path: root/modules-available/session/page.inc.php

<?php

class Page_Session extends Page
{

	protected function doPreprocess()
	{
		User::load();
		$action = Request::post('action');
		if ($action === 'login') {
			// Login - see if already logged in
			if (User::isLoggedIn()) // and then just redirect
				Util::redirect('?do=main');
			// Else, try to log in
			if (User::login(Request::post('user'),
					Request::post('pass'),
					Request::post('fixedip', false, 'bool'))) {
				Util::redirect('?do=main');
			}
			// Login credentials wrong - delay and show error message
			sleep(1);
			Message::addError('loginfail');
		} elseif ($action === 'logout') {
			// Log user out (or do nothing if not logged in)
			User::logout();
		} elseif ($action === 'changepw') {
			if (!User::isLoggedIn()) {
				Util::redirect('?do=main');
			}
			// Now check if the user supplied the corrent current password, and the new password twice
			$old = Request::post('old', false, 'string');
			$new = Request::post('newpass1', false, 'string');
			if ($old === false || $new === false) {
				Message::addError('main.empty-field');
				Util::redirect('?do=session');
			}
			if (!User::testPassword(User::getId(), $old)) {
				sleep(1);
				Message::addError('wrong-password');
				Util::redirect('?do=session');
			}
			if (strlen($new) < 4) {
				Message::addError('pass-too-short');
				Util::redirect('?do=session');
			}
			if ($new !== Request::post('newpass2', false, 'string')) {
				Message::addError('adduser.password-mismatch');
				Util::redirect('?do=session');
			}
			if (Request::post('kill-other-sessions', false, 'bool')) {
				Session::deleteAllButCurrent();
			}
			if (User::updatePassword($new)) {
				Message::addSuccess('password-changed');
			} else {
				Message::addWarning('password-unchanged');
			}
			Util::redirect('?do=session');
		} else {
			// No action, change title to session list
			Render::setTitle(Dictionary::translate('page-title-session-list'));
		}
	}

	protected function doRender()
	{
		if (User::isLoggedIn()) {
			$res = Database::simpleQuery("SELECT u.login, s.userid, s.dateline, s.lastip, s.fixedip
					FROM session s
					INNER JOIN user u USING (userid)
					ORDER BY dateline DESC");
			$sessions = [];
			$perm = User::hasPermission('.adduser.user.*');
			foreach ($res as $row) {
				if ($perm || $row['userid'] == User::getId()) {
					$row['dateline_s'] = Util::prettyTime($row['dateline']);
					$sessions[] = $row;
				}
			}
			Render::addTemplate('change-password', ['sessions' => $sessions,
				'link' => User::hasPermission('.adduser.user.edit')]);
		} else {
			Render::addTemplate('page-login');
		}
	}

}