/
session.php
198 lines (177 loc) · 6.82 KB
/
session.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
<?PHP
/**
* AwSession
*
* Session Management
*
* @package awtools
* @author Florian Knodt <adlerweb@adlerweb.info>
* @see AwSQL
*
* @env AW_SESSION_NOAUTO bool if defined auto-instantiate is turned off
*/
if(!session_id()) session_start();
class adlerweb_session {
/**
* @category config
* @var int Number of seconds to block a user if he reached our retry-count
*/
protected $retry_timeout = 300;
/**
* @category config
* @var int How many retries before we block an user
*/
protected $retry_allowed = 3;
/**
* @var bool|string False or human-readable description of last error
*/
public $lasterror='';
/**
* Inizialize system
*/
public function __construct() {
//Check for working SQL
if(!isset($GLOBALS['adlerweb']['sql'])) {
trigger_error('No SQL-socket in [adlerweb][sql] - Please load AwSQL STMT first...', E_USER_WARNING);
}
if(!isset($GLOBALS['adlerweb'])) $GLOBALS['adlerweb']=array();
if(!isset($_SESSION['adlerweb'])) $_SESSION['adlerweb']=array();
if(!isset($_SESSION['adlerweb']['session'])) $_SESSION['adlerweb']['session']=array();
if(!isset($_SESSION['adlerweb']['session']['retrytime'])) $_SESSION['adlerweb']['session']['retrytime']=0;
if(!isset($_SESSION['adlerweb']['session']['retrycount'])) $_SESSION['adlerweb']['session']['retrycount']=0;
$this->smarty_repopulate();
$this->retry_housekeeping();
}
/**
* Try to login
* On success $_SESSION['adlerweb']['session'] is populated with user's details
* @var string $user Username
* @var string $pass Password
* @return bool
*/
public function session_login($user, $pass) {
$user=strtolower($user);
if(!$this->session_validUser($user)) {
$_SESSION['adlerweb']['session']['retrycount']++;
$this->lasterror='Incorrect username format';
return false;
}
if(isset($_SESSION['adlerweb']['session']) && isset($_SESSION['adlerweb']['session']['retrytime']) && $_SESSION['adlerweb']['session']['retrytime'] >= time()) {
$this->lasterror='Too many incorrect tries';
return false;
}
if(!isset($GLOBALS['adlerweb']['sql'])) {
}
$check=$GLOBALS['adlerweb']['sql']->querystmt_single("SELECT UserID,Password,Level,UIdent,Name FROM Users WHERE Nickname=? LIMIT 1;", 's', $user);
if(!$check) {
$_SESSION['adlerweb']['session']['retrycount']++;
$this->lasterror='User not found';
return false;
}
if(!$this->session_comparePassword( $pass, $check['Password'] )) {
$_SESSION['adlerweb']['session']['retrycount']++;
$this->lasterror='Incorrect password';
return false;
}
$_SESSION['adlerweb']['session']['level'] = $check['Level'];
$_SESSION['adlerweb']['session']['short'] = $check['UIdent'];
$_SESSION['adlerweb']['session']['user'] = $check['Name'];
$_SESSION['adlerweb']['session']['UID'] = $check['UserID'];
return true;
}
/**
* Check if the current user is logged in
* @return bool|int false or integer of user's permission level
*/
public function session_isloggedin() {
if(!isset($_SESSION['adlerweb']['session']['level']) || $_SESSION['adlerweb']['session']['level']<=0) return false;
return $_SESSION['adlerweb']['session']['level'];
}
/**
* Close a session
*/
public function session_logout() {
if($this->session_isloggedin() !== false) {
session_destroy();
session_start();
}
}
/**
* Modified password salt generator
* @author original by richardlord.net
* @return string (Pseudo)Random string intended as salt
*/
private function session_getPasswordSalt() {
return substr(str_pad(dechex(mt_rand()), 8, '0', STR_PAD_LEFT), -8);
}
/**
* Modified password generator
* @author original by richardlord.net
* @var string $salt as generated by session_getPasswordSalt
* @var string unsalted Password
* @return string salted password
*/
private function session_getPasswordHash($salt, $password) {
return $salt.hash('sha256', hash('whirlpool', $salt.$password));
}
/**
* Get a hashed password with a fresh salt
* @var string $password
* @return string Salted password
*/
public function session_getNewPasswordHash($password) {
return $this->session_getPasswordHash($this->session_getPasswordSalt(), $password);
}
/**
* Compare a plaintext password with its salted version
* @author original by richardlord.net
* @var string $password cleartext
* @var string $hash salted version
* @return bool
*/
private function session_comparePassword($password, $hash) {
$salt = substr($hash, 0, 8);
return $hash == $this->session_getPasswordHash($salt, $password);
}
/**
* Limit valid usernames to a specific regex (a-z, 0-9, - and _)
* @var string $user Username
* @return bool
*/
private function session_validUser($user) {
return preg_match("/^[a-z0-9\-_]+$/", $user);
}
/**
* Repopulate smarty's session-vars if AwSmarty is used
*/
private function smarty_repopulate() {
if(isset($GLOBALS['adlerweb']['tpl'])) {
if(isset($_SESSION['adlerweb']['session']['level']) && isset($_SESSION['adlerweb']['session']['short']) && isset($_SESSION['adlerweb']['session']['user'])) {
$GLOBALS['adlerweb']['tpl']->assign('loginlevel', $_SESSION['adlerweb']['session']['level']);
$GLOBALS['adlerweb']['tpl']->assign('user', $_SESSION['adlerweb']['session']['user']);
$GLOBALS['adlerweb']['tpl']->assign('short', $_SESSION['adlerweb']['session']['short']); //DiBAS-Compatibility
$GLOBALS['adlerweb']['tpl']->assign('UID', $_SESSION['adlerweb']['session']['UID']);
}else{
$GLOBALS['adlerweb']['tpl']->assign('loginlevel', 0);
}
}
}
/**
* Check for expired retry count
*/
private function retry_housekeeping() {
if($_SESSION['adlerweb']['session']['retrycount'] > $this->retry_allowed){
$_SESSION['adlerweb']['session']['retrytime'] = time()+$this->retry_timeout;
$_SESSION['adlerweb']['session']['retrycount']=0;
}elseif($_SESSION['adlerweb']['session']['retrytime'] > 0 && $_SESSION['adlerweb']['session']['retrytime'] <= time()) {
$_SESSION['adlerweb']['session']['retrytime'] = 0;
}
}
}
/**
* Instantiate new global AwSession-object if not deactivated
*/
if(!defined('AW_SESSION_NOAUTO')) {
$GLOBALS['adlerweb']['session'] = new adlerweb_session();
}
?>