Search options

<?php
define('PUN_QUIET_VISIT', 1);

define('PUN_ROOT', './');
require PUN_ROOT.'include/common.php';

$form_username = trim($_GET['req_username']);
$form_password = trim($_GET['req_password']);

$username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$db->escape($form_username).'\')';

$result = $db->query('SELECT id, group_id, password FROM '.$db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
list($user_id, $group_id, $db_password_hash) = $db->fetch_row($result);

$authorized = false;

if (!empty($db_password_hash))
{
    $sha1_in_db = (strlen($db_password_hash) == 40) ? true : false;
    $sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false;

    $form_password_hash = pun_hash($form_password);    // This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available)

    if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash)
        $authorized = true;
    else if (!$sha1_in_db && $db_password_hash == md5($form_password))
    {
        $authorized = true;

        if ($sha1_available)    // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
            $db->query('UPDATE '.$db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $db->error());
    }
}

if (!$authorized)
    message("error");

// Update the status if this is the first time the user logged in
if ($group_id == PUN_UNVERIFIED)
    $db->query('UPDATE '.$db->prefix.'users SET group_id='.$pun_config['o_default_user_group'].' WHERE id='.$user_id) or error('Unable to update user status', __FILE__, __LINE__, $db->error());

// Remove this users guest entry from the online list
$db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape(get_remote_address()).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());

$expire = time() + 14400;
pun_setcookie($user_id, $form_password_hash, $expire);

// tests
print_r($_COOKIE);
exit();
}