diff --git a/_sakura/components/Sessions.php b/_sakura/components/Sessions.php index 0798257..f10a7b3 100644 --- a/_sakura/components/Sessions.php +++ b/_sakura/components/Sessions.php @@ -38,7 +38,7 @@ class Session { 'skey' => $session, 'started' => time(), 'expire' => time() + 604800, - 'remember' => $remember + 'remember' => $remember ? '1' : '0' ]); // Return the session key @@ -86,7 +86,7 @@ class Session { return false; // Run the query - Database::delete('sessions', [($key ? 'skey' : 'id'), [$sessionId, '=']]); + Database::delete('sessions', [($key ? 'skey' : 'id') => [$sessionId, '=']]); // Return true if key was found and deleted return true; diff --git a/_sakura/components/Users.php b/_sakura/components/Users.php index 6b4b527..d6df503 100644 --- a/_sakura/components/Users.php +++ b/_sakura/components/Users.php @@ -126,7 +126,7 @@ class Users { return false; // Remove the active session from the database - if(!Session::deleteSession($id, true)) + if(!Session::deleteSession(Session::$sessionId, true)) return false; // Set cookies diff --git a/_sakura/sakura.php b/_sakura/sakura.php index 7a5b02a..70ba4ae 100644 --- a/_sakura/sakura.php +++ b/_sakura/sakura.php @@ -54,7 +54,7 @@ $renderData = array( 'version' => SAKURA_VERSION, 'urls' => Configuration::getLocalConfig('urls'), 'charset' => Configuration::getConfig('charset'), - 'currentpage' => $_SERVER['PHP_SELF'], + 'currentpage' => '//'. $_SERVER['SERVER_NAME'] . $_SERVER['PHP_SELF'], 'recaptcha_public' => Configuration::getConfig('recaptcha_public'), 'resources' => '//'. Configuration::getLocalConfig('urls')['content'] .'/data/'. strtolower(Templates::$_TPL) ], diff --git a/_sakura/templates/yuuno/global/header.tpl b/_sakura/templates/yuuno/global/header.tpl index d784648..064d67d 100644 --- a/_sakura/templates/yuuno/global/header.tpl +++ b/_sakura/templates/yuuno/global/header.tpl @@ -55,8 +55,12 @@
Open Menu diff --git a/main/.htaccess b/main/.htaccess index e29b25d..5f41034 100644 --- a/main/.htaccess +++ b/main/.htaccess @@ -17,7 +17,7 @@ Options +FollowSymLinks -Indexes RewriteRule ^feedback?/?$ http://forum.flash.moe/viewforum.php?f=22 RewriteRule ^credits?/?$ credits.php RewriteRule ^index?/?$ index.php -RewriteRule ^login?/?$|register?/?$|forgotpassword?/?|authenticate?/?$ authenticate.php +RewriteRule ^login?/?$|logout?/?$|register?/?$|forgotpassword?/?|authenticate?/?$ authenticate.php RewriteRule ^donate?/?$ donate.php RewriteRule ^contact?/?$ contact.php diff --git a/main/authenticate.php b/main/authenticate.php index e8ac7a0..aeb2a01 100644 --- a/main/authenticate.php +++ b/main/authenticate.php @@ -16,56 +16,103 @@ if( isset($_REQUEST['session']) ) { - switch($_REQUEST['mode']) { + // Continue + $continue = true; - // Login processing - case 'login': + // Compare time and session so we know the link isn't forged + if($_REQUEST['time'] < time() - 1000) { - // Attempt login - $login = Users::login($_REQUEST['username'], $_REQUEST['password'], isset($_REQUEST['remember'])); + $renderData['page'] = [ + 'title' => 'Action failed', + 'redirect' => '/authenticate', + 'message' => 'Timestamps differ too much, please try again.' + ]; - // Array containing "human understandable" messages - $messages = [ - 'USER_NOT_EXIST' => 'The user you tried to log into does not exist.', - 'INCORRECT_PASSWORD' => 'The password you entered was invalid.', - 'DEACTIVATED' => 'Your account is deactivated.', - 'LEGACY_SUCCESS' => 'Login successful! Taking you to the password changing page...', - 'LOGIN_SUCESS' => 'Login successful!' - ]; + // Prevent + $continue = false; - // Add page specific things - $renderData['page'] = [ - 'title' => 'Login', - 'redirect' => ($login[0] ? $_REQUEST['redirect'] : '/authenticate'), - 'message' => $messages[$login[1]] - ]; + } - break; + // Match session ids for the same reason + if($_REQUEST['session'] != session_id()) { - // Registration processing - case 'register': + $renderData['page'] = [ + 'title' => 'Action failed', + 'redirect' => '/authenticate', + 'message' => 'Session IDs do not match.' + ]; - // Add page specific things - $renderData['page'] = [ - 'title' => 'Register on Flashii', - 'redirect' => $_SERVER['PHP_SELF'], - 'message' => 'what' - ]; + // Prevent + $continue = false; - break; + } - // Unforgetting passwords - case 'forgotpassword': + if($continue) { + switch($_REQUEST['mode']) { - // Add page specific things - $renderData['page'] = [ - 'title' => 'Forgot Password', - 'redirect' => $_SERVER['PHP_SELF'], - 'message' => 'what' - ]; + case 'logout': - break; + // Attempt logout + $logout = Users::logout(); + // Add page specific data + $renderData['page'] = [ + 'title' => 'Logout', + 'redirect' => ($logout ? $_REQUEST['redirect'] : '/authenticate'), + 'message' => $logout ? 'You are now logged out.' : 'Logout failed.' + ]; + + break; + + // Login processing + case 'login': + + // Attempt login + $login = Users::login($_REQUEST['username'], $_REQUEST['password'], isset($_REQUEST['remember'])); + + // Array containing "human understandable" messages + $messages = [ + 'USER_NOT_EXIST' => 'The user you tried to log into does not exist.', + 'INCORRECT_PASSWORD' => 'The password you entered was invalid.', + 'DEACTIVATED' => 'Your account is deactivated.', + 'LEGACY_SUCCESS' => 'Login successful! Taking you to the password changing page...', + 'LOGIN_SUCESS' => 'Login successful!' + ]; + + // Add page specific things + $renderData['page'] = [ + 'title' => 'Login', + 'redirect' => ($login[0] ? $_REQUEST['redirect'] : '/authenticate'), + 'message' => $messages[$login[1]] + ]; + + break; + + // Registration processing + case 'register': + + // Add page specific things + $renderData['page'] = [ + 'title' => 'Register on Flashii', + 'redirect' => $_SERVER['PHP_SELF'], + 'message' => 'what' + ]; + + break; + + // Unforgetting passwords + case 'forgotpassword': + + // Add page specific things + $renderData['page'] = [ + 'title' => 'Forgot Password', + 'redirect' => $_SERVER['PHP_SELF'], + 'message' => 'what' + ]; + + break; + + } } // Print page contents or if the AJAX request is set only display the render data