|
@@ -10,11 +10,13 @@ Doo::loadModelAt('aconfig', 'admin');
|
|
*
|
|
*
|
|
* @author NoNZero
|
|
* @author NoNZero
|
|
*/
|
|
*/
|
|
-class LoginController extends DooController {
|
|
|
|
|
|
+class LoginController extends DooController
|
|
|
|
+{
|
|
|
|
|
|
- private $data, $auth, $profile,$aconfig;
|
|
|
|
|
|
+ private $data, $auth, $profile, $aconfig;
|
|
|
|
|
|
- public function beforeRun($resource, $action) {
|
|
|
|
|
|
+ public function beforeRun($resource, $action)
|
|
|
|
+ {
|
|
$uGroups = $this->profile->getUidByname($this->auth->getUid());
|
|
$uGroups = $this->profile->getUidByname($this->auth->getUid());
|
|
if (!isset($uGroups['groups']))
|
|
if (!isset($uGroups['groups']))
|
|
$uGroups['groups'] = 'anonymous';
|
|
$uGroups['groups'] = 'anonymous';
|
|
@@ -23,60 +25,37 @@ class LoginController extends DooController {
|
|
return Doo::acl()->defaultFailedRoute;
|
|
return Doo::acl()->defaultFailedRoute;
|
|
}
|
|
}
|
|
|
|
|
|
- public function __construct() {
|
|
|
|
|
|
+ public function __construct()
|
|
|
|
+ {
|
|
$this->auth = new Auth();
|
|
$this->auth = new Auth();
|
|
$this->profile = new Uprofile();
|
|
$this->profile = new Uprofile();
|
|
$this->aconfig = new AConfig();
|
|
$this->aconfig = new AConfig();
|
|
$this->data['rootUrl'] = Doo::conf()->APP_URL;
|
|
$this->data['rootUrl'] = Doo::conf()->APP_URL;
|
|
}
|
|
}
|
|
|
|
|
|
-// public function Signup() {
|
|
|
|
-// $this->render('login', $this->data);
|
|
|
|
-// }
|
|
|
|
-// public function beforeRun($resource, $action) {
|
|
|
|
-// $uname = $this->auth->getUname();
|
|
|
|
-// if ($uname) {
|
|
|
|
-// $uGroups = $this->users->getUidByname($this->auth->getUname());
|
|
|
|
-// } else {
|
|
|
|
-// $uGroups['groups'] = 'anonymous';
|
|
|
|
-// }
|
|
|
|
-// $falg = Doo::acl()->isAllowed($uGroups['groups'], $resource, $action);
|
|
|
|
-// if (!$falg)
|
|
|
|
-// return Doo::conf()->APP_URL;
|
|
|
|
-// }
|
|
|
|
-
|
|
|
|
- public function welcome() {
|
|
|
|
|
|
+ public function welcome()
|
|
|
|
+ {
|
|
$this->render('welcome', $this->data);
|
|
$this->render('welcome', $this->data);
|
|
}
|
|
}
|
|
|
|
|
|
- public function Signin() {
|
|
|
|
|
|
+ public function Signin()
|
|
|
|
+ {
|
|
$this->data['tips'] = '';
|
|
$this->data['tips'] = '';
|
|
- // 密码采用PHPASS
|
|
|
|
- // 防止跨站采用user_agent随机串
|
|
|
|
- // 重复提交CRSF_FORM
|
|
|
|
- // 自动登录 可采用登录后生成一个可验证字符串,要求输入密码可通过网上登录查看(从客户端点击)加验证码
|
|
|
|
-// if ($this->auth->isLoggedIn())
|
|
|
|
-// return Doo::conf()->APP_URL . 'project/welcome';
|
|
|
|
if (isset($_POST['uemail']) && isset($_POST['upasswd'])) {
|
|
if (isset($_POST['uemail']) && isset($_POST['upasswd'])) {
|
|
if ($this->isValidFormHash($_POST['tokenform'])) {
|
|
if ($this->isValidFormHash($_POST['tokenform'])) {
|
|
- $retval = $this->auth->checkLogin($_POST['uemail'], $_POST['upasswd']);
|
|
|
|
- if (isset($retval['uid'])) {
|
|
|
|
- $this->auth->setUid($retval['uid']);
|
|
|
|
- $this->auth->setUemail($retval['uemail']);
|
|
|
|
- $_SESSION['token'] = sha1($this->create_randomstr() . $_SESSION['uid']);
|
|
|
|
- setcookie('token', $_SESSION['token'], 0, '/', Doo::conf()->APP_URL, FALSE, TRUE);
|
|
|
|
-// $profileArray = $this->profile->getProWithUid($this->auth->getUid());
|
|
|
|
-// if (isset($profileArray['userid'])) {
|
|
|
|
- return Doo::conf()->APP_URL . 'project/index';
|
|
|
|
-// } else {
|
|
|
|
-// return Doo::conf()->APP_URL . 'project/welcome';
|
|
|
|
-// }
|
|
|
|
-// die();
|
|
|
|
|
|
+ if ($this->aconfig->getOne(array('select' => 'onoff', 'asArray' => TRUE))['onoff']!=1) {
|
|
|
|
+ $retval = $this->auth->checkLogin($_POST['uemail'], $_POST['upasswd']);
|
|
|
|
+ if (isset($retval['uid'])) {
|
|
|
|
+ $this->auth->setUid($retval['uid']);
|
|
|
|
+ $this->auth->setUemail($retval['uemail']);
|
|
|
|
+ $_SESSION['token'] = sha1($this->create_randomstr() . $_SESSION['uid']);
|
|
|
|
+ setcookie('token', $_SESSION['token'], 0, '/', Doo::conf()->APP_URL, FALSE, TRUE);
|
|
|
|
+ return Doo::conf()->APP_URL . 'project/index';
|
|
|
|
+ } else {
|
|
|
|
+ $this->data['tips'] = '<div class="alert alert-error"><span data-icon="t" aria-hidden="true"></span> 帐号不存在或者密码错误</div>';
|
|
|
|
+ }
|
|
} else {
|
|
} else {
|
|
- $this->data['tips'] = '<div class="alert alert-error">
|
|
|
|
- <span data-icon="t" aria-hidden="true"></span> 帐号不存在或者密码错误
|
|
|
|
- </div>';
|
|
|
|
-// die();
|
|
|
|
|
|
+ $this->data['tips'] = '<div class="alert alert-error"><span data-icon="t" aria-hidden="true"></span>已停用</div>';
|
|
}
|
|
}
|
|
} else {
|
|
} else {
|
|
return Doo::conf()->APP_URL;
|
|
return Doo::conf()->APP_URL;
|
|
@@ -88,12 +67,14 @@ class LoginController extends DooController {
|
|
$this->render('login', $this->data);
|
|
$this->render('login', $this->data);
|
|
}
|
|
}
|
|
|
|
|
|
- function Signout() {
|
|
|
|
|
|
+ function Signout()
|
|
|
|
+ {
|
|
$this->auth->logout();
|
|
$this->auth->logout();
|
|
return Doo::conf()->APP_URL;
|
|
return Doo::conf()->APP_URL;
|
|
}
|
|
}
|
|
|
|
|
|
- function IsSessionHijacking() {
|
|
|
|
|
|
+ function IsSessionHijacking()
|
|
|
|
+ {
|
|
$string = $_SERVER['HTTP_USER_AGENT'];
|
|
$string = $_SERVER['HTTP_USER_AGENT'];
|
|
if (!isset($_SESSION['randstr']))
|
|
if (!isset($_SESSION['randstr']))
|
|
$_SESSION['randstr'] = $this->create_randomstr();
|
|
$_SESSION['randstr'] = $this->create_randomstr();
|
|
@@ -107,7 +88,8 @@ class LoginController extends DooController {
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
- function isLoggedIn() {
|
|
|
|
|
|
+ function isLoggedIn()
|
|
|
|
+ {
|
|
if (isset($_SESSION['token']) && isset($_COOKIE['token'])) {
|
|
if (isset($_SESSION['token']) && isset($_COOKIE['token'])) {
|
|
if ($_SESSION['token'] != $_COOKIE['token']) {
|
|
if ($_SESSION['token'] != $_COOKIE['token']) {
|
|
$this->Signout();
|
|
$this->Signout();
|
|
@@ -117,13 +99,15 @@ class LoginController extends DooController {
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
- function generateFormHash($salt) {
|
|
|
|
|
|
+ function generateFormHash($salt)
|
|
|
|
+ {
|
|
$hash = sha1(mt_rand(1, 1000000) . $salt);
|
|
$hash = sha1(mt_rand(1, 1000000) . $salt);
|
|
$_SESSION['csrf_hash'] = $hash;
|
|
$_SESSION['csrf_hash'] = $hash;
|
|
return $hash;
|
|
return $hash;
|
|
}
|
|
}
|
|
|
|
|
|
- function isValidFormHash($hash) {
|
|
|
|
|
|
+ function isValidFormHash($hash)
|
|
|
|
+ {
|
|
return $_SESSION['csrf_hash'] === $hash;
|
|
return $_SESSION['csrf_hash'] === $hash;
|
|
}
|
|
}
|
|
|
|
|
|
@@ -132,7 +116,8 @@ class LoginController extends DooController {
|
|
* @param $password 密码
|
|
* @param $password 密码
|
|
* @param $random 随机数
|
|
* @param $random 随机数
|
|
*/
|
|
*/
|
|
- function random($length, $chars = '0123456789') {
|
|
|
|
|
|
+ function random($length, $chars = '0123456789')
|
|
|
|
+ {
|
|
$hash = '';
|
|
$hash = '';
|
|
$max = strlen($chars) - 1;
|
|
$max = strlen($chars) - 1;
|
|
for ($i = 0; $i < $length; $i++) {
|
|
for ($i = 0; $i < $length; $i++) {
|
|
@@ -146,7 +131,8 @@ class LoginController extends DooController {
|
|
* @param string $lenth 长度
|
|
* @param string $lenth 长度
|
|
* @return string 字符串
|
|
* @return string 字符串
|
|
*/
|
|
*/
|
|
- function create_randomstr($lenth = 6) {
|
|
|
|
|
|
+ function create_randomstr($lenth = 6)
|
|
|
|
+ {
|
|
return $this->random($lenth, '123456789abcdefghijklmnpqrstuvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ');
|
|
return $this->random($lenth, '123456789abcdefghijklmnpqrstuvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ');
|
|
}
|
|
}
|
|
|
|
|