!empty($_SESSION['database'])) {
if (!Model\Database\select($_SESSION['database'])) {
Model\User\logout();
Response\redirect('?action=login');
}
}
// These actions are considered to be safe even for unauthenticated users
$safe_actions = array('login', 'bookmark-feed', 'select-db', 'logout', 'notfound');
if (!Model\User\is_loggedin() && !in_array($action, $safe_actions)) {
if (!Model\RememberMe\authenticate()) {
Model\User\logout();
Response\redirect('?action=login');
}
} elseif (Model\RememberMe\has_cookie()) {
Model\RememberMe\refresh();
}
// Load translations
$language = Model\Config\get('language') ?: 'en_US';
Translator\load($language);
// Set timezone
date_default_timezone_set(Model\Config\get('timezone') ?: 'UTC');
// HTTP secure headers
Response\csp(array('media-src' => '*', 'img-src' => '*', 'frame-src' => Model\Config\get_iframe_whitelist(), 'referrer' => 'no-referrer'));
Response\xframe();
<?php
use PicoFarad\Router;
use PicoFarad\Response;
use PicoFarad\Request;
use PicoFarad\Template;
// Logout and destroy session
Router\get_action('logout', function () {
Model\User\logout();
Response\redirect('?action=login');
});
// Display form login
Router\get_action('login', function () {
if (Model\User\is_loggedin()) {
Response\redirect('?action=unread');
}
Response\html(Template\load('login', array('errors' => array(), 'values' => array('csrf' => Model\Config\generate_csrf()), 'databases' => Model\Database\get_list(), 'current_database' => Model\Database\select())));
});
// Check credentials and redirect to unread items
Router\post_action('login', function () {
$values = Request\values();
Model\Config\check_csrf_values($values);
list($valid, $errors) = Model\User\validate_login($values);
if ($valid) {
Response\redirect('?action=unread');
}
Response\html(Template\load('login', array('errors' => $errors, 'values' => $values + array('csrf' => Model\Config\generate_csrf()), 'databases' => Model\Database\get_list(), 'current_database' => Model\Database\select())));
});