$connection = DB::connect($dsn, true);
if (DB::isError($connection)) {
trigger_error($connection->getMessage(), E_USER_ERROR);
}
// Check if the user is already logged in
if (isset($_SESSION["loginUsername"])) {
$_SESSION["message"] = "You are already logged in!";
header("Location: " . S_HOME);
exit;
}
// Register and clear an error array - just in case!
if (isset($_SESSION["loginErrors"])) {
unset($_SESSION["loginErrors"]);
}
$_SESSION["loginErrors"] = array();
// Set up a formVars array for the POST variables
$_SESSION["loginFormVars"] = array();
foreach ($_POST as $varname => $value) {
$_SESSION["loginFormVars"]["{$varname}"] = pearclean($_POST, $varname, 50, $connection);
}
// Validate password -- has it been provided and is the length between 6 and
// 8 characters?
if (checkMandatory("loginPassword", "password", "loginErrors", "loginFormVars")) {
checkMinAndMaxLength("loginPassword", 6, 8, "password", "loginErrors", "loginFormVars");
}
// Validate email -- has it been provided and is it valid?
if (checkMandatory("loginUsername", "email/username", "loginErrors", "loginFormVars")) {
emailCheck("loginUsername", "email/username", "loginErrors", "loginFormVars");
}
// Check if this is a valid user and, if so, log them in
checkLogin($_SESSION["loginFormVars"]["loginUsername"], $_SESSION["loginFormVars"]["loginPassword"], $connection);
}
$_SESSION["pwdErrors"] = array();
// Set up a formVars array for the POST variables
$_SESSION["pwdFormVars"] = array();
foreach ($_POST as $varname => $value) {
$_SESSION["pwdFormVars"]["{$varname}"] = pearclean($_POST, $varname, 8, $connection);
}
// Validate passwords - between 6 and 8 characters
if (checkMandatory("currentPassword", "current password", "pwdErrors", "pwdFormVars")) {
checkMinAndMaxLength("loginPassword", 6, 8, "current password", "pwdErrors", "pwdFormVars");
}
if (checkMandatory("newPassword1", "first new password", "pwdErrors", "pwdFormVars")) {
checkMinAndMaxLength("newPassword1", 6, 8, "first new password", "pwdErrors", "pwdFormVars");
}
if (checkMandatory("newPassword2", "second new password", "pwdErrors", "pwdFormVars")) {
checkMinAndMaxLength("newPassword2", 6, 8, "second new password", "pwdErrors", "pwdFormVars");
}
// Did we find no errors? Ok, check the new passwords are the
// same, and that the current password is different.
// Then, check the current password.
if (count($_SESSION["pwdErrors"]) == 0) {
if ($_SESSION["pwdFormVars"]["newPassword1"] != $_SESSION["pwdFormVars"]["newPassword2"]) {
$_SESSION["pwdErrors"]["newPassword1"] = "The new passwords must match.";
} elseif ($_SESSION["pwdFormVars"]["newPassword1"] == $_SESSION["pwdFormVars"]["currentPassword"]) {
$_SESSION["pwdErrors"]["newPassword1"] = "The password must change.";
} elseif (!authenticateUser($_SESSION["loginUsername"], $_SESSION["pwdFormVars"]["currentPassword"], $connection)) {
$_SESSION["pwdErrors"]["currentPassword"] = "******";
}
}
// Now the script has finished the validation,
// check if there were any errors