← Back
Editing: login.php
<?php $ptitolo = "Login"; $html = "n"; $barra = "n"; require_once ("../funct.php"); require_once ("conn.php"); # controlla che si sia fatto login if (sanitize ($_REQUEST['op']) == "ds" && sanitize ($_REQUEST['user']) != "") { $PHPSESSID = md5(uniqid(rand(),1)); session_id($PHPSESSID); $sql = "SELECT `operatori`.*, `dominio`, `lingue` FROM `operatori`, `utenti` WHERE `utenti`.`id`=`operatori`.`id_utente` AND `operatori`.`ruolo` > 0 AND `operatori`.`login` = '".sanitize ($_REQUEST['user'])."' AND `operatori`.`password` = '".md5 (sanitize ($_REQUEST['password']))."' LIMIT 1"; #$ris = mysql_query ($sql, $conn) or die ($sql.": ".mysql_error()); #$row = mysql_fetch_object ($ris); $ris = $dbi->query ($sql); $row = $ris->fetch_object (); #if (!mysql_num_rows($ris)) if (!$ris->num_rows) header ("Location: login.php"); else { # verifica ultimo accesso e disabilitazione if ((date2time ($row->ult_accesso)+(3600*24*182)) < time() && ($row->ult_accesso != "0000-00-00 00:00:00")) { $sqlNA = "UPDATE `operatori` SET `ruolo` = '0' WHERE `id` = ".$row->id; #mysql_query ($sqlNA, $conn) or die ($sqlNA.": ".mysql_error()); $dbi->query ($sqlNA) or die ($sqlNA."<br />".$dbi->error); $msg = "Utente non più abilitato"; } # verifica se serve un cambio password else if ((date2time ($row->cambio_passw)+(3600*24*182)) < time()) { header ("Location: https://www.smartmedia2000.it/booking/passw_ed.php"); } else { session_start(); if ($_REQUEST['password'] == "area") $_SESSION['valido'] = "chp"; else $_SESSION['valido'] = "yes"; $_SESSION['id_utente'] = $row->id_utente; $_SESSION['id_oper'] = $row->id; $_SESSION['nome'] = $row->nome; $_SESSION['login'] = $row->login; $_SESSION['ruolo'] = $row->ruolo; $_SESSION['perc_strutt'] = $row->dominio."/"; $_SESSION['lingue'] = explode (',', $row->lingue); if (strpos ("@".$_REQUEST['user'], 'fab') == 1) $_SESSION['fab'] = "s"; # marca ultimo accesso $sqlA = "UPDATE `operatori` SET `ult_accesso` = '".date ("Y-m-d H:i:s", time())."' WHERE `id` = ".$row->id; #mysql_query ($sqlA, $conn) or die ($sqlA.": ".mysql_error()); $dbi->query ($sqlA) or die ($sqlA."<br />".$dbi->error); header ("Location: https://www.smartmedia2000.it/booking/statistiche.php"); } /* if ($row->ruolo > 2) header ("Location: http://www.area-clienti.it/booking/contratti_tour.php"); else if ($row->id == 1) header ("Location: http://www.smartmedia2000.it/booking/utenti_ed.php"); else if ($_POST['pag']) header ("Location: ".str_replace ('@', '&', $_POST['pag'])); else header ("Location: http://www.smartmedia2000.it/booking/statistiche.php"); */ } echo "<h2>".$msg."</h2>"; exit (); } else { ?> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <title><?=$ptitolo;?> - Smart-Ebookiing, tha smart Accommodation Administration Suite</title> <style type="text/css"> A:link, A:visited { text-decoration: none } A:hover { text-decoration: underline } </style> </head> <body text="#000000" link="#000000" bgcolor="#FFFFFF"> <div align="center"> <form name="login" method="post" action="<?=$_SERVER['PHP_SELF'];?>"> <img src="images/smartmedia_newlogo.png" alt="Smartmedia 2000" /><br /> <font size="6" face="Arial"><b>Smart E-booking</b></font> <table align="center"> <tr><td> <font size="2" face="Verdana, Arial, Helvetica, sans-serif"> <p>Login ID:<br /> <input type="text" name="user" size="20" maxlength="25" /></p> <p>Password:<br /> <input type="password" name="password" size="20" maxlength="25" /></p> <input type="hidden" name="op" value="ds" /> <input type="hidden" name="pag" value="<?php echo $_GET['pag']; ?>" /> <input type="submit" name="invio" value="Accedi" /> </td></tr></table> </form> <p>Ogni 6 mesi la password dell'operatore scade e deve essere cambiata.<br> Se è scaduta e hai problemi nell'accesso, <a href="/booking/passw_ed.php">vai a questa pagina</a>.</p> <hr width="335" /> <?php echo spamProtect ("<a href=\"mailto:info@smartmedia2000.it\">info@smartmedia2000.it</a>"); } ?> </div> </body></html>
Save File
Cancel