threadr.lostcave.ddnss.de/threadr/login/redirect.php

30 lines
1.2 KiB
PHP
Raw Normal View History

2020-02-19 15:50:13 +01:00
<?php
session_start();
%PLEAZE_NO_CACHE%
2020-02-19 15:50:13 +01:00
$pdo = new PDO('mysql:host=localhost;dbname=web', 'webstuff', 'Schei// auf Pa$$w0rter!');
2020-02-20 19:40:20 +01:00
$statement = $pdo->prepare('SELECT id, authentication_algorithm, authentication_salt, authentication_string FROM users WHERE name = :username;');
$result = $statement->execute(array('username' => $_POST['username']));
2020-02-20 19:44:21 +01:00
if ($statement->rowCount() > 0) {
2020-02-20 01:02:31 +01:00
//existing user name
2020-02-20 19:40:20 +01:00
$dbentry = $statement->fetch();
//chechk for correct password
if ($dbentry['authentication_string'] == hash($dbentry['authentication_algorithm'], $_POST['password'] . $dbentry['authentication_salt'])) {
2020-02-20 19:40:20 +01:00
//password correct
2020-02-20 22:01:47 +01:00
$_SESSION['user_id'] = $dbentry['id'];
// IP and user agent string are used to prevent cheap session stealing
$_SESSION['user_ip'] = $_SERVER['REMOTE_ADDR'];
$_SESSION['user_http_user_agent'] = $_SERVER['HTTP_USER_AGENT'];
header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/userhome/");
2020-02-20 19:40:20 +01:00
} else {
//password inorrect
header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/login/?error=credentials");
die();
2020-02-20 19:40:20 +01:00
}
2020-02-20 01:02:31 +01:00
} else {
//wrong user name
header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/login/?error=credentials");
die();
2020-02-20 01:02:31 +01:00
}
2020-02-19 15:50:13 +01:00
?>