sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 4.1.19

Browse Source
This commit is contained in:
Neo committed 2025-12-19 05:38:56 -08:00
1 parent 28bd025b35
commit 2bd5025018
2674 files changed
+233518 -77766
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

applications/core/modules/front/system/login.php
+135 -44
View File
@@ -2,9 +2,9 @@
/**
* @brief Login
* @author <a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
* @copyright (c) 2001 - SVN_YYYY Invision Power Services, Inc.
* @copyright (c) 2001 - 2016 Invision Power Services, Inc.
* @license http://www.invisionpower.com/legal/standards/
* @package IPS Social Suite
* @package IPS Community Suite
* @since 7 Jun 2013
* @version SVN_VERSION_NUMBER
*/
@@ -46,29 +46,13 @@ class _login extends \IPS\Dispatcher\Controller
$login = new \IPS\Login( \IPS\Http\Url::internal( "app=core&module=system&controller=login", 'front', 'login', NULL, \IPS\Settings::i()->logins_over_https ) );
/* Process */
$error = isset( \IPS\Request::i()->_err ) ? \IPS\Request::i()->_err : NULL;
$error = isset( \IPS\Request::i()->_err ) && \IPS\Member::loggedIn()->language()->checkKeyExists( \IPS\Request::i()->_err ) ? \IPS\Request::i()->_err : NULL;
try
{
$member = $login->authenticate();
if ( $member !== NULL )
{
$this->_doLogin( $member, $login->flags['signin_anonymous'], $login->flags['remember_me'] );
if ( \IPS\Request::i()->isAjax() )
{
$response = array( 'status' => 'success' );
if( !empty( \IPS\Request::i()->ref ) )
{
$response['redirect'] = \IPS\Request::i()->ref;
}
\IPS\Output::i()->json( $response );
}
else
{
\IPS\Output::i()->redirect( \IPS\Login::getDestination()->setQueryString( '_fromLogin', 1 ) );
}
$this->_doLogin( $member, $login->flags['signin_anonymous'], $login->flags['remember_me'], \IPS\Login::getDestination() );
}
}
catch ( \IPS\Login\Exception $e )
@@ -78,7 +62,12 @@ class _login extends \IPS\Dispatcher\Controller
$e->member = $e->member->member_id;
$_SESSION['linkAccounts'] = json_encode( $e );
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=system&controller=login&do=link', 'front', 'login' ) );
$linkUrl = \IPS\Http\Url::internal( 'app=core&module=system&controller=login&do=link', 'front', 'login' );
if ( isset( \IPS\Request::i()->ref ) )
{
$linkUrl = $linkUrl->setQueryString( 'ref', \IPS\Request::i()->ref );
}
\IPS\Output::i()->redirect( $linkUrl );
}
$error = $e->getMessage();
@@ -105,25 +94,43 @@ class _login extends \IPS\Dispatcher\Controller
/**
* Process the login
*
* @param \IPS\Member $member The member
* @param bool $anonymous If the login is anonymous
* @param bool $rememberMe If the "remember me" checkbox was checked
* @param \IPS\Member $member The member
* @param bool $anonymous If the login is anonymous
* @param bool $rememberMe If the "remember me" checkbox was checked
* @param \IPS\Http\Url $destination Where to redirect to
* @param bool $bypass2FA If true, will not perform 2FA check
* @return void
*/
protected function _doLogin( $member, $anonymous=FALSE, $rememberMe=TRUE )
protected function _doLogin( $member, $anonymous=FALSE, $rememberMe=TRUE, $destination=NULL, $bypass2FA=FALSE )
{
/* Get destination */
if ( !$destination )
{
$destination = \IPS\Http\Url::internal( '' );
}
/* Do we need to do 2FA? */
if ( !$bypass2FA and $output = \IPS\MFA\MFAHandler::accessToArea( 'core', 'AuthenticateFront', \IPS\Http\Url::internal( '' ), $member ) )
{
$_SESSION['processing2FA'] = array( 'memberId' => $member->member_id, 'anonymous' => $anonymous, 'remember' => $rememberMe, 'destination' => (string) $destination );
\IPS\Output::i()->redirect( $destination->setQueryString( '_mfaLogin', 1 ) );
}
/* Set anonymous cookie */
if ( $anonymous and !\IPS\Settings::i()->disable_anonymous )
{
\IPS\Session::i()->setAnon();
\IPS\Request::i()->setCookie( 'anon_login', 1 );
}
/* Log in */
\IPS\Session::i()->setMember( $member );
/* Set remember me cookie */
if ( $rememberMe )
{
$expire = new \IPS\DateTime;
$expire->add( new \DateInterval( 'P7D' ) );
$expire->add( new \DateInterval( 'P3M' ) );
\IPS\Request::i()->setCookie( 'member_id', $member->member_id, $expire );
\IPS\Request::i()->setCookie( 'pass_hash', $member->member_login_key, $expire );
@@ -133,7 +140,65 @@ class _login extends \IPS\Dispatcher\Controller
}
}
/* Member sync */
$member->memberSync( 'onLogin', array( \IPS\Login::getDestination() ) );
/* Redirect */
\IPS\Output::i()->redirect( $destination->setQueryString( '_fromLogin', 1 ), '', 303 );
}
/**
* MFA
*
* @return void
*/
protected function mfa()
{
/* Have we logged in? */
$member = NULL;
if ( isset( $_SESSION['processing2FA'] ) )
{
$member = \IPS\Member::load( $_SESSION['processing2FA']['memberId'] );
}
if ( !$member->member_id )
{
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=system&controller=login', 'front', 'login' ) );
}
/* Where do we want to go? */
$destination = NULL;
try
{
$destination = \IPS\Http\Url::createFromString( $_SESSION['processing2FA']['destination'] );
}
catch ( \Exception $e ) { }
/* Have we already done 2FA? */
$output = \IPS\MFA\MFAHandler::accessToArea( 'core', 'AuthenticateFront', \IPS\Http\Url::internal( 'app=core&module=system&controller=login&do=mfa', 'front', 'login' ), $member );
if ( !$output )
{
$this->_doLogin( $member, $_SESSION['processing2FA']['anonymous'], $_SESSION['processing2FA']['remember'], $destination, TRUE );
}
/* Nope, just send us where we want to go not logged in */
$qs = array( '_mfaLogin' => 1 );
if ( isset( \IPS\Request::i()->_mfa ) )
{
$qs['_mfa'] = \IPS\Request::i()->_mfa;
if ( isset( \IPS\Request::i()->_mfaMethod ) )
{
$qs['_mfaMethod'] = \IPS\Request::i()->_mfaMethod;
}
}
elseif ( isset( \IPS\Request::i()->mfa_auth ) )
{
$qs['mfa_auth'] = \IPS\Request::i()->mfa_auth;
}
elseif ( isset( \IPS\Request::i()->mfa_setup ) )
{
$qs['mfa_setup'] = \IPS\Request::i()->mfa_setup;
}
\IPS\Output::i()->redirect( $destination->setQueryString( $qs ) );
}
/**
@@ -156,7 +221,11 @@ class _login extends \IPS\Dispatcher\Controller
}
$form = new \IPS\Helpers\Form( 'link_accounts', 'login' );
$form->addDummy( 'email_address', isset( $details['email'] ) ? $details['email'] : $member->email );
if ( isset( \IPS\Request::i()->ref ) )
{
$form->hiddenValues['ref'] = \IPS\Request::i()->ref;
}
$form->addDummy( 'email_address', htmlspecialchars( isset( $details['email'] ) ? $details['email'] : $member->email, \IPS\HTMLENTITIES, 'UTF-8', FALSE ) );
$form->add( new \IPS\Helpers\Form\Password( 'password', NULL, TRUE, array( 'validateFor' => $member ) ) );
if ( $values = $form->values() )
{
@@ -166,9 +235,21 @@ class _login extends \IPS\Dispatcher\Controller
$class::link( $member, $details['details'] );
unset( $_SESSION['linkAccounts'] );
$this->_doLogin( $member );
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( '' ) );
$destination = NULL;
if ( isset( \IPS\Request::i()->ref ) )
{
try
{
$ref = \IPS\Http\Url::createFromString( base64_decode( \IPS\Request::i()->ref ) );
if ( $ref instanceof \IPS\Http\Url\Internal )
{
$destination = $ref;
}
}
catch ( \Exception $e ) { }
}
$this->_doLogin( $member, FALSE, TRUE, $destination );
}
catch ( \IPS\Login\Exception $e )
{
@@ -191,22 +272,10 @@ class _login extends \IPS\Dispatcher\Controller
{
\IPS\Session::i()->csrfCheck();
\IPS\Request::i()->setCookie( 'member_id', NULL );
\IPS\Request::i()->setCookie( 'pass_hash', NULL );
\IPS\Request::i()->setCookie( 'anon_login', NULL );
foreach( \IPS\Request::i()->cookie as $name => $value )
{
if( mb_strpos( $name, "ipbforumpass_" ) !== FALSE )
{
\IPS\Request::i()->setCookie( $name, NULL );
}
}
if( !empty( $_SERVER['HTTP_REFERER'] ) )
{
$referrer = new \IPS\Http\Url( $_SERVER['HTTP_REFERER'] );
$redirectUrl = ( $referrer->isInternal and isset( $referrer->queryString['do'] ) and $referrer->queryString['do'] != 'validating' ) ? $referrer : \IPS\Http\Url::internal('');
$referrer = \IPS\Http\Url::createFromString( $_SERVER['HTTP_REFERER'] );
$redirectUrl = ( $referrer instanceof \IPS\Http\Url\Internal and ( !isset( $referrer->queryString['do'] ) or $referrer->queryString['do'] != 'validating' ) ) ? $referrer : \IPS\Http\Url::internal('');
}
else
{
@@ -226,6 +295,28 @@ class _login extends \IPS\Dispatcher\Controller
\IPS\Output::i()->redirect( $redirectUrl );
}
\IPS\Request::i()->setCookie( 'member_id', NULL );
\IPS\Request::i()->setCookie( 'pass_hash', NULL );
\IPS\Request::i()->setCookie( 'anon_login', NULL );
foreach( \IPS\Request::i()->cookie as $name => $value )
{
if( mb_strpos( $name, "ipbforumpass_" ) !== FALSE )
{
\IPS\Request::i()->setCookie( $name, NULL );
}
}
/* Reset session global parameters */
$_SESSION = array();
/* We have to explicitly reset the session cookie
@link http://php.net/manual/en/function.session-destroy.php */
$params = session_get_cookie_params();
setcookie( session_name(), '', time() - 42000, $params["path"], $params["domain"], $params["secure"], $params["httponly"] );
/* Then destroy the session itself */
session_destroy();
/* Login handler callback */
@@ -268,7 +359,7 @@ class _login extends \IPS\Dispatcher\Controller
/* Do it */
$_SESSION['logged_in_from'] = array( 'id' => $admin->member_id, 'name' => $admin->name );
$unique_id = md5( uniqid() );
$unique_id = \IPS\Login::generateRandomString();
$_SESSION['logged_in_as_key'] = $unique_id;
\IPS\Data\Store::i()->$unique_id = $member->member_id;