#
#
#
# The login form needs to be named "login" and have four input fields:
#
#
#
#
#
#
# where the value of login_chal is any random string.
#
#
# The form also requires the following Javascript, which md5's the
# password before posting the form (so the password is never sent
# in plaintext across the net:
#
#
#
#
#
# The md5.js file is included at the bottom of this file.
#
# The submit button should be as follows:
#
#
#
#
# All of the above can be ignored if you don't care about sending the password
# in plain text. In this case, change the code in the CheckAuth() method to
# check things correctly.
#
# Oh yeah, this also assumes your passwords are stored MD5 encrypted (since doing
# MD5 in Javascript was easier than doing unix crypting). Change CheckAuth() if
# this isn't the case.
#
class Authentication {
#
# DEFINITIONS
#
var $AUTH_lifetime = 3600;
var $AUTH_secret = 'SeCrEt'
var $AUTH_table = 'users';
var $AUTH_user_field = 'user';
var $AUTH_pass_field = 'pass';
var $AUTH_access_field = 'access';
var $AUTH_in = false;
var $AUTH_has_access = false;
var $AUTH_login_form = 'http://www.yoursite.com/login.php';
var $AUTH_denied_file = 'http://www.yoursite.com/denied.php';
var $AUTH_ACCESS_LEVELS = array(
'none' => 0,
'user' => 1,
'staff' => 2,
'admin' => 3
);
var $AUTH_denied_file = 'auth_denied.php';
var $U = '';
var $I = array();
var $EXP = 0;
var $POSTED_VARS = false;
#
# FUNCTIONS
#
function Authentication() {
}
function savePostVars() {
global $HTTP_POST_VARS;
if (!$this->POSTED_VARS) {
if (is_array($HTTP_POST_VARS)) {
$this->POSTED_VARS = $HTTP_POST_VARS;
} else {
$this->POSTED_VARS = false;
}
}
}
function loadPostVars() {
global $HTTP_POST_VARS;
if (is_array($this->POSTED_VARS)) {
foreach($this->POSTED_VARS as $k=>$v) {
$HTTP_POST_VARS[$k] = $v;
$GLOBALS[$k] = $v;
}
$this->POSTED_VARS = false;
}
}
function doAuth($level='user') {
global $HTTP_POST_VARS, $REQUEST_URI, $SCRIPT_NAME;
$level = strtolower($level);
if (!isset($this->AUTH_ACCESS_LEVELS[$level])) {
die("Invalid access level: ".$level."\n");
exit;
}
$access = $this->AUTH_ACCESS_LEVELS[$level];
$N = time();
if (isset($HTTP_POST_VARS['login_user'])) {
$temp = $this->checkAuth();
if ($temp) {
if ($this->I->{$this->AUTH_access_field} >= $access) {
$this->AUTH_in = true;
$this->U = $temp;
} else {
$this->AUTH_in = false;
$this->savePostVars();
Goto($this->AUTH_login_form .
"?url=" . urlencode($REQUEST_URI) .
"&login_user=" . urlencode($HTTP_POST_VARS["login_user"]) .
"&err=1&na=1"
);
exit;
}
} else {
$this->AUTH_in = false;
$this->savePostVars();
Goto($this->AUTH_login_form .
"?url=" . urlencode($REQUEST_URI) .
"&login_user=" . urlencode($HTTP_POST_VARS["login_user"]) .
"&err=1"
);
exit;
}
} else if ($this->U) {
if ($this->EXP < $N ) {
$this->AUTH_in = false;
$this->savePostVars();
Goto($this->AUTH_login_form .
"?exp=" . ($N - ($this->EXP) + $this->AUTH_lifetime ).
"&login_user=" . urlencode($this->U) .
"&url=" . urlencode($REQUEST_URI)
);
exit;
} else {
if ($this->I->{$this->AUTH_access_field} < $access) {
logit(sprintf("User %s (access: %s) attempted unauthorized access to %s",
$this->U, $this->I->access_level, $SCRIPT_NAME )
);
include($this->AUTH_denied_file);
exit;
}
}
} else {
$this->AUTH_in = false;
$this->savePostVars();
Goto($this->AUTH_login_form .
"?url=" . urlencode($REQUEST_URI)
);
exit();
}
$this->EXP = $N + $this->AUTH_lifetime;
$this->loadPostVars();
}
function checkAuth() {
global $HTTP_POST_VARS;
$luser = $HTTP_POST_VARS['login_user'];
$lpass = $HTTP_POST_VARS['login_pass'];
$lhash = $HTTP_POST_VARS['login_hash'];
$lchal = $HTTP_POST_VARS['login_chal'];
$query = sprintf("SELECT * FROM %s WHERE %s='%s'",
$this->AUTH_table,
$this->AUTH_user_field,
$luser
);
$q = new DB($query);
if ( $q->num_rows() != 1 ) {
return false;
}
$q->getRecord();
if ($lhash) {
$guess = md5( $luser . $q->f($this->AUTH_pass_field) . $lchal );
if ($guess != $lhash) {
return false;
}
} else {
$guess = md5($lpass);
if ($guess != $q->f($this->AUTH_pass_field) ) {
return false;
}
}
# pull out other data from database
$this->I = $q->R;
$this->I->full_name = $q->f('first_name') . ' ' . $q->f('last_name');
$this->I->formal_name = $q->f('last_name') . ', ' . $q->f('first_name');
$this->I->access_level = $this->getAccessLevel();
$q->freeResult();
return $luser;
}
function getAccessLevel($level=false) {
if (!$level) {
$level = $this->I->access;
}
$temp = array_flip($this->AUTH_ACCESS_LEVELS);
if (isset($temp[$level])) {
return $temp[$level];
}
return false;
}
}
?>