define( "TITLE", "Accedi a Mystic Land" ); //Title for the login page.
define( "EXPIRE", 14400 ); //Seconds until the cookie expires.
$bg_color = '#000000';
$text_color = '#00CC33';
$link_color = 'red';
$vlink_color = 'darkred';
$alink_color = 'yellow';
function DisplayLoginForm ($err_string) {
require('htmldoc.inc');
global $THIS_URL;
global $bg_color;
global $text_color;
global $link_color;
global $vlink_color;
global $alink_color;
$html = new htmldoc();
$html->printheader( $bg_color, $text_color, $link_color, $vlink_color, $alink_color, TITLE );
?>
<CENTER>
<FORM NAME=login ACTION=<? echo $THIS_URL ?> METHOD=post>
<TABLE BORDER=0>
<tr align='center'><FONT face='morpheus' SIZE=3 COLOR="#FF0000"><? echo $err_string ?></FONT></tr>
<TR>
<TD><font face='comic sans ms' size='2'>Username --></font></TD>
<TD><INPUT NAME="username" TYPE="text" SIZE="10"></TD>
</TR>
<TR>
<TD><font face='comic sans ms' size='2'>Password --></font></TD>
<TD><INPUT NAME="password" TYPE="password" SIZE="10"></TD>
</TR>
<tr align='center'><td align='center'><INPUT TYPE="submit" VALUE="Accedi"></td></tr>
</TABLE>
</FORM>
<?
$html->printfooter();
exit;
}
function GenerateSecret ( $username, $encrypted_password ) {
$md5str = MD5( TIME() );
$cookie_val = "$username-$encrypted_password-$md5str";
setcookie( "php_mini_auth", $cookie_val, time()+EXPIRE);
$arg = "update acl set string='$md5str' where username='$username'";
$row = mysql_db_query( DATABASE, $arg );
}
function AuthenticateUser ( $username, $password ) {
global $ip;
global $host;
global $referer;
$arg = "select password, 1 as auth from acl where username='$username' and password=encrypt('$password','$username')";
$row = mysql_fetch_array(mysql_db_query( DATABASE, $arg ));
if ($row[auth]) {
if (defined( "AUTH_LOG" ))
error_log( date("Ymd H:i:s") . " -- $ip -- Username: '$username' authenticated\n", 3, AUTH_LOG);
GenerateSecret( $username, $row[password] );
}
else {
if (defined( "AUTH_LOG" ))
error_log( date("Ymd H:i:s") . " -- $ip -- Username: '$username' authentication failure\n", 3, AUTH_LOG);
DisplayLoginForm( "Dati incorretti, riprova" );
}
}
function AuthenticateCookie ( $cookie, $username, $password ) {
$cookie_var = split("-", $cookie);
$ck_username = $cookie_var[0];
$ck_password = $cookie_var[1];
$secret = $cookie_var[2];
$arg = "select 1 as auth from acl where username='$ck_username' and password='$ck_password' and string='$secret'";
$row = mysql_fetch_array(mysql_db_query( DATABASE, $arg ));
if (!($row[auth]))
AuthenticateUser ( $username, $password );
else return $ck_username;
}
mysql_connect($db_hostname,$db_user,$db_pass) or
die("Unable to connect to the SQL server...");
$THIS_URL=getenv("SCRIPT_NAME");
$ip = getenv("REMOTE_ADDR");
$host = getenv("REMOTE_HOST");
$referer = getenv("REMOTE_REFERER");
if ($php_mini_auth)
$username = AuthenticateCookie( $php_mini_auth, $username, $password );
else
if ($username)
AuthenticateUser( $username, $password );
else
DisplayLoginForm( "Accedi con i tuoi dati" );
$result = mysql_db_query( DATABASE,"SELECT * from acl WHERE username='$username'");
$row=mysql_fetch_row($result);
?>