global.php

jsp程序开发系统

<?php
// +-------------------------------------------------------------+
// | DeskPRO v [2.0.1 Production]
// | Copyright (C) 2001 - 2004 Headstart Solutions Limited
// | Supplied by WTN-WDYL
// | Nullified by WTN-WDYL
// | Distribution via WebForum, ForumRU and associated file dumps
// +-------------------------------------------------------------+
// | DESKPRO IS NOT FREE SOFTWARE
// +-------------------------------------------------------------+
// | License ID : Full Enterprise License =) ...
// | License Owner : WTN-WDYL Team
// +-------------------------------------------------------------+
// | $RCSfile: global.php,v $
// | $Date: 2004/02/10 01:34:25 $
// | $Revision: 1.57 $
// +-------------------------------------------------------------+
// | File Details:
// | - Sessions management and global initialization for user
// |   interface.
// +-------------------------------------------------------------+

############################### INCLUDE FILES ###############################

define('USERZONE', 1);
define('INCLUDE_PATH', './includes/');
include ('./includes/init.php');

############################### LICENSE CHECK ###############################

if ($_REQUEST[checklicense]) {
	check_license();
}

############################### LAYOUT TEMPLATES ###############################

// replacement variables
$db->query("SELECT name, value from template_replace");
while ($result = $db->row_array()) {
	$r[$result[name]] = $result[value];
}

// some templates always used
$template_cache = templatecache('HF_language_bit,HF_header,HF_footer,HF_head_include,HF_navbar_in,HF_navbar_out,HF_navbar_out_allow,HTML_notice_start,HTML_notice_end,HTML_midtable_start,HTML_midtable_end,HTML_content_start,HTML_error_start,HTML_tablebit_end,HTML_tablebit_start,HTML_tableelement_start,HTML_tableelement_end');

eval(makeeval('css', 'HF_css'));

// html bit templates
eval(makeeval('t[tablebit_start]', 'HTML_tablebit_start'));
eval(makeeval('t[tablebit_end]', 'HTML_tablebit_end'));
eval(makeeval('t[tableelement_start]', 'HTML_tableelement_start'));
eval(makeeval('t[tableelement_end]', 'HTML_tableelement_end'));
eval(makeeval('t[bordertable_start]', 'HTML_bordertable_start'));
eval(makeeval('t[bordertable_end]', 'HTML_bordertable_end'));
eval(makeeval('t[tablebitall]', 'HTML_tablebitall'));
eval(makeeval('t[row_spacer]', 'HTML_rowspacer'));

############################### SESSIONS / USER DATA ###############################

// check if the user already has a cookie
if ($_COOKIE[dp_user_sessionid] OR $_COOKIE[dp_user_userid] OR $_COOKIE[dp_user_password]) {
	$acceptcookies = 1;
}

// check if valid session
$session = validate_session();

// if session found get user details if user is logged in
if ($session) {
	
	if ($session[userid]) {
		$user = $db->query_return("SELECT * FROM user WHERE id = '$session[userid]'");
	}

// no session
} else {
	
	// check if we are remembering this user
	if ($_COOKIE['dp_user_userid'] AND $_COOKIE['dp_user_password']) { 
		
		$user = $db->query_return("	
			SELECT * FROM user 
			WHERE id = '" . mysql_escape_string($_COOKIE['dp_user_userid']) . "' 
			AND password_cookie = '" . mysql_escape_string($_COOKIE['dp_user_password']) . "'
		");	
	}

	// if user is not found, delete the cookies
	if (!$db->num_rows()) {
		dp_setcookie("dp_user_userid", "", -1);
		dp_setcookie("dp_user_password", "", -1);
	}

	// we make a session now independant of finding user or not. If a user is found the session is linked to the user
	$session = make_session($user[id], $user[language]);
				
	// Send headers unless we are making PDF
	if (!defined('PDF')) { 
		dp_setcookie('dp_user_sessionid', $session[sessionid]);
	}

}

// check there is a language in the session
if (!$session[language]) {
	if ($_COOKIE['dp_language']) {
		$session[language] = $_COOKIE['dp_language'];
	} elseif ($settings[default_language]) {
		$session[language] = $settings[default_language];
	} else {
		$session[language] = 1;
	}
}

$dplang = get_words();

// is user trying to login
if ($_REQUEST['login_form'] == 'login' OR strtolower($_REQUEST['submit']) == 'login') { 

	$user = $db->query_return("
			SELECT * FROM user 
			WHERE 
				(
				username = '". mysql_escape_string($_POST[username]) . "' OR
				email = '". mysql_escape_string($_POST[username]) . "'
				)
			AND password = '".mysql_escape_string($_POST[password])."'
		");

	if (($db->num_rows() > 0) AND ($_POST[username] != '')) {
		
		$session = update_session('user', $user[id]);
		$session = update_session('language', $user[language]);

		// if we are staying logged in, we remember the userid/password at this point	
		if ($_REQUEST[remember]) {
			if (!defined('PDF') AND !defined('NOCOOKIES')) {
				dp_setcookie('dp_user_userid', $user[id], 'ever');
				dp_setcookie('dp_user_password', $user[password_cookie], 'ever');
			}
		}
		
		// Rebuild GET, POST and FILE data
		$_getvars = unserialize($_POST['_getvars']);
		$_GET = array_merge($_GET, $_getvars);

		$_postvars = unserialize($_POST['_postvars']);
		$_POST = array_merge($_POST, $_postvars);

		$_filevars = unserialize($_POST['_filevars']);
		$_FILES = array_merge($_FILES, $_filevars);

		$_REQUEST = array_merge($_GET,$_POST,$_COOKIE);

		// if we came from login page *or* index redirect to index again
		if (is_integer(strpos($_SERVER['PHP_SELF'], 'login.php'))
			OR is_integer(strpos($_SERVER['PHP_SELF'], 'index.php'))) {

			if (!$acceptcookies) { // Set the right URL params 
				 $session_url = '?s='.$session[sessionid]; 
				 $session_ampersand = '&'; 
			} else { 
				 $session_url = ''; 
				 $session_ampersand = '?'; 
			}

			jump('index.php', 'redirect_login');
		}
	
	} else { // display after template parseing
		unset($user);
		$login_error = 1;
		$error = $dplang['login_fail'];
	}
}

// Set the right URL params 
if (!$acceptcookies) { 
     $session_url = '?s='.$session[sessionid]; 
     $session_ampersand = '&amp;'; 
} else { 
     $session_url = ''; 
     $session_ampersand = '?'; 
}

// sort out usergroups
if ($user[usergroup]) {
	$session[usergroup] = $user[usergroup];
} elseif ($session[userid]) {
	$session[usergroup] = 2;
} else {
	$session[usergroup] = 1;
}

############################### WORDS / LANGUAGES ###############################

// needs to be functionalised because needed for redirect above
function get_words() {

	global $db, $settings, $session;

	$db->query("SELECT * FROM template_words WHERE language = '0' OR language = '$session[language]' OR language = '$settings[default_language]' ORDER BY cust DESC");

	while ($result = $db->row_array()) {
		if ($result[language] == '0') {
			$start_lang[$result[wordref]] = iff($start_lang[$result[wordref]], $start_lang[$result[wordref]], trim($result[text]));
		} elseif ($result[language] == $settings[default_language]) {
			$default_lang[$result[wordref]] = iff($default_lang[$result[wordref]], $default_lang[$result[wordref]], trim($result[text]));
		} else {
			$this_lang[$result[wordref]] = iff($this_lang[$result[wordref]], $this_lang[$result[wordref]], trim($result[text]));
		}
	}

	$dplang = array_merge($start_lang, $default_lang);
	$dplang = array_merge($dplang, $this_lang); 

	return $dplang;
}

// languages
$db->query("SELECT * FROM languages WHERE is_selectable");
$language = array();
while ($result = $db->row_array()) {
	$language[$result[id]] = $result;
}
$this_language = $language[$session[language]];

// need to make sure we have defined a charset etc
give_default($this_language['isocode'], 'en');
give_default($this_language['contenttype'], 'text/html; charset=ISO-8859-12');
give_default($this_language['direction'], 'ltr');
if ($this_language['direction'] == 'ltr') {
	$this_language['align'] = 'right';
} else {
	$this_language['align'] = 'left';
}

$this_language['url'] = basename($_SERVER['SCRIPT_NAME']) . '?' . $_SERVER['QUERY_STRING'];
eval(makeeval('language_html', 'HF_language'));

############################### UNSET VARIABLES ###############################

// minor defense against XSS is unsettting any useful 'cracking' variables

unset($_COOKIE);
unset($user[password]);

############################### LOGIN ERROR / DISABLED ###############################

// if user is disabled (we need to log the user out so they can go somewhere)
if (is_array($user)) {
	if ($user[disabled]) {
		unset($user);
		delete_cookies();
		$session = make_session($userid='', $session[language]);
		error('error_user_disabled');
	}
}

// if the user attempte to login but with wrong username/password
if ($login_error) {
	sleep(1);
	$page = 'login';
	login_form($error, $_POST['_getvars'], $_POST['_postvars'], $_POST['_filevars']);
}

############################### OTHER ###############################

// set user timezone

$settings['timezone'] -= ($settings['timezone'] - $settings['timezone_offset']);

if ($user['timezone'] != NULL) {
	$settings['timezone'] -= ($settings['timezone'] - $user['timezone']);
}

if ($user['timezone_dst']) {
	$settings['timezone']++;
}

if ($session[language] == 1) {
	$show_spellcheck = 1;
}

/*
	At this point every user has a sessionid
*/