I need your help applying a script to more databases

EricOnAdventure · June 21, 2016

Hello all, I have a very complex problem, one far beyond me (I tried and got nowhere). I am using the login script from http://www.quadodo.net , and it works quite well. But I ran into an issue the other day, I created a code to pull from my databases. the code worked in a vacuum but when pared up with pages that also used the login script it failed. I'm not sure why, but perhaps a security feature. Anyway, this got me thinking, if this very vital login script is creating a conflict, why try to work around it or fight it, I could just take the code that it already has, code that already pulls from databases and rework it to my desire. I tried this and uhh,,,wow it was quite beyond me.

SO in the login script this

$anyvar= $qls->user_info['anycolumn'];

works great, it allows me to pull any column from my login database which I have been adding and adding too. Of course I don't want to add too much to, so I need to rework this script so that I can pull from other databases, the problem is my limited knowledge of PHP and is preventing me from editing the code in a meaningful and effective way. Below is the code whole page that would allow me to use the little code I just showed you. A good porting of this code is for security, and it does make sense to keep that Any advice on how I could start? Or perhaps you need more information? Really this is so far beyond me that I am so lost that I can't even find myself.

<?php
if (!defined('QUADODO_IN_SYSTEM')) {
    exit;
}

/**
 * Contains all user functions
 */
class User {

/**
 * @var object $qls - Will contain everything else
 */
var $qls;

	/**
	 * Construct class
	 * @param object $qls - Contains all other classes
	 * @return void
	 */
	function User(&$qls) {
	    $this->qls = &$qls;
	}

	/**
	 * Un-activates accounts that need un-activation
	 * @return void
	 */
	function check_activated_accounts() {
	    $groups_result = $this->qls->SQL->query("SELECT * FROM `{$this->qls->config['sql_prefix']}groups` WHERE `expiration_date`<>0");

		// Get the groups and put them into a variable
		while ($groups_row = $this->qls->SQL->fetch_array($groups_result)) {
            // Find the amount of seconds the admin entered
            $in_seconds = time() - ($groups_row['expiration_date'] * 86400);
            $users_result = $this->qls->SQL->query("SELECT * FROM `{$this->qls->config['sql_prefix']}users` WHERE `group_id`={$groups_row['id']} AND `activation_time`<{$in_seconds} AND `active`='yes'");

			while ($users_row = $this->qls->SQL->fetch_array($users_result)) {
                // Un-activate them
                $this->qls->SQL->update('users',
                    array(
                        'active' => 'no'
                    ),
                    array('id' =>
                        array(
                            '=',
                            $users_row['id']
                        )
                    )
                );
			}
		}
	}

	/**
	 * Checks the password code via the GET method
	 * @return bool
	 */
	function check_password_code() {
        $code = $this->qls->Security->make_safe($_GET['code']);
        $result = $this->qls->SQL->select('*',
            'password_requests',
            array('code' =>
                array(
                    '=',
                    $code
                )
            )
        );
        $row = $this->qls->SQL->fetch_array($result);

		if ($row['id'] != '' && $row['used'] != 1) {
		    return true;
		}
		else {
		    return false;
		}
	}

	/**
	 * This will actually change the password of the user
	 * @return bool
	 */
	function change_password() {
		// A little extra security
		if ($this->check_password_code()) {
		    $code = $this->qls->Security->make_safe($_GET['code']);

            // Retrieve the information from the database
            $result = $this->qls->SQL->select('*',
                'password_requests',
                array('code' =>
                    array(
                        '=',
                        $code
                    )
                )
            );
            $row = $this->qls->SQL->fetch_array($result);

            // Get the user's username from the database
            $users_result = $this->qls->SQL->select('*',
                'users',
                array('id' =>
                    array(
                        '=',
                        $row['user_id']
                    )
                )
            );
            $users_row = $this->qls->SQL->fetch_array($users_result);

            $new_password = (isset($_POST['new_password']) && $this->validate_password($_POST['new_password'])) ? $this->qls->Security->make_safe($_POST['new_password']) : false;
            $new_password_confirm = (isset($_POST['new_password_confirm']) && $_POST['new_password_confirm'] == $_POST['new_password']) ? true : false;

			if ($new_password !== false && $new_password_confirm !== false) {
                $password_hash = $this->generate_password_hash($new_password, $users_row['code']);

                // Update the database
                $this->qls->SQL->update('users',
                    array('password' => $password_hash),
                    array('id' =>
                        array(
                            '=',
                            $row['user_id']
                        )
                    )
                );
                $this->qls->SQL->update('password_requests',
                    array('used' => 1),
                    array('id' =>
                        array(
                            '=',
                            $row['id']
                        )
                    )
                );

			    return true;
			}
			else {
                $this->change_password_error = REGISTER_PASSWORD_ERROR;
                return false;
			}
		}
		else {
            $this->change_password_error = CHANGE_PASSWORD_INVALID_CODE;
            return false;
		}
	}

	/**
	 * This will generate a random code
	 * @return string of SHA1 hash
	 */
	function generate_random_code() {
        $hash[] = sha1(sha1(rand(1, 100)) . md5(rand(1, 100)));
        $hash[] = sha1(time() + time() . md5(time() + time()) . md5(rand()));
        $hash[] = sha1($hash[0] . $hash[1] . md5(time()));
        $hash[] = sha1($this->qls->config['user_regex'] . time());
        return sha1($hash[0] . $hash[0] . $hash[1] . $hash[2] . $hash[3] . time() . time() + time());
	}

	/**
	 * Sends the password change email to the user
	 * @return true on success, false on failure
	 */
	function send_password_email() {
	    $username = $this->qls->Security->make_safe($_POST['username']);

		if ($this->check_username_existence($username)) {
            $code = $this->generate_random_code();
            $this->qls->SQL->insert('password_requests',
                array(
                    'user_id',
                    'code',
                    'used',
                    'date'
                ),
                array(
                    $this->username_to_id($_POST['username']),
                    $code,
                    0,
                    time()
                )
            );
            $user_info = $this->fetch_user_info($username);

			// Generate the link
			if (substr($this->qls->config['cookie_domain'], 0, 1) == '.') {
				if (substr($this->qls->config['cookie_path'], -1) == '/') {
				    $change_link = "http://www{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}change_password.php?code={$code}";
				}
				else {
				    $change_link = "http://www{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}/change_password.php?code={$code}";
				}
			}
			else {
				if (substr($this->qls->config['cookie_path'], -1) == '/') {
				    $change_link = "http://{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}change_password.php?code={$code}";
				}
				else {
				    $change_link = "http://{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}/change_password.php?code={$code}";
				}
			}

		    $headers = "From: {$user_info['email']}\r\n";

			if (mail($user_info['email'], SEND_PASSWORD_SUBJECT, sprintf(SEND_PASSWORD_BODY, $change_link), $headers)) {
			    return true;
			}
			else {
			    $this->send_password_email_error = SEND_PASSWORD_MAIL_ERROR;
			    return false;
			}
		}
		else {
		    $this->send_password_email_error = SEND_PASSWORD_USERNAME_NON_EXISTANT;
		    return false;
		}
	}

	/**
	 * Transforms a username into an ID number
	 * @param string $username - The username to change
	 * @return int
	 */
	function username_to_id($username) {
	    $username = $this->qls->Security->make_safe($username);

		// Make sure it exists
		if ($this->check_username_existence($username)) {
            $result = $this->qls->SQL->select('id',
                'users',
                array('username' =>
                    array(
                        '=',
                        $username
                    )
                )
            );
            $row = $this->qls->SQL->fetch_array($result);
            return $row['id'];
		}
		else {
		    return 0;
		}
	}

	/**
	 * Transform a user ID into a username
	 * @param integer $user_id - The ID to change
	 * @return string
	 */
	function id_to_username($user_id) {
        $user_id = (is_numeric($user_id) && $user_id > 0) ? $user_id : 0;
        $result = $this->qls->SQL->select('username',
            'users',
            array('id' =>
                array(
                    '=',
                    $user_id
                )
            )
        );
        $row = $this->qls->SQL->fetch_array($result);
        return $row['username'];
	}

	/**
	 * Validates a password
	 * @param string $input - The input password
	 * @return bool
	 */
	function validate_password($input) {
		if (strlen($input) <= $this->qls->config['max_password'] &&
			strlen($input) >= $this->qls->config['min_password']) {
		    return true;
		}
		else {
		    return false;
		}
	}

	/**
	 * Validate the username according to the defined regex string.
	 * @param string $input - The input username
	 * @return bool
	 */
	function validate_username($input) {
		if (preg_match($this->qls->config['user_regex'], $input)) {
			if (strlen($input) <= $this->qls->config['max_username'] &&
				strlen($input) >= $this->qls->config['min_username']) {
			    return true;
			}
			else {
			    return false;
			}
		}
		else {
		    return false;
		}
	}

	/**
	 * Validates the user that is logged in, not logging in a user
	 * @return bool
	 */
	function validate_login() {
		if ($this->qls->Session->find_session()) {
		    return true;
		}
		else {
		    return false;
		}
	}

	/**
	 * Fetch the user info of the user trying to login
	 * @param string $username - The username
	 * @return array|bool
	 */
	function fetch_user_info($username) {
		if ($this->validate_username($username)) {
            // Get info from the database
            $result = $this->qls->SQL->select('*',
                'users',
                array('username' =>
                    array(
                        '=',
                        $username
                    )
                )
            );
            $row = $this->qls->SQL->fetch_array($result);
            return $row;
		}
		else {
		    return false;
		}
	}

	/**
	 * Increases the number of tries by 1
	 * @param string  $username      - The username
	 * @param integer $current_tries - The user's current tries
	 * @return void
	 */
	function update_tries($username, $current_tries) {
		if ($this->validate_username($username)) {
            $this->qls->SQL->update('users',
                array(
                    'tries' => ($current_tries + 1),
                    'last_try' => time()
                ),
                array('username' =>
                    array(
                        '=',
                        $username
                    )
                )
            );
		}
	}

	/**
	 * Generates the password hash
	 * @param string $password  - The user's password
	 * @param string $user_code - The user's activation code
	 * @return string
	 */
	function generate_password_hash($password, $user_code) {
        $hash[] = md5($password);
        $hash[] = md5($password . $user_code);
        $hash[] = md5($password) . sha1($user_code . $password) . md5(md5($password));
        $hash[] = sha1($password . $user_code . $password);
        $hash[] = md5($hash[3] . $hash[0] . $hash[1] . $hash[2] . sha1($hash[3] . $hash[2]));
        $hash[] = sha1($hash[0] . $hash[1] . $hash[2] . $hash[3]) . md5($hash[4] . $hash[4]) . sha1($user_code);
        return sha1($hash[0] . $hash[1] . $hash[2] . $hash[3] . $hash[4] . $hash[5] . md5($user_code));
	}

	/**
	 * Compares an inputted password with the one in the database
	 * @param string $input_password - The input password
	 * @param string $real_password  - The user's real password
	 * @param string $user_code      - The user's activation code
	 * @return bool
	 */
	function compare_passwords($input_password, $real_password, $user_code) {
        // Generate the hash to compare them
        $input_hash = $this->generate_password_hash($input_password, $user_code);

		// Actually compare them
		if ($input_hash == $real_password) {
		    return true;
		}
		else {
		    return false;
		}
	}

	/**
	 * Tries to login the user
	 * @return bool
	 */
	function login_user() {
        $username = $_POST['username'];
        $password = $_POST['password'];
        $remember = $_POST['remember'];
        $user_info = $this->fetch_user_info($username);

		if ($user_info['id'] != '') {
			if ($user_info['tries'] < $this->qls->config['max_tries']) {
				if ($this->compare_passwords($password, $user_info['password'], $user_info['code'])) {
					if ($user_info['blocked'] == 'no') {
						// They need to be active
						if ($user_info['active'] == 'yes') {
							if ($remember == '1') {
							    $this->qls->Session->create_session($username, $password, $user_info['password'], true);
							}
							else {
							    $this->qls->Session->create_session($username, $password, $user_info['password'], false);
							}

						    return true;
						}
						else {
                            if ($this->qls->config['activation_type'] == 1) {
                                $this->login_error = LOGIN_NOT_ACTIVE_USER_CODE;
                            }
                            else {
                                $this->login_error = LOGIN_NOT_ACTIVE_ADMIN_CODE;
                            }

						    return false;
						}
					}
					else {
					    $this->update_tries($username, $user_info['tries']);
					    $this->login_error = LOGIN_USER_BLOCKED_CODE;
					    return false;
					}
				}
				else {
				    $this->update_tries($username, $user_info['tries']);
				    $this->login_error = LOGIN_PASSWORDS_NOT_MATCHED_CODE;
				    return false;
				}
			}
			else {
			    $this->login_error = LOGIN_NO_TRIES_CODE;
			    return false;
			}
		}
		else {
		    $this->login_error = LOGIN_USER_INFO_MISSING_CODE;
		    return false;
		}
	}

	/**
	 * Removes set logout cookies/sessions
	 * @returns void
	 */
	function logout_user() {
	    $session_names = array('user_id', 'user_time', 'user_unique');

		if (isset($_SESSION[$this->qls->config['cookie_prefix'] . 'user_unique'])) {
            $this->qls->SQL->delete('sessions',
                array('id' =>
                    array(
                        '=',
                        $_SESSION[$this->qls->config['cookie_prefix'] . 'user_unique']
                    )
                )
            );
		}

        // Remove all session information and unset the cookie
        $_SESSION = array();

		if (isset($_COOKIE[session_name()])) {
		    setcookie(session_name(), '', time() - 42000, '/');
		}

		if (isset($_COOKIE[$this->qls->config['cookie_prefix'] . 'user_id'])) {
			foreach ($session_names as $value) {
			    setcookie($this->qls->config['cookie_prefix'] . $value, 0, time() - 3600, $this->qls->config['cookie_path'], $this->qls->config['cookie_domain']);
			}
		}

	    $this->qls->redirect($this->qls->config['logout_redirect']);
	}

	/**
	 * Checks to see if that username already exists
	 * @param string $username - Username to check
	 * @return bool
	 */
	function check_username_existence($username) {
        if (empty($username)) {
            return false;
        }

		// Check username...
		if ($this->validate_username($username)) {
            $result = $this->qls->SQL->select('id',
                'users',
                array('username' =>
                    array(
                        '=',
                        $username
                    )
                )
            );
            $row = $this->qls->SQL->fetch_array($result);

			if ($row['id'] == '') {
			    return false;
			}
			else {
			    return true;
			}
		}
		else {
		    return true;
		}
	}

	/**
	 * Generates a new activation code
	 * @param string $username - The user's username
	 * @param string $password - The user's password
	 * @param string $email    - The user's email address
	 * @return string
	 */
	function generate_activation_code($username, $password, $email) {
        $hash[] = md5($username . $password . md5($email));
        $hash[] = sha1($hash[0] . $hash[0]) . md5(sha1(sha1($email) . sha1($password)) . md5($username));
        $hash[] = sha1(sha1(sha1(sha1(md5(md5('   	') . sha1(' 	'))) . sha1($password . $username))));
        $hash[] = sha1($hash[0] . $hash[1] . $hash[2]) . sha1($hash[2] . $hash[0] . $hash[1]);
        $hash[] = sha1($username);
        $hash[] = sha1($password);
        $hash[] = md5(md5($email) . md5($password));
        $hash_count = count($hash);

		for ($x = 0; $x < $hash_count; $x++) {
            $random_hash = rand(0, $hash_count);
            $hash[] = sha1($hash[$x]) . sha1($password) . sha1($hash[$random_hash] . $username);
		}

	    return sha1(sha1($hash[0] . $hash[1] . $hash[2] . $hash[3]) . sha1($hash[4] . $hash[5]) . md5($hash[6] . $hash[7] . $hash[8] . sha1($hash[9])) . $password . $email);
	}

	/**
	 * Inserts registration data into the database
	 * @param string $username - The user's username
	 * @param string $password - The user's password
	 * @param string $email    - The user's email address
	 * @return void
	 */
	function insert_registration_data($username, $password, $email) {
        // Generate activation code
        $generated_code = $this->generate_activation_code($username, $password, $email);

        // All the columns that should be in the users table
        $columns = array(
            'username',
            'password',
            'code',
            'active',
            'last_login',
            'last_session',
            'blocked',
            'tries',
            'last_try',
            'email',
            'activation_time'
        );

        // All the values that go with the columns
        $values = array(
            $username,
            $this->generate_password_hash($password, $generated_code),
            $generated_code,
            'no',
            0,
            '',
            'no',
            0,
            0,
            $email,
            0
        );

		// Is activation required?
		if ($this->qls->config['activation_type'] == 0) {
            $values[3] = 'yes';
            $values[10] = time();
		}
		elseif ($this->qls->config['activation_type'] == 1) {
	    	$headers = "From: {$email}\r\n";
		    // Email stuff...

			if (substr($this->qls->config['cookie_domain'], 0, 1) == '.') {
				if (substr($this->qls->config['cookie_path'], -1) == '/') {
				    $activation_link = "http://www{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}activate.php?code={$generated_code}&username={$username}";
				}
				else {
				    $activation_link = "http://www{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}/activate.php?code={$generated_code}&username={$username}";
				}
			}
			else {
				if (substr($this->qls->config['cookie_path'], -1) == '/') {
				    $activation_link = "http://{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}activate.php?code={$generated_code}&username={$username}";
				}
				else {
				    $activation_link = "http://{$this->qls->config['cookie_domain']}{$this->qls->config['cookie_path']}/activate.php?code={$generated_code}&username={$username}";
				}
			}

		    @mail($email, ACTIVATION_SUBJECT, sprintf(ACTIVATION_BODY, $activation_link), $headers);
		}


	    $this->qls->SQL->insert('users', $columns, $values);

        // Check the invitation code
        $code = (isset($_GET['code']) && strlen($_GET['code']) == 40 && preg_match('/^[a-fA-F0-9]{40}$/', $_GET['code'])) ? $this->qls->Security->make_safe($_GET['code']) : false;
            if ($code !== false) {
            $this->qls->SQL->update('invitations',
                array('used' => 1),
                array('code' =>
                    array(
                        '=',
                        $code
                    )
                )
            );
		}
	}

	/**
	 * This will register a user
	 * @return bool
	 */
	function register_user() {
        $this->qls->Security->check_auth_registration();

        // Default security
        $security_check = false;

        /**
         * These next lines will retrieve the necessary fields. These include username,
         * password & confirmation, email & confirmation and possibly the security image.
         */
        $username = (isset($_POST['username']) && $this->validate_username($_POST['username'])) ? $this->qls->Security->make_safe($_POST['username']) : false;
        $password = (isset($_POST['password']) && $this->validate_password($_POST['password'])) ? $this->qls->Security->make_safe($_POST['password']) : false;
        $confirm_password = (isset($_POST['password_c']) && $this->qls->Security->make_safe($_POST['password_c']) == $password) ? true : false;
        $email = (isset($_POST['email']) && strlen($_POST['email']) > 6 && strlen($_POST['email']) < 256 && filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) ? $this->qls->Security->make_safe($_POST['email']) : false;
        $confirm_email = (isset($_POST['email_c']) && $_POST['email_c'] == $email) ? true : false;

		if ($this->qls->config['security_image'] == 'yes') {
            // The random id of the image
            $random_id = (isset($_POST['random_id']) && preg_match('/^[a-fA-F0-9]{40}$/', $_POST['random_id'])) ? $this->qls->Security->make_safe($_POST['random_id']) : false;

            // The security code entered by the user
            $security_code = (isset($_POST['security_code']) && preg_match('/[a-zA-Z1-9]{5,8}/', $_POST['security_code'])) ? $_POST['security_code'] : false;

			if ($this->qls->Security->check_security_image($random_id, $security_code)) {
			    $security_check = true;
			}
		}
		else {
		    $security_check = true;
		}

        $_SESSION[$this->qls->config['cookie_prefix'] . 'registration_username'] = $this->qls->Security->make_safe($_POST['username']);
        $_SESSION[$this->qls->config['cookie_prefix'] . 'registration_email'] = $this->qls->Security->make_safe($_POST['email']);
        $_SESSION[$this->qls->config['cookie_prefix'] . 'registration_email_confirm'] = $this->qls->Security->make_safe($_POST['email_c']);

		if ($username === false) {
		    $this->register_error = REGISTER_USERNAME_ERROR;
		    return false;
		}

		if ($this->check_username_existence($username)) {
		    $this->register_error = REGISTER_USERNAME_EXISTS;
		    return false;
		}

		if ($password === false || $confirm_password === false) {
		    $this->register_error = REGISTER_PASSWORD_ERROR;
		    return false;
		}

		if ($email === false || $confirm_email === false) {
		    $this->register_error = REGISTER_EMAIL_ERROR;
		    return false;
		}

		if ($security_check === false) {
		    $this->register_error = REGISTER_SECURITY_ERROR;
		    return false;
		}

        $this->insert_registration_data($username, $password, $email);
        return true;
	}

	/**
	 * Compare the code input by the user to the one in the database
	 * @param string $input    - The input code
	 * @param string $username - The username
	 * @return bool
	 */
	function compare_codes($input, $username) {
        $result = $this->qls->SQL->select('*',
            'users',
            array('username' =>
                array(
                    '=',
                    $username
                )
            )
        );
        $row = $this->qls->SQL->fetch_array($result);

		// Compare the codes
		if ($row['code'] == $input) {
		    return true;
		}
		else {
		    return false;
		}
	}

	/**
	 * Tries to activate a user
	 * @return bool
	 */
	function activate_user() {
        // validate activation code input and user id input
        $activation_code = (isset($_GET['code']) && preg_match('/[a-fA-F0-9]{40}/', $_GET['code'])) ? $this->qls->Security->make_safe($_GET['code']) : false;
        $username = (isset($_GET['username']) && $this->validate_username($_GET['username'])) ? $this->qls->Security->make_safe($_GET['username']) : false;

		if ($activation_code === false) {
            $this->activate_error = ACTIVATE_CODE_NOT_VALID;
		    return false;
		}

		if ($username === false) {
		    $this->activate_error = ACTIVATE_USERNAME_NOT_VALID;
		    return false;
		}

		// Compare the codes
		if ($this->compare_codes($activation_code, $username)) {
            $this->qls->SQL->update('users',
                array(
                    'active' => 'yes',
                    'activation_time' => time()
                ),
                array('username' =>
                    array(
                        '=',
                        $username
                    )
                )
            );

            return true;
		}
		else {
            $this->activate_error = ACTIVATE_CODE_NOT_MATCH;
            return false;
		}
	}
}

?

EricOnAdventure · June 21, 2016

Oh, and this code too may be relevant....

<?php
/*** *** *** *** *** ***
* @package Quadodo Login Script
* @file    qls.class.php
* @start   July 18th, 2007
* @author  Douglas Rennehan
* @license http://www.opensource.org/licenses/gpl-license.php
* @version 1.1.3
* @link    http://www.quadodo.net
*** *** *** *** *** ***
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*** *** *** *** *** ***
* Comments are always before the code they are commenting.
*** *** *** *** *** ***/
if (!defined('QUADODO_IN_SYSTEM')) {
exit;	
}

/**
 * Contains everything needed to run the system
 */
class qls {

	/**
	 * Construct main class and grab all other classes
	 * @param string $current_language - The current language
	 * @return void, but will output error if found
	 */
	function qls($current_language) {
        // Get current language constants
        require_once($current_language . '.lang.php');

        require_once('Security.class.php');
        $this->Security = new Security($this);

        require_once('SQL.class.php');
        $this->SQL = new SQL($this);

        // Get configuration information and assign to $config
        $result = $this->SQL->query("SELECT * FROM `{$this->config['sql_prefix']}config`");

		while ($row = $this->SQL->fetch_array($result)) {
		    $this->config[$row['name']] = $row['value'];
		}

        $this->Security->remove_old_tries();

        require_once('User.class.php');
        $this->User = new User($this);

        require_once('Session.class.php');
        $this->Session = new Session($this);

        require_once('Admin.class.php');
        $this->Admin = new Admin($this);

        require_once('Group.class.php');
        $this->Group = new Group($this);

        require_once('Upload.class.php');
        $this->Upload = new Upload($this);

        $this->main_directory = str_replace('/includes', '', dirname(__FILE__));

        // Make sure their account isn't outdated
        $this->User->check_activated_accounts();

        // See if someone is logged in 0_0
        $this->User->validate_login();

        // Clear any old sessions used by the system
        $this->Session->clear_old_sessions();

        // Set the users last action
        if ($this->user_info['username'] != '') {
            $this->SQL->update('users',
                array('last_action' => time()),
                array('id' =>
                    array(
                        '=',
                        $this->user_info['id']
                    )
                )
            );
	    }

		if ($this->user_info['blocked'] == 'yes') {
		    die(BLOCKED_ERROR);
		}
	}

	/**
	 * Reference to the function inside User.class.php
	 * @param string $username - The username
	 * @return the ID of the username in the form of an integer
	 */
	function username_to_id($username) {
	    return $this->User->username_to_id($username);
	}

	/**
	 * Reference to the function inside User.class.php
	 * @param integer $user_id - The user ID
	 * @return the username (string)
	 */
	function id_to_username($user_id) {
	    return $this->User->id_to_username($user_id);
	}

	/**
	 * Translates a page name into a ID from the database
	 * @param string $page_name - The name of the page
	 * @return int
	 */
	function page_name_to_id($page_name) {
        $page_name = $this->Security->make_safe($page_name);
        $result = $this->SQL->select('id',
            'pages',
            array('name' =>
                array(
                    '=',
                    $page_name
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['id'];
	}

	/**
	 * Translates a page ID into a name from the database
	 * @param integer $page_id - The ID of the page
	 * @return String
	 */
	function page_id_to_name($page_id) {
        $page_id = $this->Security->make_safe($page_id);
        $result = $this->SQL->select('name',
            'pages',
            array('id' =>
                array(
                    '=',
                    $page_id
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['name'];
	}

	/**
	 * Translates a group name into an ID from the database
	 * @param string $group_name - The group name
	 * @return int
	 */
	function group_name_to_id($group_name) {
        $group_name = $this->Security->make_safe($group_name);
        $result = $this->SQL->select('id',
            'groups',
            array('name' =>
                array(
                    '=',
                    $group_name
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['id'];
	}

	/**
	 * Translate a group ID into a name from the database
	 * @param integer $group_id - The group ID
	 * @return String
	 */
	function group_id_to_name($group_id) {
        $group_id = $this->Security->make_safe($group_id);
        $result = $this->SQL->select('name',
            'groups',
            array('id' =>
                array(
                    '=',
                    $group_id
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['name'];
	}

	/**
	 * Translates a mask name to an ID from the database
	 * @param string $mask_name - The mask name
	 * @return int
	 */
	function mask_name_to_id($mask_name) {
        $mask_name = $this->Security->make_safe($mask_name);
        $result = $this->SQL->select('id',
            'masks',
            array('name' =>
                array(
                    '=',
                    $mask_name
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['id'];
	}

	/**
	 * Translates a mask ID to a name from the database
	 * @param integer $mask_id - The mask ID
	 * @return string
	 */
	function mask_id_to_name($mask_id) {
        $mask_id = $this->Security->make_safe($mask_id);
        $result = $this->SQL->select('name',
            'masks',
            array('id' =>
                array(
                    '=',
                    $mask_id
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['name'];
	}

	/**
	 * Opens a file and reads from it
	 * @param string $file_name - The name of the file
	 * @return string
	 */
	function fetch_file_data($file_name) {
        $file_location = $this->main_directory . '/' . $file_name;

        // If it has a 0 file size it won't be readable
        $file_size = filesize($file_location);
        if ($file_size == 0) {
            return '';
        }
        else {
            if (!$file_handle = fopen($file_location, 'r')) {
                $this->file_data_error = FILE_NOT_OPENABLE;
                return false;
            }
            else {
                if (!$file_data = fread($file_handle, filesize($file_location))) {
                    $this->file_data_error = FILE_NOT_READABLE;
                    return false;
                }
                else {
                    fclose($file_handle);
                    return $file_data;
                }
            }
        }
	}

	/**
	 * Retrieves the current page hits
	 * @param string $page_name - The page name
	 * @return int
	 */
	function hits($page_name) {
        $page_name = $this->Security->make_safe($page_name);
        $result = $this->SQL->select('*',
            'pages',
            array('name' =>
                array(
                    '=',
                    $page_name
                )
            )
        );
        $row = $this->SQL->fetch_array($result);
        return $row['hits'];
	}

	/**
	 * This will generate the activation link using the cookie information
	 * @param string $generated_code - The code they need
	 * @param string $username       - The user's username
	 * @return string
	 */
	function generate_activation_link($generated_code, $username) {
		// See if the domain is prepended with a dot
		if (substr($this->config['cookie_domain'], 0, 1) == '.') {
			// Does it have a / at the end?
			if (substr($this->config['cookie_path'], -1) == '/') {
			    $activation_link = "http://www{$this->config['cookie_domain']}{$this->config['cookie_path']}activate.php?code={$generated_code}&username={$username}";
			}
			else {
			    $activation_link = "http://www{$this->config['cookie_domain']}{$this->config['cookie_path']}/activate.php?code={$generated_code}&username={$username}";
			}
		}
		else {
			// Does it have a / at the end?
			if (substr($this->config['cookie_path'], -1) == '/') {
			    $activation_link = "http://{$this->config['cookie_domain']}{$this->config['cookie_path']}activate.php?code={$generated_code}&username={$username}";
			}
			else {
			    $activation_link = "http://{$this->config['cookie_domain']}{$this->config['cookie_path']}/activate.php?code={$generated_code}&username={$username}";
			}
		}

	    return $activation_link;
	}

	/**
	 * Redirects a user to another page
	 * @param string $url - The new URL to go to
	 * @return void
	 */
	function redirect($url) {
		switch ($this->config['redirect_type']) {
			default:
                header('Location: ' . $url);
                exit;
			break;
			case 2:
			    echo <<<META
<html><head><meta http-equiv="Refresh" content="0;URL={$url}" /></head><body></body></html>
META;
			    break;
			case 3:
			    echo <<<SCRIPT
<html><body><script>location="{$url}";</script></body></html>
SCRIPT;
			    break;
		}
	}

	/**
	 * Grabs all the users that are currently surfing and their info
	 * @return array
	 */
	function online_users() {
        // $five_minutes_ago can be changed if you want it farther back
        $five_minutes_ago = time() - 300;
        $result = $this->SQL->select('*',
            'users',
            array('last_action' =>
                array(
                    '>',
                    $five_minutes_ago
                )
            )
        );

        $users = array();

		while ($row = $this->SQL->fetch_assoc($result)) {
		    $users[] = $row;
		}

	    return $users;
	}
	
	/**
	 * Outputs the current online users
	 * @return void
	 */
	function output_online_users() {
	    $users = $this->online_users();

		if (count($users) == 0) {
		    echo ' ---- ';
		}
		else {
		    $count = 0;
            $string = '';

			foreach ($users as $information) {
                $prepared_output = str_ireplace('{username}', $information['username'], stripslashes($this->config['online_users_format']));
                $prepared_output = str_ireplace('{id}', $information['id'], $prepared_output);

				if ($count == 0) {
				    $string = $prepared_output;
				}
				else {
				    $string .= stripslashes($this->config['online_users_separator']) . $prepared_output;
				}

			    $count++;
			}

		    echo $string;
		}
	}
}

ginerjm · June 21, 2016

ONe solution might be to isolate your login code to a separate login script that when successful saves a token for the session. This script (upon success) would re-direct you to some other script that does whatever function is needed. That script would only need to check for the existence of the token (or more stuff) to allow it to operate. In this way you remove any possible conflict (unresolved) between the two pirated code samples you have.

Jacques1 · June 21, 2016

The log-in script is a joke. This method alone is a clear sign that the author has no idea what he's doing:

function generate_password_hash($password, $user_code) {
        $hash[] = md5($password);
        $hash[] = md5($password . $user_code);
        $hash[] = md5($password) . sha1($user_code . $password) . md5(md5($password));
        $hash[] = sha1($password . $user_code . $password);
        $hash[] = md5($hash[3] . $hash[0] . $hash[1] . $hash[2] . sha1($hash[3] . $hash[2]));
        $hash[] = sha1($hash[0] . $hash[1] . $hash[2] . $hash[3]) . md5($hash[4] . $hash[4]) . sha1($user_code);
        return sha1($hash[0] . $hash[1] . $hash[2] . $hash[3] . $hash[4] . $hash[5] . md5($user_code));
}

What on earth is this supposed to do? It looks as if a cat jumped on the keyboard.

The code is also close to 10 years old, which is a very, very long time in web programming, especially in the security field. A lot has changed since 2007.

It's generally a bad idea to download random code from the Internet and put it on your server. Most of it is crap put together by amateurs, lots of it is actually malicious and will open your application to all kinds of attacks.

Either learn and write your own code. Or look for a credible library. Credible means:

It's actively maintained by professional programmers who understand security. There must be versions, updates and bugfixes, not just some lone .zip file.
It should be under version control (e. g. a GitHub project) so that you can keep track of code changes.
It must use state-of-the-art algorithms like bcrypt (which is available through the built-in password_hash() function).

To be honest, I'm not aware of any such project outside of big frameworks.

NotionCommotion · June 21, 2016

Or look for a credible library....

To be honest, I'm not aware of any such project outside of big frameworks.

I too don't know of one, but would be surprised if there isn't one.

How difficult would to take script from one of the big frameworks, and utilize it just for log-on authentication? If the logon script remains open source, and licencing concerns? Recommendations on which one to plagiarize?

benanamen · June 21, 2016

I logged into their demo and see this at the top of the page:

Deprecated: Function ereg_replace() is deprecated in /home/quadodo/public_html/includes/SQL.class.php on line 60

That is enough information to know this code is old and should not be used. OP, ditch this code. It is no good.

EricOnAdventure · June 22, 2016

Well if I ditch this one, does anyone have any advice on what I should use, I would rather not write one from scratch at this moment.

EricOnAdventure · June 22, 2016

Perhaps I should buy one on the envato market?

EricOnAdventure · June 22, 2016

Or is this something I could do next month? Right now my goal is to get the website up and running, this week ideally. I could come back later, when I have more time, and when I have a true expert near, to repair issues, such as this, in my code.

EricOnAdventure · June 22, 2016

I have decided just to buy this one
http://codecanyon.net/item/php-login-user-management/49008?s_rank=2

Hopefully I will have no issues with this.

Thanks for your advice guys

-Eric

benanamen · June 24, 2016

Eric, I have done a quick review of the code in that script. Get your money back and don't use it. There are several serious security issues with it. One of the more glaring ones is that it uses MD5 or SHA256 for password encryption. It will also output the exact server error messages directly to the user providing valuable information to a hacker.

Sign In

I need your help applying a script to more databases

Recommended Posts

EricOnAdventure

Link to comment

Share on other sites

EricOnAdventure

Link to comment

Share on other sites

ginerjm

Link to comment

Share on other sites

Jacques1

Link to comment

Share on other sites

NotionCommotion

Link to comment

Share on other sites

benanamen

Link to comment

Share on other sites

EricOnAdventure

Link to comment

Share on other sites

EricOnAdventure

Link to comment

Share on other sites

EricOnAdventure

Link to comment

Share on other sites

EricOnAdventure

Link to comment

Share on other sites

benanamen

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information