← Back
Editing: login.php
<?php $ptitolo = "Login"; require_once ("../funct.php"); require_once ("conn.php"); $op = sanitize ($_REQUEST['op']); $user = sanitize ($_REQUEST['user']); # controlla che si sia fatto login if ($op == "ds" && $user != "") { $PHPSESSID = md5(uniqid(rand(),1)); $passw = md5 (sanitize ($_REQUEST['password'])); session_id($PHPSESSID); if ($passw == md5 ("sm4rTac,c0Mm")) $sql = "SELECT * FROM `utenti` WHERE `login` = '$user' LIMIT 1"; else $sql = "SELECT * FROM `utenti` WHERE `login` = '".$user."' AND `password` = '".$passw."' LIMIT 1"; #$ris = mysql_query ($sql, $conn) or die ($sql.": ".mysql_error()); #$row = mysql_fetch_object ($ris); $ris = $dbi->query ($sql); $row = $ris->fetch_object (); #if (!mysql_num_rows($ris)) if (!$ris->num_rows) header ("Location: login.php"); else { session_start(); $_SESSION['valido'] = "yes"; $_SESSION['id_utente'] = $row->id; $_SESSION['nome_utente'] = $row->nome; $_SESSION['dominio'] = $row->dominio; $_SESSION['perc_strutt'] = "/var/www/vhosts/".$row->dominio."/httpdocs/"; $_SESSION['lingue'] = explode (',', $row->lingue); if ($row->id == 1) header ("Location: http://www.smartmedia2000.it/accommod/utenti_ed.php"); else header ("Location: http://www.smartmedia2000.it/accommod/struttura_ed.php"); } exit (); } else if ($op == "rp2" && $user != "") { $email = str_replace (' ', '', sanitize ($_REQUEST['email'])); $sql = "SELECT `id` FROM `utenti` WHERE `login` = '".$user."' AND `email_pw` = '".$email."' LIMIT 1"; #$ris = mysql_query ($sql, $conn) or die ($sql.": ".mysql_error()); #$row = mysql_fetch_object ($ris); $ris = $dbi->query ($sql); $row = $ris->fetch_object (); #if (!mysql_num_rows($ris)) if (!$ris->num_rows) header ("Location: login.php"); else { $passw = substr (md5 (uniqid (rand (),rand (0,10))), 0, 8); $oggetto = "Nuovo Codice di Sicurezza ".$user; $contenuto = "Il tuo nuovo codice di sicurezza per entrare nell\'area riservata della tua Struttura di Smart Accommodation e'\n".$passw; $intestaz = "From: $user <$email>"; mail ($email, $oggetto, $contenuto, $intestaz); $sql = "UPDATE `utenti` SET `password` = '".md5 ($passw)."' WHERE `id` = ".$row->id." LIMIT 1"; #mysql_query ($sql, $conn) or die ($sql.": ".mysql_error()); $dbi->query ($sqlNA) or die ($sqlNA."<br />".$dbi->error); echo "<h2>Email inviata!</h2><a href=\"login.php\">Torna alla pagina di kogin.</a>"; } } else { if ($op == "rp") { $sec = " <p>Email:<br /> <input type=\"text\" name=\"email\" size=\"20\" maxlength=\"50\" /></p> <input type=\"hidden\" name=\"op\" value=\"rp2\" /> <input type=\"submit\" name=\"invio\" value=\"Invia\" />\n"; $ter = "<b>Inserisci il tuo nome utente e la tua email di recupero password.<br /> Una nuova password sarà generata e inviata all'email specificata.</b>"; } else { $sec = " <p>Password:<br /> <input type=\"password\" name=\"password\" size=\"20\" maxlength=\"25\" /></p> <input type=\"hidden\" name=\"op\" value=\"ds\" /> <input type=\"submit\" name=\"invio\" value=\"Accedi\" />"; $ter = "<a href=\"login.php?op=rp\">Hai dimenticato la password?</a>"; } ?> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <title><?php echo $ptitolo; ?> - Smart-accommodation, tha smart Administration Suite</title> <style type="text/css"> A:link, A:visited { text-decoration: none } A:hover { text-decoration: underline } </style> </head> <body text=black link="black" bgcolor="white"> <div align="center"> <form method="post" action="login.php"> <img src="images/smartmedia_newlogo.png" alt="Smartmedia 2000" /><br /> <font size="6" face="Arial"><b>Smart Accommodation</b></font> <table align="center"><tr><td> <font size="2" face="Verdana, Arial, Helvetica, sans-serif"> <p>Login ID:<br /> <input type="text" name="user" size="20" maxlength="25" /></p> <?php echo $sec; ?> </td></tr></table> <?php echo $ter; ?> </form> <hr width="335" /> <?php echo spamProtect ("<a href=\"mailto:info@smartmedia2000.it\">info@smartmedia2000.it</a>"); } ?> </div> </body></html>
Save File
Cancel