\n";
print " \n";
print " | | \n";
print "
\n";
print " \n";
print " | ".__("Username").": | \n";
print " ".$U." | \n";
print "
\n";
print " \n";
print " | ".__("Account Type").": | \n";
print " ";
if ($T == "User") {
print __("User");
} elseif ($T == "Trusted User") {
print __("Trusted User");
} elseif ($T == "Developer") {
print __("Developer");
}
print " | \n";
print "
\n";
print " \n";
print " | ".__("Email Address").": | \n";
print " ".htmlspecialchars($E,ENT_QUOTES)." | \n";
print "
\n";
print " \n";
print " | ".__("Real Name").": | \n";
print " ".htmlspecialchars($R,ENT_QUOTES)." | \n";
print "
\n";
print " \n";
print " | ".__("IRC Nick").": | \n";
print " ".htmlspecialchars($I,ENT_QUOTES)." | \n";
print "
\n";
print " \n";
print " | ".__("PGP Key Fingerprint").": | \n";
print " ".html_format_pgp_fingerprint($K)." | \n";
print "
\n";
print " \n";
print " | ".__("Last Voted").": | \n";
print " ";
print $LV ? date("Y-m-d", $LV) : __("Never");
print " | \n";
print "
\n";
print " \n";
print " | ".__("View this user's packages")." | \n";
print "
\n";
print "
\n";
return;
}
/*
* Returns SID (Session ID) and error (error message) in an array
* SID of 0 means login failed.
*/
function try_login() {
global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT;
$login_error = "";
$new_sid = "";
$userID = null;
if ( isset($_REQUEST['user']) || isset($_REQUEST['passwd']) ) {
$dbh = db_connect();
$userID = valid_user($_REQUEST['user'], $dbh);
if ( user_suspended($userID, $dbh) ) {
$login_error = "Account Suspended.";
}
elseif ( $userID && isset($_REQUEST['passwd'])
&& valid_passwd($userID, $_REQUEST['passwd'], $dbh) ) {
$logged_in = 0;
$num_tries = 0;
# Account looks good. Generate a SID and store it.
while (!$logged_in && $num_tries < 5) {
if ($MAX_SESSIONS_PER_USER) {
# Delete all user sessions except the
# last ($MAX_SESSIONS_PER_USER - 1).
$q = "DELETE s.* FROM Sessions s ";
$q.= "LEFT JOIN (SELECT SessionID FROM Sessions ";
$q.= "WHERE UsersId = " . $userID . " ";
$q.= "ORDER BY LastUpdateTS DESC ";
$q.= "LIMIT " . ($MAX_SESSIONS_PER_USER - 1) . ") q ";
$q.= "ON s.SessionID = q.SessionID ";
$q.= "WHERE s.UsersId = " . $userID . " ";
$q.= "AND q.SessionID IS NULL;";
db_query($q, $dbh);
}
$new_sid = new_sid();
$q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)"
." VALUES (" . $userID . ", '" . $new_sid . "', UNIX_TIMESTAMP())";
$result = db_query($q, $dbh);
# Query will fail if $new_sid is not unique
if ($result) {
$logged_in = 1;
break;
}
$num_tries++;
}
if ($logged_in) {
$q = "UPDATE Users SET LastLogin = UNIX_TIMESTAMP() ";
$q.= "WHERE ID = '$userID'";
db_query($q, $dbh);
# set our SID cookie
if (isset($_POST['remember_me']) &&
$_POST['remember_me'] == "on") {
# Set cookies for 30 days.
$cookie_time = time() + $PERSISTENT_COOKIE_TIMEOUT;
# Set session for 30 days.
$q = "UPDATE Sessions SET LastUpdateTS = $cookie_time ";
$q.= "WHERE SessionID = '$new_sid'";
db_query($q, $dbh);
}
else
$cookie_time = 0;
setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true);
header("Location: " . $_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING']);
$login_error = "";
}
else {
$login_error = "Error trying to generate session id.";
}
}
else {
$login_error = __("Bad username or password.");
}
}
return array('SID' => $new_sid, 'error' => $login_error);
}
/*
* Only checks if the name itself is valid
* Longer or equal to USERNAME_MIN_LEN
* Shorter or equal to USERNAME_MAX_LEN
* Starts and ends with a letter or number
* Contains at most ONE dot, hyphen, or underscore
* Returns the username if it is valid
* Returns nothing if it isn't valid
*/
function valid_username($user) {
if (!empty($user)) {
#Is username at not too short or too long?
if ( strlen($user) >= USERNAME_MIN_LEN &&
strlen($user) <= USERNAME_MAX_LEN ) {
$user = strtolower($user);
# Does username:
# start and end with a letter or number
# contain only letters and numbers,
# and at most has one dash, period, or underscore
if ( preg_match("/^[a-z0-9]+[.\-_]?[a-z0-9]+$/", $user) ) {
#All is good return the username
return $user;
}
}
}
return;
}
/*
* Checks if the username is valid and if it exists in the database
* Returns the username ID or nothing
*/
function valid_user($user, $dbh=NULL) {
/* if ( $user = valid_username($user) ) { */
if(!$dbh) {
$dbh = db_connect();
}
if ( $user ) {
$q = "SELECT ID FROM Users WHERE Username = '"
. db_escape_string($user). "'";
$result = db_query($q, $dbh);
# Is the username in the database?
if ($result) {
$row = mysql_fetch_row($result);
return $row[0];
}
}
return;
}
# Check for any open proposals about a user. Used to prevent multiple proposals.
function open_user_proposals($user, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "SELECT * FROM TU_VoteInfo WHERE User = '" . db_escape_string($user) . "'";
$q.= " AND End > UNIX_TIMESTAMP()";
$result = db_query($q, $dbh);
if (mysql_num_rows($result)) {
return true;
}
else {
return false;
}
}
# Creates a new trusted user proposal from entered agenda.
# Optionally takes proposal about specific user. Length of vote set by submitter.
function add_tu_proposal($agenda, $user, $votelength, $submitteruid, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "INSERT INTO TU_VoteInfo (Agenda, User, Submitted, End, SubmitterID) VALUES ";
$q.= "('" . db_escape_string($agenda) . "', ";
$q.= "'" . db_escape_string($user) . "', ";
$q.= "UNIX_TIMESTAMP(), UNIX_TIMESTAMP() + " . db_escape_string($votelength);
$q.= ", " . $submitteruid . ")";
db_query($q, $dbh);
}
# Add a reset key for a specific user
function create_resetkey($resetkey, $uid, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "UPDATE Users ";
$q.= "SET ResetKey = '" . $resetkey . "' ";
$q.= "WHERE ID = " . $uid;
db_query($q, $dbh);
}
# Change a password and save the salt only if reset key and email are correct
function password_reset($hash, $salt, $resetkey, $email, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "UPDATE Users ";
$q.= "SET Passwd = '$hash', ";
$q.= "Salt = '$salt', ";
$q.= "ResetKey = '' ";
$q.= "WHERE ResetKey != '' ";
$q.= "AND ResetKey = '".db_escape_string($resetkey)."' ";
$q.= "AND Email = '".db_escape_string($email)."'";
$result = db_query($q, $dbh);
if (!mysql_affected_rows($dbh)) {
$error = __('Invalid e-mail and reset key combination.');
return $error;
} else {
header('Location: passreset.php?step=complete');
exit();
}
}
function good_passwd($passwd) {
if ( strlen($passwd) >= PASSWD_MIN_LEN ) {
return true;
}
return false;
}
/* Verifies that the password is correct for the userID specified.
* Returns true or false
*/
function valid_passwd($userID, $passwd, $dbh) {
if ( strlen($passwd) > 0 ) {
# get salt for this user
$salt = get_salt($userID);
if ($salt) {
# use salt
$passwd_q = "SELECT ID FROM Users" .
" WHERE ID = " . $userID . " AND Passwd = '" .
salted_hash($passwd, $salt) . "'";
$result = db_query($passwd_q, $dbh);
if ($result) {
$passwd_result = mysql_fetch_row($result);
if ($passwd_result[0]) {
return true;
}
}
} else {
# check without salt
$nosalt_q = "SELECT ID FROM Users".
" WHERE ID = " . $userID .
" AND Passwd = '" . md5($passwd) . "'";
$result = db_query($nosalt_q, $dbh);
if ($result) {
$nosalt_row = mysql_fetch_row($result);
if ($nosalt_row[0]) {
# password correct, but salt it first
if (!save_salt($userID, $passwd)) {
trigger_error("Unable to salt user's password;" .
" ID " . $userID, E_USER_WARNING);
return false;
}
return true;
}
}
}
}
return false;
}
/*
* Checks if the PGP key fingerprint is valid (must be 40 hexadecimal digits).
*/
function valid_pgp_fingerprint($fingerprint) {
$fingerprint = str_replace(" ", "", $fingerprint);
return (strlen($fingerprint) == 40 && ctype_xdigit($fingerprint));
}
/*
* Is the user account suspended?
*/
function user_suspended($id, $dbh) {
if (!$id) {
return false;
}
$q = "SELECT Suspended FROM Users WHERE ID = " . $id;
$result = db_query($q, $dbh);
if ($result) {
$row = mysql_fetch_row($result);
if ($result[0] == 1 ) {
return true;
}
}
return false;
}
/*
* This should be expanded to return something
*/
function user_delete($id, $dbh) {
$q = "DELETE FROM Users WHERE ID = " . $id;
db_query($q, $dbh);
return;
}
/*
* A different way of determining a user's privileges
* rather than account_from_sid()
*/
function user_is_privileged($id, $dbh) {
$q = "SELECT AccountTypeID FROM Users WHERE ID = " . $id;
$result = db_query($q, $dbh);
if ($result) {
$row = mysql_fetch_row($result);
if( $result[0] > 1) {
return $result[0];
}
}
return 0;
}
# Remove session on logout
function delete_session_id($sid, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "DELETE FROM Sessions WHERE SessionID = '";
$q.= db_escape_string($sid) . "'";
db_query($q, $dbh);
}
# Clear out old expired sessions.
function clear_expired_sessions($dbh=NULL) {
global $LOGIN_TIMEOUT;
if(!$dbh) {
$dbh = db_connect();
}
$q = "DELETE FROM Sessions WHERE LastUpdateTS < (UNIX_TIMESTAMP() - $LOGIN_TIMEOUT)";
db_query($q, $dbh);
return;
}
function account_details($uid, $username, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "SELECT Users.*, AccountTypes.AccountType ";
$q.= "FROM Users, AccountTypes ";
$q.= "WHERE AccountTypes.ID = Users.AccountTypeID ";
if (!empty($uid)) {
$q.= "AND Users.ID = ".intval($uid);
} else {
$q.= "AND Users.Username = '".db_escape_string($username) . "'";
}
$result = db_query($q, $dbh);
if ($result) {
$row = mysql_fetch_assoc($result);
}
return $row;
}
function own_account_details($sid, $dbh=NULL) {
if(!$dbh) {
$dbh = db_connect();
}
$q = "SELECT Users.*, AccountTypes.AccountType ";
$q.= "FROM Users, AccountTypes, Sessions ";
$q.= "WHERE AccountTypes.ID = Users.AccountTypeID ";
$q.= "AND Users.ID = Sessions.UsersID ";
$q.= "AND Sessions.SessionID = '";
$q.= db_escape_string($sid)."'";
$result = db_query($q, $dbh);
if ($result) {
$row = mysql_fetch_assoc($result);
}
return $row;
}