phpBB.de

Code: Alles auswählen

if( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset($HTTP_POST_VARS['logout']) || isset($HTTP_GET_VARS['logout']) )
{
        if( ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) ) && !$userdata['session_logged_in'] )
        {
                $username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';
                $username = substr(str_replace("\\'", "'", $username), 0, 25);
                $username = str_replace("'", "\\'", $username);
                $password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';

                //Für externen Login
                if ($username == '') $username = urldecode($HTTP_GET_VARS['username']);
                if ($password == '') $password = urldecode($HTTP_GET_VARS['password']);

                $sql = "SELECT user_id, username, user_password, user_active, user_level
                        FROM " . USERS_TABLE . "
                        WHERE username = '" . str_replace("\\'", "''", $username) . "'";
                if ( !($result = $db->sql_query($sql)) )
                {
                        message_die(GENERAL_ERROR, 'Error in obtaining userdata', '', __LINE__, __FILE__, $sql);
                }

                if( $row = $db->sql_fetchrow($result) )
                {
                        if( $row['user_level'] != ADMIN && $board_config['board_disable'] )
                        {
                                redirect(append_sid("index.$phpEx", true));
                        }
                        else
                        {
                                //if( md5($password) == $row['user_password'] && $row['user_active'] )
                                //Für externen Login
                                if( ((md5($password) == $row['user_password']) || ($password == $row['user_password'])) && $row['user_active'] )
                                {
                                        $autologin = ( isset($HTTP_POST_VARS['autologin']) ) ? TRUE : 0;

                                        $session_id = session_begin($row['user_id'], $user_ip, PAGE_INDEX, FALSE, $autologin);

                                        if( $session_id )
                                        {
                                                $url = ( !empty($HTTP_POST_VARS['redirect']) ) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : "index.$phpEx";
                                                redirect(append_sid($url, true));
                                        }
                                        else
                                        {
                                                message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
                                        }
...

Code: Alles auswählen

if ($username == '') $username = urldecode($HTTP_GET_VARS['username']); 
if ($password == '') $password = urldecode($HTTP_GET_VARS['password']);