Cod: Selectaţi tot
ini_set('session.bug_compat_warn', 0);
ini_set('session.bug_compat_42', 0);
class Session
{
var $username; //Username given on sign-up
var $userid; //Random value generated on current login
var $userlevel; //The level to which the user pertains
var $time; //Time user was last active (page loaded)
var $logged_in; //True if user is logged in, false otherwise
var $userinfo = array(); //The array holding all user info
var $url; //The page url current being viewed
var $referrer; //Last recorded site page viewed
/**
* Note: referrer should really only be considered the actual
* page referrer in process.php, any other time it may be
* inaccurate.
*/
/* Class constructor */
function Session(){
$this->time = time();
$this->startSession();
}
/**
* startSession - Performs all the actions necessary to
* initialize this session object. Tries to determine if the
* the user has logged in already, and sets the variables
* accordingly. Also takes advantage of this page load to
* update the active visitors tables.
*/
function startSession(){
global $database; //The database connection
session_start(); //Tell PHP to start the session
/* Determine if user is logged in */
$this->logged_in = $this->checkLogin();
/**
* Set guest value to users not logged in, and update
* active guests table accordingly.
*/
if(!$this->logged_in){
$this->username = $_SESSION['username'] = GUEST_NAME;
$this->userlevel = GUEST_LEVEL;
$database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);
}
/* Update users last active timestamp */
else{
$database->addActiveUser($this->username, $this->time);
}
/* Remove inactive visitors from database */
$database->removeInactiveUsers();
$database->removeInactiveGuests();
/* Set referrer page */
if(isset($_SESSION['url'])){
$this->referrer = $_SESSION['url'];
}else{
$this->referrer = "/";
}
/* Set current url */
$this->url = $_SESSION['url'] = $_SERVER['REQUEST_URI'];
}
/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
global $database; //The database connection
/* Check if user has been remembered */
if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
$this->username = $_SESSION['username'] = $_COOKIE['cookname'];
$this->userid = $_SESSION['userid'] = $_COOKIE['cookid'];
}
/* Username and userid have been set and not guest */
if(isset($_SESSION['username']) && isset($_SESSION['userid']) &&
$_SESSION['username'] != GUEST_NAME){
/* Confirm that username and userid are valid */
if($database->confirmUserID($_SESSION['username'], $_SESSION['userid']) != 0){
/* Variables are incorrect, user not logged in */
unset($_SESSION['username']);
unset($_SESSION['userid']);
return false;
}
/* User is logged in, set class variables */
$this->userinfo = $database->getUserInfo($_SESSION['username']);
$this->username = $this->userinfo['username'];
$this->userid = $this->userinfo['userid'];
$this->userlevel = $this->userinfo['userlevel'];
return true;
}
/* User not logged in */
else{
return false;
}
}
/**
* login - The user has submitted his username and password
* through the login form, this function checks the authenticity
* of that information in the database and creates the session.
* Effectively logging in the user if all goes well.
*/
function login($subuser, $subpass, $subremember){
global $database, $form; //The database and form object
/* Username error checking */
$field = "user"; //Use field name for username
$q = "SELECT valid FROM ".TBL_USERS." WHERE username='$subuser'";
$valid = $database->query($q);
$valid = mysql_fetch_array($valid);
if(!$subuser || strlen($subuser = trim($subuser)) == 0){
$form->setError($field, "* Introduceti numele de utilizator");
}
/* Password error checking */
$field = "pass"; //Use field name for password
if(!$subpass){
$form->setError($field, "* Introduceti parola");
}
/* Return if form errors exist */
if($form->num_errors > 0){
return false;
}
/* Checks that username is in database and password is correct */
$subuser = stripslashes($subuser);
$result = $database->confirmUserPass($subuser, md5($subpass));
/* Check error codes */
if($result == 1){
$field = "user";
$form->setError($field, "* Numele de utilizator nu exista");
}
else if($result == 2){
$field = "pass";
$form->setError($field, "* Parola incorecta");
}
/* Return if form errors exist */
if($form->num_errors > 0){
return false;
}
if(EMAIL_WELCOME){
if($valid['valid'] == 0){
$form->setError($field, "* Contul cu acest nume nu a fost inca confirmat");
}
}
/* Return if form errors exist */
if($form->num_errors > 0){
return false;
}
/* Username and password correct, register session variables */
$this->userinfo = $database->getUserInfo($subuser);
$this->username = $_SESSION['username'] = $this->userinfo['username'];
$this->userid = $_SESSION['userid'] = $this->generateRandID();
$this->userlevel = $this->userinfo['userlevel'];
/* Insert userid into database and update active users table */
$database->updateUserField($this->username, "userid", $this->userid);
$database->addActiveUser($this->username, $this->time);
$database->removeActiveGuest($_SERVER['REMOTE_ADDR']);
/**
* This is the cool part: the user has requested that we remember that
* he's logged in, so we set two cookies. One to hold his username,
* and one to hold his random value userid. It expires by the time
* specified in constants.php. Now, next time he comes to our site, we will
* log him in automatically, but only if he didn't log out before he left.
*/
setcookie("cookname", $this->username, time()+COOKIE_EXPIRE, COOKIE_PATH);
setcookie("cookid", $this->userid, time()+COOKIE_EXPIRE, COOKIE_PATH);
/* Login completed successfully */
return true;
}
/**
* logout - Gets called when the user wants to be logged out of the
* website. It deletes any cookies that were stored on the users
* computer as a result of him wanting to be remembered, and also
* unsets session variables and demotes his user level to guest.
*/
function logout(){
global $database; //The database connection
/**
* Delete cookies - the time must be in the past,
* so just negate what you added when creating the
* cookie.
*/
if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
setcookie("cookname", "", time()-COOKIE_EXPIRE, COOKIE_PATH);
setcookie("cookid", "", time()-COOKIE_EXPIRE, COOKIE_PATH);
}
/* Unset PHP session variables */
unset($_SESSION['username']);
unset($_SESSION['userid']);
/* Reflect fact that user has logged out */
$this->logged_in = false;
/**
* Remove from active users table and add to
* active guests tables.
*/
$database->removeActiveUser($this->username);
$database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);
/* Set user level to guest */
$this->username = GUEST_NAME;
$this->userlevel = GUEST_LEVEL;
}
/**
* register - Gets called when the user has just submitted the
* registration form. Determines if there were any errors with
* the entry fields, if so, it records the errors and returns
* 1. If no errors were found, it registers the new user and
* returns 0. Returns 2 if registration failed.
*/
function register($subuser, $subpass, $subemail, $subname, $subadresa, $subserie_ci, $suboras, $subtelefon, $subfirma, $subcui_firma, $subj_firma, $subadr_firma){
global $database, $form, $mailer; //The database, form and mailer object
/* Username error checking */
$field = "user"; //Use field name for username
if(!$subuser || strlen($subuser = trim($subuser)) == 0){
$form->setError($field, "* Introduceti un nume de utilizator");
}
else{
/* Spruce up username, check length */
$subuser = stripslashes($subuser);
if(strlen($subuser) < 5){
$form->setError($field, "* Numele de utilizator trebuie sa fie de minim 5 caractere");
}
else if(strlen($subuser) > 30){
$form->setError($field, "* Numele de utilizator trebuie sa fie de maxim 30 caractere");
}
/* Check if username is not alphanumeric */
else if(!ctype_alnum($subuser)){
$form->setError($field, "* Numele de utilizator trebuie sa contina doar cifre si litere");
}
/* Check if username is reserved */
else if(strcasecmp($subuser, GUEST_NAME) == 0){
$form->setError($field, "* Numele de utilizator este rezervat");
}
/* Check if username is already in use */
else if($database->usernameTaken($subuser)){
$form->setError($field, "* Numele de utilizator este folosit");
}
/* Check if username is banned */
else if($database->usernameBanned($subuser)){
$form->setError($field, "* Numele de utilizator este banat");
}
}
/* Password error checking */
$field = "pass"; //Use field name for password
if(!$subpass){
$form->setError($field, "* Introduceti o parola");
}
else{
/* Spruce up password and check length*/
$subpass = stripslashes($subpass);
if(strlen($subpass) < 4){
$form->setError($field, "* Parola este prea scurta");
}
/* Check if password is not alphanumeric */
else if(!ctype_alnum(($subpass = trim($subpass)))){
$form->setError($field, "* Parola trebuie sa contina doar cifre si litere");
}
/**
* Note: I trimmed the password only after I checked the length
* because if you fill the password field up with spaces
* it looks like a lot more characters than 4, so it looks
* kind of stupid to report "password too short".
*/
}
/* Email error checking */
$field = "email"; //Use field name for email
if(!$subemail || strlen($subemail = trim($subemail)) == 0){
$form->setError($field, "* Introduceti adresa dvs de e-mail");
}
else{
/* Check if valid email address */
if(filter_var($subemail, FILTER_VALIDATE_EMAIL) == FALSE){
$form->setError($field, "* Adresa de e-mail este incorecta");
}
/* Check if email is already in use */
if($database->emailTaken($subemail)){
$form->setError($field, "* Adresa de e-mail este folosita");
}
$subemail = stripslashes($subemail);
}
/* Oras error checking */
$field = "oras";
if(!$suboras || strlen($suboras = trim($suboras)) == 0){
$form->setError($field, "* Selectati judetul");
} else {
$suboras = stripslashes($suboras);
}
/* Telephone error checking */
$field = "telefon";
if(!$subtelefon || strlen($subtelefon = trim($subtelefon)) == 0){
$form->setError($field, "* Introduceti numarul dvs de telefon");
} else {
/* Check if telefon is not numeric */
if(!ctype_digit($subtelefon)){
$form->setError($field, "* Numarul de telefon trebuie sa contina doar numere");
}
$subtelefon = stripslashes($subtelefon);
}
/* Name error checking */
$field = "name";
if(!$subname || strlen($subname = trim($subname)) == 0){
$form->setError($field, "* Introduceti numele si prenumele dvs");
} else {
$subname = stripslashes($subname);
}
$randid = $this->generateRandID();
/* Errors exist, have user correct them */
if($form->num_errors > 0){
return 1; //Errors with form
}
/* No errors, add the new account to the */
else{
if($database->addNewUser($subuser, md5($subpass), $subemail, $randid, $subname, $subadresa, $subserie_ci, $suboras, $subtelefon, $subfirma, $subcui_firma, $subj_firma, $subadr_firma)){
if(EMAIL_WELCOME){
$mail = new PHPMailer();
$body = $subuser.",<br><br>"
."Buna ziua! Tocmai v-ati inregistrat pe site "
."cu urmatoarele informatii:<br><br>"
."Nume de utilizator: ".$subuser."<br>"
."Parola: ".$subpass."<br><br>"
."Pentru a va conecta pe site, mai intai trebuie "
."sa va activati contul accesand link-ul de mai jos:<br><br>"
."<a href=".SITE."cont-utilizator/confirmare-email.html?qs1=".$subuser."&qs2=".$randid.">".SITE."cont-utilizator/confirmare-email.html?qs1=".$subuser."&qs2=".$randid."</a><br><br>"
."Daca uitati sau pierdeti parola, "
."o parola noua va fi generata si trimisa "
."la aceasta adresa dvs de e-mail. Puteti sa schimbati adresa "
."de e-mail oricand accesand sectiunea Editare informatii profil din contul dvs "
."dupa ce v-ati conectat.<br><br>"
."- PieseTractor.ro";
$body = eregi_replace("[\]",'',$body);
$mail->IsSMTP(); // telling the class to use SMTP
$mail->Host = 'mail.dpat.ro'; // SMTP server
$mail->SMTPDebug = 0; // enables SMTP debug information (for testing)
// 1 = errors and messages
// 2 = messages only
$mail->SMTPAuth = true; // enable SMTP authentication
$mail->Host = 'mail.dpat.ro'; // sets the SMTP server
$mail->Port = 26; // set the SMTP port for the GMAIL server
$mail->Username = 'mail@piesetractor.ro'; // SMTP account username
$mail->Password = 'Moira-2014'; // SMTP account password
$mail->SetFrom('mail@piesetractor.ro', 'PieseTractor.ro');
$mail->AddReplyTo('mail@piesetractor.ro', 'PieseTractor.ro');
$mail->Subject = "PieseTractor.ro - Bine ati venit!";
$mail->MsgHTML($body);
$mail->AddAddress($subemail);
if($mail->Send()) { }
}
return 0; //New user added succesfully
}else{
return 2; //Registration attempt failed
}
}
}
/**
* editAccount - Attempts to edit the user's account information
* including the password, which it first makes sure is correct
* if entered, if so and the new password is in the right
* format, the change is made. All other fields are changed
* automatically.
*/
function editAccount($subcurpass, $subnewpass, $subemail, $subname, $subadresa, $subserie_ci, $suboras, $subtelefon, $subfirma, $subcui_firma, $subj_firma, $subadr_firma){
global $database, $form; //The database and form object
/* New password entered */
if($subnewpass){
/* Current Password error checking */
$field = "curpass"; //Use field name for current password
if(!$subcurpass){
$form->setError($field, "* Introduceti parola curenta");
}
else{
/* Password entered is incorrect */
if($database->confirmUserPass($this->username,md5($subcurpass)) != 0){
$form->setError($field, "* Parola curenta este incorecta");
}
}
/* New Password error checking */
$field = "newpass"; //Use field name for new password
/* Spruce up password and check length*/
$subpass = stripslashes($subnewpass);
if(strlen($subnewpass) < 4){
$form->setError($field, "* Parola noua este prea scurta");
}
/* Check if password is not alphanumeric */
else if(!ctype_alnum(($subpass = trim($subpass)))){
$form->setError($field, "* Parola trebuie sa contina doar cifre si litere");
}
}
/* Change password attempted */
else if($subcurpass){
/* New Password error reporting */
$field = "newpass"; //Use field name for new password
$form->setError($field, "* Introduceti o parola noua");
}
/* Email error checking */
$field = "email"; //Use field name for email
if($subemail && strlen($subemail = trim($subemail)) > 0){
/* Check if valid email address */
if(filter_var($subemail, FILTER_VALIDATE_EMAIL) == FALSE){
$form->setError($field, "* Adresa de e-mail este incorecta");
}
$subemail = stripslashes($subemail);
}
/* Adresa error checking */
$field = "adresa";
if(!$subadresa || strlen($subadresa = trim($subadresa)) == 0){
$form->setError($field, "* Introduceti adresa de livrare");
} else {
$subadresa = stripslashes($subadresa);
}
/* Serie CI error checking */
$field = "serie_ci";
if(!$subserie_ci || strlen($subserie_ci = trim($subserie_ci)) == 0){
$form->setError($field, "* Introduceti seria dvs de buletin");
} else {
$subserie_ci = stripslashes($subserie_ci);
}
/* Oras error checking */
$field = "oras";
if(!$suboras || strlen($suboras = trim($suboras)) == 0){
$form->setError($field, "* Selectati orasul");
} else {
$suboras = stripslashes($suboras);
}
/* Telephone error checking */
$field = "telefon";
if(!$subtelefon || strlen($subtelefon = trim($subtelefon)) == 0){
$form->setError($field, "* Introduceti numarul dvs de telefon");
} else {
/* Check if telefon is not numeric */
if(!ctype_digit($subtelefon)){
$form->setError($field, "* Numarul de telefon trebuie sa contina doar numere");
}
$subtelefon = stripslashes($subtelefon);
}
/* Name error checking */
$field = "name";
if(!$subname || strlen($subname = trim($subname)) == 0){
$form->setError($field, "* Introduceti numele si prenumele dvs");
} else {
$subname = stripslashes($subname);
}
/* Errors exist, have user correct them */
if($form->num_errors > 0){
return false; //Errors with form
}
/* Update password since there were no errors */
if($subcurpass && $subnewpass){
$database->updateUserField($this->username,"password",md5($subnewpass));
}
/* Change Email */
if($subemail){
$database->updateUserField($this->username,"email",$subemail);
}
/* Change Name */
if($subname){
$database->updateUserField($this->username,"name",$subname);
}
/* Change Telephone */
if($subtelefon){
$database->updateUserField($this->username,"telefon",$subtelefon);
}
/* Change Adresa */
if($subadresa){
$database->updateUserField($this->username,"adresa",$subadresa);
}
/* Change Serie CI */
if($subserie_ci){
$database->updateUserField($this->username,"serie_ci",$subserie_ci);
}
/* Change Firma */
$database->updateUserField($this->username,"firma",$subfirma);
/* Change CUI Firma */
$database->updateUserField($this->username,"cui_firma",$subcui_firma);
/* Change J Firma */
$database->updateUserField($this->username,"j_firma",$subj_firma);
/* Change Adresa Firma */
$database->updateUserField($this->username,"adr_firma",$subadr_firma);
/* Change Oras */
if($suboras){
$database->updateUserField($this->username,"oras",$suboras);
}
/* Success! */
return true;
}
/**
* isAdmin - Returns true if currently logged in user is
* an administrator, false otherwise.
*/
function isAdmin(){
return ($this->userlevel == ADMIN_LEVEL ||
$this->username == ADMIN_NAME);
}
/**
* isAuthor - Returns true if currently logged in user is
* an author or an administrator, false otherwise.
*/
function isAuthor(){
return ($this->userlevel == AUTHOR_LEVEL ||
$this->userlevel == ADMIN_LEVEL);
}
/**
* generateRandID - Generates a string made up of randomized
* letters (lower and upper case) and digits and returns
* the md5 hash of it to be used as a userid.
*/
function generateRandID(){
return md5($this->generateRandStr(16));
}
/**
* generateRandStr - Generates a string made up of randomized
* letters (lower and upper case) and digits, the length
* is a specified parameter.
*/
function generateRandStr($length){
$randstr = "";
for($i=0; $i<$length; $i++){
$randnum = mt_rand(0,61);
if($randnum < 10){
$randstr .= chr($randnum+48);
}else if($randnum < 36){
$randstr .= chr($randnum+55);
}else{
$randstr .= chr($randnum+61);
}
}
return $randstr;
}
function cleanInput($post = array()) {
foreach($post as $k => $v){
$post[$k] = trim(htmlspecialchars($v));
}
return $post;
}
};
/**
* Initialize session object - This must be initialized before
* the form object because the form uses session variables,
* which cannot be accessed unless the session has started.
*/
$session = new Session;
/* Initialize form object */
$form = new Form;