From 85bbaca28f41831304501f8029c93c0fe0dc4454 Mon Sep 17 00:00:00 2001 From: Yehuda Eisenberg <32451776+YehudaEi@users.noreply.github.com> Date: Tue, 10 Nov 2020 18:31:17 +0200 Subject: [PATCH] Change login to login with session --- SysManager.php | 53 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 11 deletions(-) diff --git a/SysManager.php b/SysManager.php index 97c9bde..db5c50a 100644 --- a/SysManager.php +++ b/SysManager.php @@ -5,13 +5,16 @@ define('BASE_PATH', __DIR__ . DS . "data" . DS); define('BASE_URL', ($_SERVER['REQUEST_SCHEME'] ?? ($_SERVER['HTTPS'] == "on" ? "https" : "http")) . "://" . $_SERVER['HTTP_HOST'] . dirname($_SERVER['SCRIPT_NAME']) . "/"); +session_name('FileServerMng'); +session_start(); + if(file_exists(substr(BASE_PATH, 0, -1)) && !is_dir(substr(BASE_PATH, 0, -1))) die("

Fatal Error!

"); if(!is_dir(BASE_PATH)) mkdir(BASE_PATH); if(!file_exists(BASE_PATH . '.htaccess')) file_put_contents(BASE_PATH . '.htaccess', 'deny from all'); if(!file_exists(__DIR__ . DS . '.htaccess')) file_put_contents(__DIR__ . DS . '.htaccess', "RewriteEngine on\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule ^(.*)$ /SysManager.php?file=$1 [NC,L,QSA]"); -$users = array( - "admin" => "admin@123", +$users = array( + 'admin' => password_hash('admin@123', PASSWORD_DEFAULT), ); $isLogged = false; @@ -84,21 +87,49 @@ function getFakePath($path){ $file = cleanPath($_GET['file'] ?? ""); if(empty($file)) $file = ""; -if(isset($_GET['login']) || isset($_GET['logout'])){ - if(!isset($_GET['logout']) && isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']) && isset($users[$_SERVER['PHP_AUTH_USER']]) && $users[$_SERVER['PHP_AUTH_USER']] == $_SERVER['PHP_AUTH_PW']){ +if(isset($_GET['logout'])){ + unset($_SESSION['FileServerMngUser']['logged']); + header('location: ' . BASE_URL); +} +if (isset($_SESSION['FileServerMngUser']['logged'], $users[$_SESSION['FileServerMngUser']['logged']])){ + $isLogged = true; +} +if(isset($_GET['login'])){ + if (isset($_POST['user'], $_POST['pass'])) { + if (isset($users[$_POST['user']]) && isset($_POST['pass']) && password_verify($_POST['pass'], $users[$_POST['user']])) { + $_SESSION['FileServerMngUser']['logged'] = $_POST['user']; + } else { + unset($_SESSION['FileServerMngUser']['logged']); + $_SESSION['FileServerMngMessage'] = "

Error Credentials :(

"; + } header('location: ' . BASE_URL); } - else{ - header('WWW-Authenticate: Basic realm="Files Server Auth"'); - header('HTTP/1.0 401 Unauthorized'); - echo 'You do not have permission to view this page!

[go back]'; + else { + unset($_SESSION['FileServerMngUser']['logged']); + $message = $_SESSION['FileServerMngMessage'] ?? ""; + $_SESSION['FileServerMngMessage'] = ""; + echo ' + + + Yehuda\'s Files Server πŸ˜‰ | Login + + + +
+

Login - Files Server

+ ' . $message . ' +
+

+

+ +
+
+ + '; } die(); } -if(isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']) && isset($users[$_SERVER['PHP_AUTH_USER']]) && $users[$_SERVER['PHP_AUTH_USER']] == $_SERVER['PHP_AUTH_PW']) - $isLogged = true; - $act = $_GET['act'] ?? null; if(isset($act) && $isLogged){