User session fix

* User session fix
sergejey · Jan 3, 2019 · 02cdc9f · 02cdc9f
1 parent 4a7d624
commit 02cdc9f
Showing 1 changed file with 26 additions and 8 deletions.
diff --git a/command.php b/command.php
@@ -72,13 +72,34 @@
     $user_id = 0;
     $username = gr('username');
     if ($username) {
-        $user = SQLSelectOne("SELECT ID FROM users WHERE USERNAME = '" . DBSafe(trim($username)) . "'");
+        $user=SQLSelectOne("SELECT * FROM users WHERE USERNAME LIKE '".DBSafe($username)."'");
+        if (!$user['PASSWORD']) {
+            $session->data['SITE_USERNAME']=$user['USERNAME'];
+            $session->data['SITE_USER_ID']=$user['ID'];
+        } else {
+            if (!isset($_SERVER['PHP_AUTH_USER'])) {
+                header('WWW-Authenticate: Basic realm="MajorDoMo"');
+                header('HTTP/1.0 401 Unauthorized');
+                echo 'Password required!';
+                exit;
+            } else {
+                if ($_SERVER['PHP_AUTH_USER'] == $user['USERNAME'] && $_SERVER['PHP_AUTH_PW'] == $user['PASSWORD']) {
+                    $session->data['SITE_USERNAME'] = $user['USERNAME'];
+                    $session->data['SITE_USER_ID'] = $user['ID'];
+                } else {
+                    header('WWW-Authenticate: Basic realm="MajorDoMo"');
+                    header('HTTP/1.0 401 Unauthorized');
+                    echo 'Incorrect username/password!';
+                    exit;
+                }
+            }
+        }
         $user_id = (int)$user['ID'];
     }
 
     if (!$user_id) {
-        if ($session->data['logged_user']) {
-            $user_id = $session->data['logged_user'];
+        if ($session->data['SITE_USER_ID']) {
+            $user_id = $session->data['SITE_USER_ID'];
         } else {
             $user = SQLSelectOne("SELECT ID FROM users ORDER BY ID");
             $user_id = $user['ID'];
@@ -89,14 +110,11 @@
         $user_id = $params['user_id'];
     }
 
-    /*
-    include_once(DIR_MODULES . 'patterns/patterns.class.php');
-    $pt = new patterns();
-    */
-
     $qrys = explode(' ' . DEVIDER . ' ', $qry);
     $total = count($qrys);
 
+    $session->save();
+
     for ($i = 0; $i < $total; $i++) {
         $room_id = 0;