Browse Source

mod panel

pull/40/head
Savetheinternet 14 years ago
committed by Paul Merrill
parent
commit
529da36330
  1. 12
      inc/config.php
  2. 14
      inc/display.php
  3. 16
      inc/functions.php
  4. 14
      inc/instance-config.php
  5. 90
      inc/user.php

12
inc/config.php

@ -23,8 +23,13 @@
define('TIME_COOKIE', 'arrived', true);
// HASH_COOKIE contains an MD5 hash of TIME_COOKIE+SALT for verification.
define('HASH_COOKIE', 'hash', true);
// Used for moderation login
define('MOD_COOKIE', 'mod', true);
// Where to set the 'path' parameter to ROOT when creating cookies. Recommended.
define('JAIL_COOKIES', true, true);
// Whether or not to lock moderator sessions to the IP address that was logged in with.
define('MOD_LOCK_IP', true, true);
// How long should the cookies last (in seconds)
define('COOKIE_EXPIRE', 15778463, true); //6 months
@ -60,7 +65,12 @@
define('ERR_FILESIZE', 'Maximum file size: %maxsz% bytes<br>Your file\'s size: %filesz% bytes', true);
define('ERR_MAXSIZE', 'The file was too big.', true);
define('ERR_INVALIDZIP','Invalid archive!', true);
// Moderator errors
define('ERROR_INVALID', 'Invalid username and/or password.', true);
define('ERROR_INVALIDAFTER', 'Invalid username and/or password. Your user may have been deleted or changed.');
define('ERROR_MALFORMED','Invalid/malformed cookies.', true);
// For resizing, max values
define('THUMB_WIDTH', 200, true);
define('THUMB_HEIGHT', 200, true);

14
inc/display.php

@ -34,6 +34,20 @@
)));
}
function loginForm($error=false, $username=false) {
if(function_exists('sql_close')) sql_close();
die(Element('page.html', Array(
'index'=>ROOT,
'title'=>'Login',
'body'=>Element('login.html', Array(
'index'=>ROOT,
'error'=>$error,
'username'=>$username
)
)
)));
}
class Post {
public function __construct($id, $thread, $subject, $email, $name, $trip, $body, $time, $thumb, $thumbx, $thumby, $file, $filex, $filey, $filesize, $filename) {
$this->id = $id;

16
inc/functions.php

@ -318,7 +318,7 @@
return $result;
}
function buildThread($id) {
function buildThread($id, $return=false) {
global $sql, $board;
$id = round($id);
@ -335,7 +335,19 @@
} else {
$thread->add(new Post($post['id'], $thread->id, $post['subject'], $post['email'], $post['name'], $post['trip'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename']));
}
@file_put_contents($board['dir'] . DIR_RES . $id . '.html', Element('thread.html', Array('button'=>BUTTON_REPLY, 'board'=>$board, 'body'=>$thread->build(), 'post_url' => POST_URL, 'index' => ROOT, 'id' => $id))) or error("Couldn't write to file.");
$body = Element('thread.html', Array(
'button'=>BUTTON_REPLY,
'board'=>$board,
'body'=>$thread->build(),
'post_url' => POST_URL,
'index' => ROOT,
'id' => $id
));
if($return)
return $body;
else
@file_put_contents($board['dir'] . DIR_RES . $id . '.html', $body) or error("Couldn't write to file.");
}
mysql_free_result($query);
}

14
inc/instance-config.php

@ -8,16 +8,16 @@
* You can copy values from config.php (defaults) and paste them here.
*/
/*
// Database stuff
define('MY_SERVER', 'localhost');
define('MY_USER', '');
define('MY_PASSWORD', '');
define('MY_DATABASE', '');
define('MY_SERVER', '127.0.0.1');
define('MY_USER', 'imgboard');
define('MY_PASSWORD', 'DF3uHz4vvhUM6rCq');
define('MY_DATABASE', 'imgboard');
define('ROOT', '/');
define('ROOT', '/board/');
// define('FOO', 'bar');
*/
?>

90
inc/user.php

@ -15,9 +15,97 @@
if(!isset($_COOKIE[HASH_COOKIE]) || !isset($_COOKIE[TIME_COOKIE]) || $_COOKIE[HASH_COOKIE] != md5($_COOKIE[TIME_COOKIE].SALT)) {
$time = time();
setcookie(TIME_COOKIE, $time, time()+COOKIE_EXPIRE, JAIL_COOKIES?ROOT:'/', null, false, true);
setcookie(HASH_COOKIE, md5(time().SALT), time()+COOKIE_EXPIRE, JAIL_COOKIES?ROOT:'/', null, false, true);
setcookie(HASH_COOKIE, md5($time.SALT), $time+COOKIE_EXPIRE, JAIL_COOKIES?ROOT:'/', null, false, true);
$user = Array('valid' => false, 'appeared' => $time);
} else {
$user = Array('valid' => true, 'appeared' => $_COOKIE[TIME_COOKIE]);
}
// 'false' means that the user is not logged in as a moderator
$mod = false;
// Creates a small random string for validating moderators' cookies
function mkhash($length=12) {
// The method here isn't really important,
// but I think this generates a relatively
// unique string that looks cool.
// If you choose to change this, make sure it cannot include a ':' character.
return substr(base64_encode(sha1(rand() . time(), true)), 0, $length);
}
function login($username, $password, $makehash=true) {
global $sql, $mod;
// SHA1 password
if($makehash) {
$password = sha1($password);
}
$res = mysql_query(sprintf(
"SELECT `id`,`type` FROM `mods` WHERE `username` = '%s' AND `password` = '%s' LIMIT 1",
mysql_real_escape_string($username),
$password
), $sql) or error(mysql_error($sql));
if($user = mysql_fetch_array($res)) {
return $mod = Array(
'id' => $user['id'],
'type' => $user['type'],
'username' => $username,
'password' => $password,
'hash' => mkhash()
);
} else return false;
}
function setCookies() {
global $mod;
if(!$mod) error('setCookies() was called for a non-moderator!');
// MOD_COOKIE contains username:hash
setcookie(MOD_COOKIE, $mod['username'] . ':' . $mod['hash'], time()+COOKIE_EXPIRE, JAIL_COOKIES?ROOT:'/', null, false, true);
// Put $mod in the session
$_SESSION['mod'] = $mod;
// Lock sessions to IP addresses
if(MOD_LOCK_IP)
$_SESSION['mod']['ip'] = $_SERVER['REMOTE_ADDR'];
}
function destroyCookies() {
// Delete the cookies
setcookie(MOD_COOKIE, 'deleted', time()-COOKIE_EXPIRE, JAIL_COOKIES?ROOT:'/', null, false, true);
// Unset the session
unset($_SESSION['mod']);
}
if(isset($_COOKIE['mod']) && isset($_SESSION['mod']) && is_array($_SESSION['mod'])) {
// Should be username:session hash
$cookie = explode(':', $_COOKIE['mod']);
if(count($cookie) != 2) {
destroyCookies();
error(ERROR_MALFORMED);
}
// Validate session
if( $cookie[0] != $_SESSION['mod']['username'] ||
$cookie[1] != $_SESSION['mod']['hash']) {
// Malformed cookies
destroyCookies();
error(ERROR_MALFORMED);
}
// Open connection
sql_open();
// Check username/password
if(!login($_SESSION['mod']['username'], $_SESSION['mod']['password'], false)) {
destroyCookies();
error(ERROR_INVALIDAFTER);
}
$mod = $_SESSION['mod'];
}
?>
Loading…
Cancel
Save