Author: cfinck Date: Wed Jun 11 15:02:19 2008 New Revision: 33936

URL: http://svn.reactos.org/svn/reactos?rev=33936&view=rev Log: - Fix/unhack/simplify/rewrite the RosCMS authentication module for phpBB. This should finally fix all Login/Logout problems people were experiencing. - Don't do any RosCMS-related stuff in login_box(), this is all done in the Authentication module now. - Disable the phpBB autologin, it interferes with the RosCMS Login.

Modified: trunk/web/reactos.org/htdocs/forum/includes/auth/auth_roscms.php trunk/web/reactos.org/htdocs/forum/includes/functions.php

Modified: trunk/web/reactos.org/htdocs/forum/includes/auth/auth_roscms.php URL: http://svn.reactos.org/svn/reactos/trunk/web/reactos.org/htdocs/forum/includ... ============================================================================== --- trunk/web/reactos.org/htdocs/forum/includes/auth/auth_roscms.php [iso-8859-1] (original) +++ trunk/web/reactos.org/htdocs/forum/includes/auth/auth_roscms.php [iso-8859-1] Wed Jun 11 15:02:19 2008 @@ -12,52 +12,23 @@ exit; }

+require_once("$phpbb_root_path/../roscms/inc/subsys_login.php"); + /** * Login function */ define(ROSCMS_DB_NAME, "roscms");

-function login_roscms(&$userid, &$password) +function login_roscms(&$username, &$password) { global $db, $config; - // We only check the User ID here. - if (!$userid) - { - return array( - 'status' => LOGIN_ERROR_USERNAME, - 'error_msg' => 'LOGIN_ERROR_USERNAME', - 'user_row' => array('user_id' => ANONYMOUS), - ); - } - - // Get the phpBB ID of the user belonging to the "roscmsusrkey" cookie - $sql = "SELECT m.map_subsys_userid " . - "FROM " . ROSCMS_DB_NAME . ".user_sessions s, " . ROSCMS_DB_NAME . ".users u, " . ROSCMS_DB_NAME . ".subsys_mappings m " . - "WHERE s.usersession_id = '" . $db->sql_escape($_COOKIE["roscmsusrkey"]) . "' AND (s.usersession_expires IS NULL OR NOW() <= s.usersession_expires) " . - "AND u.user_id = s.usersession_user_id AND (u.user_setting_ipaddress = 'false' OR s.usersession_ipaddress = '" . $db->sql_escape($_SERVER["REMOTE_ADDR"]) . "') " . - "AND (u.user_setting_browseragent = 'false' OR s.usersession_browseragent = '" . $db->sql_escape($_SERVER["HTTP_USER_AGENT"]) . "') " . - "AND m.map_roscms_userid = s.usersession_user_id " . - "AND m.map_subsys_name = 'phpbb'"; - $result = $db->sql_query($sql); - $row = $db->sql_fetchrow($result); - $db->sql_freeresult($result); + // We ignore both username and password here and retrieve the login data on our own using roscms_subsys_login + // This will either retrieve the phpbb user ID of the user currently logged in or redirect us to the RosCMS login page. + $userid = (int)roscms_subsys_login("phpbb", ROSCMS_LOGIN_REQUIRED, "/forum"); - // Verify this ID against $userid - if(!$row || $row["map_subsys_userid"] != $userid) - { - return array( - 'status' => LOGIN_ERROR_USERNAME, - 'error_msg' => 'LOGIN_ERROR_USERNAME', - 'user_row' => array('user_id' => ANONYMOUS), - ); - } - - // Now get the user information based on this ID - $sql = "SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts " . - "FROM " . USERS_TABLE . " " . - "WHERE user_id = " . (int)$userid; - + // Now get the user row based on this ID + $sql = "SELECT * FROM " . USERS_TABLE . " WHERE user_id = $userid"; $result = $db->sql_query($sql); $row = $db->sql_fetchrow($result); $db->sql_freeresult($result); @@ -89,29 +60,38 @@ ); }

+/* This function is called, when a session cookie already exists and we try to verify if it's valid. */ function validate_session_roscms(&$user) +{ + // Check if our current RosCMS login is (still) valid, check the session expiration time and perform session cleanups. + $valid_login = (roscms_subsys_login("phpbb", ROSCMS_LOGIN_OPTIONAL, "") != 0); + + // If we have a valid login, but the phpBB user ID is still ANONYMOUS, the user was logged in to RosCMS, but not yet to phpBB. + // So do that now. + if($valid_login && $user["user_id"] == ANONYMOUS) + login_box(); + + return $valid_login; +} + +/* This function is called, when no phpBB session exists and we're in the process of creating the session cookie. */ +function autologin_roscms() { global $db; - if($_COOKIE["roscmsusrkey"]) + // Get the User ID of the logged in user (if any), check the session expiration time and perform session cleanups. + $userid = (int)roscms_subsys_login("phpbb", ROSCMS_LOGIN_OPTIONAL, ""); + + if($userid) { - if($user["user_id"] == ANONYMOUS) - { - // The user is logged in in RosCMS, but not yet in phpBB. Do that now - login_box(); - } - else - { - // Update the session expiration time - $sql = "UPDATE " . ROSCMS_DB_NAME . ".user_sessions " . - "SET usersession_expires = DATE_ADD(NOW(), INTERVAL 30 MINUTE) " . - "WHERE usersession_id = '" . $db->sql_escape($_COOKIE["roscmsusrkey"]) . "' " . - "AND usersession_expires IS NOT NULL"; - $db->sql_query($sql); - } + // Return the phpBB user row if a user is logged in. + $sql = "SELECT * FROM " . USERS_TABLE . " WHERE user_id = $userid"; + $result = $db->sql_query($sql); + $row = $db->sql_fetchrow($result); + $db->sql_freeresult($result); + + return $row; } - - return true; }

?>

Modified: trunk/web/reactos.org/htdocs/forum/includes/functions.php URL: http://svn.reactos.org/svn/reactos/trunk/web/reactos.org/htdocs/forum/includ... ============================================================================== --- trunk/web/reactos.org/htdocs/forum/includes/functions.php [iso-8859-1] (original) +++ trunk/web/reactos.org/htdocs/forum/includes/functions.php [iso-8859-1] Wed Jun 11 15:02:19 2008 @@ -15,8 +15,6 @@ { exit; } - -require_once("$phpbb_root_path/../roscms/inc/subsys_login.php");

// Common global functions

@@ -2257,14 +2255,9 @@ } trigger_error('NO_AUTH_ADMIN'); } - - // Login using RosCMS - // The function will return the phpBB user ID if we're already logged in. - // Otherwise this function will be automatically called again through validate_session_roscms, when we will be redirected to the forum. - $userid = roscms_subsys_login("phpbb", ROSCMS_LOGIN_REQUIRED, "/forum"); - // If authentication is successful we redirect user to previous page - $result = $auth->login($userid, '', true, true, $admin); + // Don't pass anything here, login_roscms will call roscms_subsys_login on its own. + $result = $auth->login('', '', false, true, $admin);

// If admin authentication and login, we will log if it was a success or not... // We also break the operation on the first non-success login - it could be argued that the user already knows