session.php

Go to the documentation of this file.

<?php
/*~ session.php
.---------------------------------------------------------------------------.
|  Software: Sencillo Session                                               |
|   Version: 2014.002                                                       |
|   Contact: [email protected]                                                  |
| ------------------------------------------------------------------------- |
|    Author: Bc. Peter Horváth (original founder)                           |
| Copyright (c) 2014, Bc. Peter Horváth. All Rights Reserved.               |
| ------------------------------------------------------------------------- |
|   License: Distributed under the General Public License (GPL)             |
|            http://www.gnu.org/copyleft/gpl.html                           |
| This program is distributed in the hope that it will be useful - WITHOUT  |
| ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or     |
| FITNESS FOR A PARTICULAR PURPOSE.                                         |
'---------------------------------------------------------------------------'
~*/
class sessionManager
{
    private $i;
    private $smarray;
    
    public function __construct()
    {
        session_start();
    }
    
    public function sm_get($name)
    {
        if(is_array($name))
        {
            $this->i = 0;
            $this->smarray = array();
            while(sizeof($name)>$this->i)
            {
                $this->smarray[$this->i] = $_SESSION[$name[$this->i++]];
            }
            return $this->smarray;
        }
        else
        {
            return $_SESSION[$name];
        }
    }
    
    public function sm_destroy()
    {
        session_destroy();
    }
}

class loginManager extends sessionManager
{
    private $current_time;
    private $sql;
    
    public function __construct()
    {
        $this->current_time = array('year'=>date('Y'),
                                    'month'=>date('m'),
                                    'day'=>date('d'),
                                    'hour'=>date('H'),
                                    'minute'=>date('i'),
                                    'second'=>date('s'),
                                    'session'=>date('YmdHis'));
    }
    
    public function lm_install()
    {
        $this->sql='
        CREATE TABLE IF NOT EXISTS `login` (
            `id` bigint(20) NOT NULL AUTO_INCREMENT,
            `userid` bigint(20) NOT NULL,
            `sessionid` longtext NOT NULL,
            `expiration` int(11) NOT NULL,
            `perm` int(11) NOT NULL,
            PRIMARY KEY (`id`)
        ) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=0;
        ';
        $mysql->openTable('login');
        $mysql->write($this->sql);
        $this->sql='
        CREATE TABLE IF NOT EXISTS `users` (
            `userid` bigint(20) NOT NULL AUTO_INCREMENT,
            `name` longtext NOT NULL,
            `pass` longtext NOT NULL,
            `perm` int(4) NOT NULL,
            PRIMARY KEY (`userid`)
        ) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=0;
        ';
        $mysql->openTable('users');
        $mysql->write($this->sql);
    }
    
    public function lm_addUser($name,$pass,$perm=1000)
    {
        $mysql->openTable('users');
        $mysql->insert("'name',md5('$pass'),$perm");
    }
}

$email=$_POST['email'];
$pass=md5($_POST['pass']);
$cookie1=null;
$cookie2=null;
$error=null;
$LoginExp=3600;
$perm=null;
if(isset($_POST['email']))
{
    $_SESSION['sessionid'] = session_id();
    $readsql="SELECT `userid`,`email`,`pass` FROM users WHERE email='$email'";
    $con = mysql_connect($DBHost, $DBUser, $DBPass);
    mysql_select_db($DBName, $con);

    $result = mysql_query($readsql);
    $row = mysql_fetch_array($result);

    $LoginExp=time()+$LoginExp;
    if($_POST['boxremember']==1)
    {
        $LoginExp=time()+3600*24*365*4;
        $perm=1001;
    }
    else
    {
        $perm=1000;
    }
    if(($row["pass"]==$pass)&&($row["email"]==$email))
    {
        $userid=$row["userid"];
        $error=0;
        $cookie1=USER_GEO.":".$userid.":".$_SESSION['sessionid'];
        $_SESSION['userid'] = $userid;
        $cookie2=$userid;
        $signature=md5($_SESSION['userid'].$_SESSION['sessionid']);

        $sql="DELETE FROM `login` WHERE `userid` = '$userid';";
        sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);

        $sql="INSERT INTO `login` (`id` ,`userid` ,`sessionid` ,`expiration` ,`perm`) VALUES (NULL,'$userid','$cookie1','$LoginExp','$perm');";
        sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
        $sql="INSERT INTO `console` (`id` ,`time` ,`title` ,`data`) VALUES (NULL , NOW(), 'LOGIN', 'user:$userid, ip:".USER_IP.", from:".USER_GEO_TWO.", browser:".USER_BROWSER.", perm:$perm, timeout:$LoginExp.');";
        sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
    }
    else
    {
        $userid=$row["userid"];
        if($row["pass"]!=$pass)
        {
            $error=2;
        }
        else
        {
            $error=1;
        }
    }
    mysql_close($con);
    unset($userid,$pass,$sql);
}
else
{
    $userid=$_COOKIE['uid'];
    $desissn=$_COOKIE['ulid'];
    $readsql="SELECT * FROM login WHERE userid='$userid' AND sessionid='$desissn'";
    $con = mysql_connect($DBHost, $DBUser, $DBPass);
    mysql_select_db($DBName, $con);

    $result = mysql_query($readsql);
    $userid = null;
    $ssnData = null;
    while($row = mysql_fetch_array($result))
    {
        $id=$row["id"];
        $userid=$row["userid"];
        $ssnData=$row["sessionid"];
        $LoginExp=$row["expiration"];
        $perm=$row["perm"];
    }
    $ssnData=explode(":","$ssnData");
    $desissn=explode(":","$desissn");
    $LoginCountry = $ssnData[0];
    $oldSignature = $ssnData[2];
    if(($LoginCountry==USER_GEO)&&($userid==$ssnData[1])&&(isset($oldSignature))&&($oldSignature==$desissn[2])&&(time()<$LoginExp))
    {
        if($perm==1000)
        {
            $LoginExp=time()+3600;
        }
        if($perm==1001)
        {
            $LoginExp=time()+3600*24*365*4;
        }
        $_SESSION['userid'] = $userid;
        $_SESSION['sessionid'] = $oldSignature;
        $sql="UPDATE `login` SET expiration='$LoginExp' WHERE id='$id';";
        sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
        $error=0;
        $signature=md5($_SESSION['userid'].$_SESSION['sessionid'].$desissn[0].":".$desissn[1].":".$desissn[2]);
        $cookie1=USER_GEO.":".$userid.":".$_SESSION['sessionid'];
        $cookie2=$userid;
        $sql="SELECT `userid`,`email` FROM users WHERE userid='$userid'";
        $con2=mysql_connect($DBHost, $DBUser, $DBPass);
        mysql_select_db($DBName, $con2);
        $result=mysql_query($sql);
        $row2=mysql_fetch_array($result);
        $email=$row2["email"];
        mysql_close($con2);
    }
    else
    {
        $error=3;
        session_destroy();
        $cookie1="AntiHack attention";
        $cookie2="AntiHack attention";
        $LoginExp=time()+3600;
        $sql="INSERT INTO `console` (`id` ,`time` ,`title` ,`data`) VALUES (NULL , NOW(), 'ANTIHACK_ATTENTION', 'user:$userid, ip:".USER_IP.", from:".USER_GEO_TWO.", browser:".USER_BROWSER.", action: illegal cookies signature.');";
        sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
    }
    mysql_close($con);
}
if($_GET['s']=="exit")
{
    $sql="DELETE FROM `login` WHERE `userid` = '$userid';";
    sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
    session_destroy();
    unset($signature);
    $cookie1=0;
    $cookie2=0;
    $error=NULL;
    $LoginExp=time()-7200;
    $sql="INSERT INTO `console` (`id` ,`time` ,`title` ,`data`) VALUES (NULL , NOW(), 'MANUAL_LOGOUT', 'user:$userid, browser:".USER_BROWSER."');";
    sql_freecode_ng($DBUser,$DBName,$DBPass,$DBHost,$sql);
}
unset($con,$con2,$sql,$id,$ssnData,$LoginCountry,$oldSignature,$desissn,$pass,$row,$row2,$result,$userid);
/*
 *
 *  error = 0; //system: OK - access granted
 *  error = null; //system: UNKNOWN STATUS, system continued
 *  error = 1; //system: I/O - ERROR email not exist
 *  error = 2; //system: I/O - ERROR password error
 *  error = 3; //system: DB - ERROR login structured data failed - AntiHack attention
 *
 *  Session manipulation:
 *  ?s=exit //system get status NULL and unset access signature - system go to logout mode
 *
 */
//echo("<script>alert('Country:".USER_GEO.";User:".$_SESSION['userid'].";Status:".$error.";Cookies:[".$cookie1."],[".$cookie2."];Exp:".$LoginExp.";SessionID:".$_SESSION['sessionid']."');</script>");
?>