Fix bug 451: Auto login does not work properly

svn merge r1492:1493 from trunk
svn merge r1510:1511 from trunk
svn merge r1521:1522 from trunk
svn merge r1523:1524 from trunk
svn merge r1525:1526 from trunk
auto_login key add to users table:
- add update script
- update upgrade_1.5.0.php script

(related to svn:1553)


git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1554 68402e56-0260-453c-a942-63ccdbb3a9ee

identification.php

@@ -63,7 +63,7 @@ SELECT '.$conf['user_fields']['id'].' AS id,
     {
       $remember_me = true;
     }
-    log_user( $row['id'], $remember_me);
+    log_user($row['id'], $remember_me);
     redirect(empty($redirect_to) ? make_index_url() : $redirect_to);
   }
   else
@@ -71,6 +71,10 @@ SELECT '.$conf['user_fields']['id'].' AS id,
     array_push( $errors, $lang['invalid_pwd'] );
   }
 }
+elseif (!empty($_COOKIE[$conf['remember_me_name']]))
+{
+  auto_login();
+}
 //----------------------------------------------------- template initialization
 //
 // Start output of page

include/config_default.inc.php

@@ -318,13 +318,13 @@ $conf['session_save_handler'] = 'db';
 // creates a cookie on client side.
 $conf['authorize_remembering'] = true;
 
+// remember_me_name: specifies the name of the cookie used to stay logged
+$conf['remember_me_name'] = 'pwg_remember';
+
 // remember_me_length : time of validity for "remember me" cookies, in
 // seconds.
 $conf['remember_me_length'] = 31536000;
 
-// session_length : time of validity for normal session, in seconds.
-$conf['session_length'] = 3600;
-
 // +-----------------------------------------------------------------------+
 // |                                debug                                  |
 // +-----------------------------------------------------------------------+

include/functions_session.inc.php

@@ -71,11 +71,8 @@ if (isset($conf['session_save_handler'])
     ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
     ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
   }
-  session_name( $conf['session_name'] );
-  session_set_cookie_params(
-      ini_get('session.cookie_lifetime'),
-      cookie_path()
-    );
+  session_name($conf['session_name']);
+  session_set_cookie_params(0, cookie_path());
 }
 
 // cookie_path returns the path to use for the PhpWebGallery cookie.

include/functions_user.inc.php

@@ -550,15 +550,69 @@ function get_language_filepath($filename)
 */
 function log_user($user_id, $remember_me)
 {
-  global $conf;
-  $session_length = $conf['session_length'];
+  global $conf, $user;
+
   if ($remember_me)
   {
-    $session_length = $conf['remember_me_length'];
+    // search for an existing auto_login_key
+    $query = '
+SELECT auto_login_key 
+  FROM '.USERS_TABLE.'
+  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
+;';
+ 
+    $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
+    if (empty($auto_login_key)) 
+    {
+      $auto_login_key = base64_encode(md5(uniqid(rand(), true)));
+      $query = '
+UPDATE '.USERS_TABLE.'
+  SET auto_login_key=\''.$auto_login_key.'\'
+  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
+;';
+      pwg_query($query);
+    }
+    $cookie = array('id' => $user_id, 'key' => $auto_login_key);
+    setcookie($conf['remember_me_name'],
+	      serialize($cookie), 
+	      time()+$conf['remember_me_length'],
+	      cookie_path()
+	      );
   }
-  session_set_cookie_params($session_length);
   session_start();
   $_SESSION['pwg_uid'] = $user_id;
+
+  $user['id'] = $_SESSION['pwg_uid'];
+  $user['is_the_guest'] = false;
+}
+
+/*
+ * Performs auto-connexion when cookie remember_me exists
+ * @return void
+*/
+function auto_login() { 
+  global $conf;
+
+  // must remove slash added in include/common.inc.php
+  $cookie = unserialize(stripslashes($_COOKIE[$conf['remember_me_name']]));
+
+  $query = '
+SELECT auto_login_key
+  FROM '.USERS_TABLE.'
+  WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].'
+;';
+
+  $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
+  if ($auto_login_key == $cookie['key'])
+  {
+    log_user($cookie['id'], false);
+    redirect(make_index_url());
+  }
+  else
+  {
+    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    redirect(make_index_url());
+  } 
 }
 
 /*

include/menubar.inc.php

@@ -44,7 +44,7 @@ $template->assign_vars(
     'U_HOME' => make_index_url(),
     'U_REGISTER' => get_root_url().'register.php',
     'U_LOST_PASSWORD' => get_root_url().'password.php',
-    'U_LOGOUT' => add_url_params(make_index_url(), array('act'=>'logout') ),
+    'U_LOGOUT' => get_root_url().'?act=logout',
     'U_ADMIN'=> get_root_url().'admin.php',
     'U_PROFILE'=> get_root_url().'profile.php',
     )

include/user.inc.php

@@ -25,26 +25,52 @@
 // | USA.                                                                  |
 // +-----------------------------------------------------------------------+
 
-// retrieving connected user informations
 if (isset($_COOKIE[session_name()])) 
 {
- session_start();
- if (isset($_SESSION['pwg_uid']))
- {
-   $user['id'] = $_SESSION['pwg_uid'];
-   $user['is_the_guest'] = false;
- }
- else 
- {
-   // session timeout
-   $user['id'] = $conf['guest_id'];
-   $user['is_the_guest'] = true;
- }
-} 
-else 
+  session_start();
+  if (isset($_GET['act']) and $_GET['act'] == 'logout')
+  {
+    // logout
+    $_SESSION = array();
+    session_unset();
+    session_destroy();
+    setcookie(session_name(),'',0,
+	      ini_get('session.cookie_path'), 
+	      ini_get('session.cookie_domain') 
+	      );
+    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    redirect(make_index_url());
+  } 
+  elseif (empty($_SESSION['pwg_uid'])) 
+  {
+    // timeout
+    setcookie(session_name(),'',0,
+	      ini_get('session.cookie_path'), 
+	      ini_get('session.cookie_domain') 
+	      );
+  }
+  else
+  {
+    $user['id'] = $_SESSION['pwg_uid'];
+    $user['is_the_guest'] = false;
+  }
+}
+elseif (!empty($_COOKIE[$conf['remember_me_name']]))
 {
- $user['id'] = $conf['guest_id'];
- $user['is_the_guest'] = true;
+  auto_login();
+} 
+else
+{
+  $user['id'] = $conf['guest_id'];
+  $user['is_the_guest'] = true;
+}
+
+if ($user['is_the_guest'] and !$conf['guest_access'] 
+    and (basename($_SERVER['PHP_SELF'])!='identification.php')
+    and (basename($_SERVER['PHP_SELF'])!='password.php')
+    and (basename($_SERVER['PHP_SELF'])!='register.php'))
+{
+  redirect (get_root_url().'identification.php');
 }
 
 // using Apache authentication override the above user search
@@ -58,6 +84,7 @@ if ($conf['apache_authentication'] and isset($_SERVER['REMOTE_USER']))
   
   $user['is_the_guest'] = false;
 }
+
 $user = array_merge(
   $user,
   getuserdata(

install/db/22.7-database.php

@@ -0,0 +1,47 @@
+<?php
+// +-----------------------------------------------------------------------+
+// | PhpWebGallery - a PHP based picture gallery                           |
+// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
+// | Copyright (C) 2003-2006 PhpWebGallery Team - http://phpwebgallery.net |
+// +-----------------------------------------------------------------------+
+// | branch        : BSF (Best So Far)
+// | file          : $RCSfile$
+// | last update   : $Date: 2006-07-23 14:17:00 +0200 (dim, 23 jui 2006) $
+// | last modifier : $Author: nikrou $
+// | revision      : $Revision: 1492 $
+// +-----------------------------------------------------------------------+
+// | This program is free software; you can redistribute it and/or modify  |
+// | it under the terms of the GNU General Public License as published by  |
+// | the Free Software Foundation                                          |
+// |                                                                       |
+// | This program is distributed in the hope that it will be useful, but   |
+// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
+// | General Public License for more details.                              |
+// |                                                                       |
+// | You should have received a copy of the GNU General Public License     |
+// | along with this program; if not, write to the Free Software           |
+// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
+// | USA.                                                                  |
+// +-----------------------------------------------------------------------+
+
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+$upgrade_description = 'add an auto login key in users table';
+
+// add column auto_login_key
+$query = '
+ALTER TABLE '.PREFIX_TABLE.'users
+  ADD auto_login_key varchar(64) NOT NULL
+;';
+pwg_query($query);
+
+echo
+"\n"
+. $upgrade_description
+."\n"
+;
+?>

install/phpwebgallery_structure.sql

@@ -1,4 +1,4 @@
--- MySQL dump 9.11
+1-- MySQL dump 9.11
 --
 -- Host: localhost    Database: pwg-1_6
 -- ------------------------------------------------------
@@ -345,6 +345,7 @@ CREATE TABLE `phpwebgallery_users` (
   `username` varchar(100) binary NOT NULL default '',
   `password` varchar(32) default NULL,
   `mail_address` varchar(255) default NULL,
+  `auto_login_key` varchar(64) default NULL,
   PRIMARY KEY  (`id`),
   UNIQUE KEY `users_ui1` (`username`)
 ) TYPE=MyISAM;

install/upgrade_1.5.0.php

@@ -468,4 +468,9 @@ ALTER TABLE '.PREFIX_TABLE.'users
   }
 }
 
+$query = '
+ALTER TABLE '.PREFIX_TABLE.'users
+  ADD auto_login_key varchar(64) NOT NULL
+;';
+pwg_query($query);
 ?>