Code: Alles auswählen
if( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset($HTTP_POST_VARS['logout']) || isset($HTTP_GET_VARS['logout']) )
{
if( ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) ) && !$userdata['session_logged_in'] )
{
$username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';
$username = substr(str_replace("\\'", "'", $username), 0, 25);
$username = str_replace("'", "\\'", $username);
$password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';
//Für externen Login
if ($username == '') $username = urldecode($HTTP_GET_VARS['username']);
if ($password == '') $password = urldecode($HTTP_GET_VARS['password']);
$sql = "SELECT user_id, username, user_password, user_active, user_level
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\\'", "''", $username) . "'";
if ( !($result = $db->sql_query($sql)) )
{
message_die(GENERAL_ERROR, 'Error in obtaining userdata', '', __LINE__, __FILE__, $sql);
}
if( $row = $db->sql_fetchrow($result) )
{
if( $row['user_level'] != ADMIN && $board_config['board_disable'] )
{
redirect(append_sid("index.$phpEx", true));
}
else
{
//if( md5($password) == $row['user_password'] && $row['user_active'] )
//Für externen Login
if( ((md5($password) == $row['user_password']) || ($password == $row['user_password'])) && $row['user_active'] )
{
$autologin = ( isset($HTTP_POST_VARS['autologin']) ) ? TRUE : 0;
$session_id = session_begin($row['user_id'], $user_ip, PAGE_INDEX, FALSE, $autologin);
if( $session_id )
{
$url = ( !empty($HTTP_POST_VARS['redirect']) ) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : "index.$phpEx";
redirect(append_sid($url, true));
}
else
{
message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
}
...
http://www.acardi.de/test/content/inde ... me_x=TRUE
einloggen mit:
username: oliverh
passwort: pwolli00
dann bitte nur den link community anklicken...
es sollte doch eigentlich nun nicht mehr der login-button zu sehen sein, sondern mein user-name müsste erscheinen, oder ?
btw:
was macht eigentlich folgender code???
Code: Alles auswählen
if ($username == '') $username = urldecode($HTTP_GET_VARS['username']);
if ($password == '') $password = urldecode($HTTP_GET_VARS['password']);
)