<?php
-global $User, $Admin;
+date_default_timezone_set('Europe/Amsterdam');
-call_user_func(function () {
- if (isset($_SERVER['PHP_AUTH_USER'])) {
- $authinfo = [ $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ];
+class User
+{
+ function __construct($dir)
+ {
+ if (!file_exists($dir)) {
+ throw new Exception("Gebruiker niet gevonden in $dir");
+ }
+ $this->dir = $dir;
+ $this->login = basename($dir);
}
- elseif (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) {
- // cgi compatibility
- $authinfo = explode(':' , base64_decode(substr($_SERVER['REDIRECT_HTTP_AUTHORIZATION'], 6)));
+
+ function __get($col)
+ {
+ return $this->$col = $this->$col(); # run method and cache
}
- else {
- return;
+
+ function rawname()
+ {
+ return @file_get_contents("{$this->dir}/name.txt");
+ }
+
+ function name()
+ {
+ return htmlspecialchars(implode(' & ', explode("\n", $this->rawname)));
}
- $pwdata = file_get_contents(__DIR__.'/.htpasswd');
- $pwlist = [];
- foreach (explode("\n", $pwdata) as $line) {
- if (!$line) continue;
- list ($username, $pass) = explode(':', $line);
- $pwlist[$username] = $pass;
+ function admin()
+ {
+ return @file_exists("{$this->dir}/.admin");
}
- list ($authname, $authpass) = $authinfo;
- $usertest = $pwlist[ strtolower($authname) ];
+ function seen()
+ {
+ return @filemtime("{$this->dir}/last.log");
+ }
+}
+
+function login_password_verify($input, $test)
+{
+ if (substr($test, 0, 1) != '$') {
+ # plaintext match for uncrypted passwords
+ return $input === $test;
+ }
+ return password_verify($input, $test);
+}
+
+function login_setcookie()
+{
+ global $User;
+ return setcookie('login', $User['auth'], 0, '/');
+}
+
+function login($inuser, $inpass = NULL)
+{
+ if (empty($inuser)) return;
+ if (!isset($inpass)) {
+ @list ($inuser, $inauth) = explode(':', $inuser, 2);
+ }
+
+ # find password data by user name
+ $userdir = 'profile/'.preg_replace('/[^a-z0-9]+/', '-', strtolower($inuser));
+ $pwfile = "$userdir/.passwd";
+ if (!file_exists($pwfile)) return;
+ $usertest = trim(file_get_contents($pwfile));
if (!$usertest) return;
- $salt = substr($usertest, 0, 2);
- if (crypt($authpass, $salt) != $usertest) return;
+ # verify password
+ $authhash = md5($usertest);
+ if (isset($inpass)) {
+ if (!login_password_verify($inpass, $usertest)) return;
+ }
+ else {
+ if ($inauth !== $authhash) return;
+ }
+
+ if (function_exists('apache_note')) apache_note('user', $inuser);
+
+ if ($log = @fopen("$userdir/last.log", 'w')) {
+ fwrite($log, "{$_SERVER['REMOTE_ADDR']} {$_SERVER['HTTP_USER_AGENT']}\n");
+ }
+
+ return [
+ 'name' => $inuser,
+ 'dir' => $userdir,
+ 'admin' => file_exists("$userdir/.admin"),
+ 'pass' => $usertest,
+ 'auth' => "$inuser:$authhash",
+ ];
+}
- global $User, $Admin;
- $User = $authname;
- $Admin = !empty($User) && $User != 'lid' ? $User : FALSE;
-});
+if (isset($_COOKIE['login'])) {
+ global $User;
+ $User = login($_COOKIE['login']);
+}