aschwarz/survey
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Angemeldet bleiben

Browse Source
This commit is contained in:
aschwarz
2023-03-29 16:22:45 +02:00
parent a675b295e7
commit 670599777b
62 changed files with 1668 additions and 14210 deletions
Download Patch File Download Diff File Expand all files Collapse all files

120
controller/admin_login.php
View File

@ -1,12 +1,105 @@
<?php
# https://www.php-einfach.de/experte/php-codebeispiele/loginscript/angemeldet-bleiben/
require_once("../config/datenbankanbindung.php");
$db = dbconnect();
$function = $_POST['function'];
if(!isset($_SESSION)) { session_start(); }
if ($function == 'logout') {
if($_SESSION['angemeldet_bleiben'] == 1){
$identifier = $_COOKIE['identifier'];
$securitytoken = $_COOKIE['securitytoken'];
$token_neu = sha1($securitytoken);
$update = $db->query("DELETE FROM jumi_securitytokens
WHERE securitytoken ='$token_neu'
AND identifier = '$identifier'
");
}
//Cookies entfernen
session_destroy();
setcookie("identifier","",time()-(3600*24*365));
setcookie("securitytoken","",time()-(3600*24*365));
header("location:../dashboard/login.php");
}
function random_string() {
if(function_exists('random_bytes')) {
$bytes = random_bytes(16);
$str = bin2hex($bytes);
} else if(function_exists('openssl_random_pseudo_bytes')) {
$bytes = openssl_random_pseudo_bytes(16);
$str = bin2hex($bytes);
} else if(function_exists('mcrypt_create_iv')) {
$bytes = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
$str = bin2hex($bytes);
} else {
//Bitte euer_geheim_string durch einen zufälligen String mit >12 Zeichen austauschen
$str = md5(uniqid('#!af445bsvjke34vas', true));
}
return $str;
}
//Automatischer Login
#if ($function != 'login') {
if ($function == '') {
if(!isset($_SESSION['userid']) && isset($_COOKIE['identifier']) && isset($_COOKIE['securitytoken'])) {
$identifier = $_COOKIE['identifier'];
$securitytoken = $_COOKIE['securitytoken'];
$result = $db->query("SELECT * FROM jumi_securitytokens WHERE identifier ='$identifier'");
$securitytoken_row = $result->fetch_array();
## $statement = $pdo->prepare("SELECT * FROM jumi_securitytokens WHERE identifier = ?");
## $result = $statement->execute(array($identifier));
## $securitytoken_row = $statement->fetch();
if(sha1($securitytoken) !== $securitytoken_row['securitytoken']) {
# die('Ein vermutlich gestohlener Security Token wurde identifiziert');
header("location:../dashboard/login.php");
} else { //Token war korrekt
//Setze neuen Token
$neuer_securitytoken = random_string();
# $insert = $pdo->prepare("UPDATE jumi_securitytokens SET securitytoken = :securitytoken WHERE identifier = :identifier");
# $insert->execute(array('securitytoken' => sha1($neuer_securitytoken), 'identifier' => $identifier));
$token_neu = sha1($neuer_securitytoken);
$update = $db->query("UPDATE jumi_securitytokens
SET securitytoken ='$token_neu'
WHERE identifier = '$identifier'
");
setcookie("identifier",$identifier,time()+(3600*24*365)); //1 Jahr Gültigkeit
setcookie("securitytoken",$neuer_securitytoken,time()+(3600*24*365)); //1 Jahr Gültigkeit
$_SESSION['angemeldet_bleiben'] = 1;
//Logge den Benutzer ein
$_SESSION['userid'] = $securitytoken_row['uid'];
$redirect = $_SESSION['cur_page'];
if($redirect != ''){
header("location:$redirect");
}else{
header("location:../dashboard/index.php");
}
}
}else{
if(!isset($_SESSION['userid'])){
header("location:../dashboard/login.php");
}
}
}
if ($function == 'login') {
$mail=strtoupper($_POST["mail"]); //remove case sensitivity on the mail
$password=$_POST["password"];
if($_POST["mail"] != ""){
$_SESSION["global_mail"]=$mail;
}
@ -17,7 +110,6 @@ if ($function == 'login') {
}else{
$db = dbconnect();
$result = $db->query("SELECT uid, mail, passwort, aktiv FROM jumi_admin WHERE UPPER(mail)='$mail'");
$row = $result->fetch_array();
@ -28,15 +120,31 @@ if ($function == 'login') {
echo '<div class="alert alert-danger"><i class="fa fa-fw fa-thumbs-down"></i> Bitte prüfen Sie Ihre Zugangsdaten</div>|***|error';
exit;
}else{
$uid = $row['uid'];
//Möchte der Nutzer angemeldet beleiben?
if($_POST['angemeldet_bleiben'] == 1) {
$identifier = random_string();
$securitytoken = random_string();
# $insert = $pdo->prepare("INSERT INTO jumi_securitytokens (user_id, identifier, securitytoken) VALUES (:user_id, :identifier, :securitytoken)");
# $insert->execute(array('user_id' => $user['id'], 'identifier' => $identifier, 'securitytoken' => sha1($securitytoken)));
$token_neu = sha1($securitytoken);
$result_1 = $db->query("INSERT INTO jumi_securitytokens (uid, identifier, securitytoken) VALUES ('$uid', '$identifier', '$token_neu')");
setcookie("identifier",$identifier,time()+(3600*24*365)); //1 Jahr Gültigkeit
setcookie("securitytoken",$securitytoken,time()+(3600*24*365)); //1 Jahr Gültigkeit
$_SESSION['angemeldet_bleiben'] = 1;
}else{
$_SESSION['angemeldet_bleiben'] = 0;
}
$db = dbconnect();
$datum=date("Y-m-d H:i:s");
$ip=getenv("REMOTE_ADDR");
$agent=getenv("HTTP_USER_AGENT");
$user_admin = $row['uid'];
$_SESSION["global_uid"] = $user_admin;
$_SESSION['userid'] = $uid;
$_SESSION["global_mail"] = $row['mail'];
$result_1 = $db->query("INSERT INTO jumi_adminlog (Datum, IP, user_agent, uid) VALUES ('$datum', '$ip', '$agent', '$user_admin')");
$result_1 = $db->query("INSERT INTO jumi_adminlog (Datum, IP, user_agent, uid) VALUES ('$datum', '$ip', '$agent', '$uid')");
echo '<div class="alert alert-success"><i class="fa fa-fw fa-thumbs-up"></i> Login wird durchgef&uuml;hrt</div>|***|success';
}
}