1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
<?php
class Page_Session extends Page
{
protected function doPreprocess()
{
User::load();
$action = Request::post('action');
if ($action === 'login') {
// Login - see if already logged in
if (User::isLoggedIn()) // and then just redirect
Util::redirect('?do=main');
// Else, try to log in
if (User::login(Request::post('user'),
Request::post('pass'),
Request::post('fixedip', false, 'bool'))) {
Util::redirect('?do=main');
}
// Login credentials wrong - delay and show error message
sleep(1);
Message::addError('loginfail');
} elseif ($action === 'logout') {
// Log user out (or do nothing if not logged in)
User::logout();
} elseif ($action === 'changepw') {
if (!User::isLoggedIn()) {
Util::redirect('?do=main');
}
// Now check if the user supplied the corrent current password, and the new password twice
$old = Request::post('old', false, 'string');
$new = Request::post('newpass1', false, 'string');
if ($old === false || $new === false) {
Message::addError('main.empty-field');
Util::redirect('?do=session');
}
if (!User::testPassword(User::getId(), $old)) {
sleep(1);
Message::addError('wrong-password');
Util::redirect('?do=session');
}
if (strlen($new) < 4) {
Message::addError('pass-too-short');
Util::redirect('?do=session');
}
if ($new !== Request::post('newpass2', false, 'string')) {
Message::addError('adduser.password-mismatch');
Util::redirect('?do=session');
}
if (Request::post('kill-other-sessions', false, 'bool')) {
Session::deleteAllButCurrent();
}
if (User::updatePassword($new)) {
Message::addSuccess('password-changed');
} else {
Message::addWarning('password-unchanged');
}
Util::redirect('?do=session');
} else {
// No action, change title to session list
Render::setTitle(Dictionary::translate('page-title-session-list'));
}
}
protected function doRender()
{
if (User::isLoggedIn()) {
$res = Database::simpleQuery("SELECT u.login, s.userid, s.dateline, s.lastip, s.fixedip
FROM session s
INNER JOIN user u USING (userid)
ORDER BY dateline DESC");
$sessions = [];
$perm = User::hasPermission('.adduser.user.*');
foreach ($res as $row) {
if ($perm || $row['userid'] == User::getId()) {
$row['dateline_s'] = Util::prettyTime($row['dateline']);
$sessions[] = $row;
}
}
Render::addTemplate('change-password', ['sessions' => $sessions,
'link' => User::hasPermission('.adduser.user.edit')]);
} else {
Render::addTemplate('page-login');
}
}
}
|
