session.lib.php

<?php
/*
Datei : session.lib.php
Änderungen in dieser Datei nur dann vornehmen wenn Sie wissen was Sie tun!
*/
session_start();
// Variabeln definieren
if (!isset($_SESSION['login'])) $_SESSION['login'] = "";
if (!isset($_SESSION['werber'])) $_SESSION['werber'] = "0";
if (!isset($_SESSION['uid'])) $_SESSION['uid'] = "0";
if (!isset($_POST['nickname'])) $_POST['nickname'] = "";
if (!isset($_POST['passwort'])) $_POST['passwort'] = "";
if (!isset($_POST['checkid'])) $_POST['checkid'] = "";
if (!isset($_POST['autologin'])) $_POST['autologin'] = "";
if (!isset($_GET['logout'])) $_GET['logout'] = "";
if (!isset($_GET['ref'])) $_GET['ref'] = "0";

if ($_SESSION['werber'] == "0") $_SESSION['werber'] = (int)$_GET['ref'];

// Seiteneinstellungen laden...
$pageconfig = sql::$db->prepare ("SELECT * FROM `" . _VMS_ . "_seitenkonfig` LIMIT 1")->fetch();

if ($pageconfig['wartung'] == 1 && $_SESSION['uid'] != $system['admin_id']) {
    setCookie('uid', '', time() - 86400 * 30);
    setCookie('passwort', '', time() - 86400 * 30);
    setCookie('autologin', '', time() - 86400 * 30);
    $_SESSION['uid'] = "";
    $_SESSION['passwort'] = "";
    $_SESSION['login'] = "";
    header ("location: " . $system['domain'] . "/wartung.php");
    die();
}

// Login
if ($_POST['checkid'] == 'Login' && $_POST['nickname'] && $_POST['passwort']) {
    $_POST['nickname'] = addslashes($_POST['nickname']);

    $sql = sql::$db->prepare ("SELECT `k`.`uid`, `k`.`passwort`, `k`.`status`, `k`.`hinweis` FROM `" . _VMS_ . "_userdaten` AS  `u` LEFT JOIN `" . _VMS_ . "_kontodaten`  AS `k` ON `k`.`uid` = `u`.`uid` WHERE `u`.`nickname` = ? AND `k`.`passwort` = ? LIMIT 1");
    $sql -> execute(array($_POST['nickname'], md5($_POST['passwort'])));
    if ($sql -> rowCount()) {
        $login_check = $sql -> fetch();
        // Wenn User noch nicht freigeschaltet!
        if ($login_check['status'] == 0) {
            $_SESSION['uid'] = "";
            $_SESSION['passwort'] = "";
            $_SESSION['login'] = "";
            $_GET['content'] = '/error/kein_zutritt';
        }
        // Wenn beim User alles O.K. ist!
        if ($login_check['status'] == 1) {
            sql::$db->prepare ("UPDATE `" . _VMS_ . "_kontodaten` SET `login_ip` = ? , `loginzeit` = ? WHERE `uid` = ? and `passwort` = ? LIMIT 1")
                -> execute( array( $system['ip'], time(), $login_check['uid'], md5($_POST['passwort'])));
            if ($_POST['autologin'] == 'true') {
                setCookie('uid', $login_check['uid'], time() + 86400 * 30);
                setCookie('passwort', $login_check['passwort'], time() + 86400 * 30);
                setCookie('autologin', 'true', time() + 86400 * 30);
            }
            $_SESSION['uid'] = $login_check['uid'];
            $_SESSION['passwort'] = $login_check['passwort'];
            $_SESSION['login'] = "true";
            header ("location: " . $system['domain']);
            die();
        }
        // Wenn User gesperrt wurde!
        if ($login_check['status'] == 2) {
            $_SESSION['uid'] = "";
            $_SESSION['passwort'] = "";
            $_SESSION['login'] = "";
            $_GET['content'] = '/error/user_gesperrt';
        }
        // Wenn es den User garnicht giebt
    } else {
        $_GET['content'] = '/error/kein_zutritt';
    }
} else {
    if ($_POST['checkid'] == 'Login') $_GET['content'] = '/error/kein_zutritt';
}

// Autologin
if ($_SESSION['login'] != 'true' && isset($_COOKIE['autologin']) && isset($_COOKIE['uid']) && isset($_COOKIE['passwort'])) {
    $_COOKIE['uid'] = (int)$_COOKIE['uid'];
    $_COOKIE['passwort'] = addslashes ($_COOKIE['passwort']);

    $sql = sql::$db->prepare ("SELECT `uid`,`passwort`,`status`,`hinweis` FROM `" . _VMS_ . "_kontodaten` WHERE `uid` = ? and `passwort` = ? LIMIT 1");
    $sql -> execute( array( $_COOKIE['uid'], $_COOKIE['passwort']));
    if ($sql -> rowCount()) {
        $login_check = $sql -> fetch();
        if ($login_check['status'] == 1) {
            sql::$db->prepare ("UPDATE `" . _VMS_ . "_kontodaten` SET `login_ip` = ? , `loginzeit` = ? WHERE `uid` = ? and `passwort` = ? LIMIT 1")
                -> execute( array( $system['ip'], time(), $login_check['uid'], md5($_COOKIE['passwort'])));
            $_SESSION['uid'] = $login_check['uid'];
            $_SESSION['passwort'] = $login_check['passwort'];
            $_SESSION['login'] = "true";
        }
    }
}

// Logout
if ($_GET['logout'] == 'true') {
    setCookie('uid', '', time() - 86400 * 30);
    setCookie('passwort', '', time() - 86400 * 30);
    setCookie('autologin', '', time() - 86400 * 30);
    $_SESSION['uid'] = "";
    $_SESSION['passwort'] = "";
    $_SESSION['login'] = "";
    header ("location: " . $system['domain']);
    die();
}
if (isset ($_SESSION['uid']) && isset ($_SESSION['passwort']) && !empty ($_SESSION['uid']) && !empty ($_SESSION['passwort'])) {
    sql::$db->prepare ("UPDATE `" . _VMS_ . "_kontodaten` SET `last_active` = ? WHERE `uid` = ? AND `passwort` = ? LIMIT 1")
        -> execute( array( time(), $_SESSION['uid'], $_SESSION['passwort']));
}

?>