A hint: This file contains one or more very long lines, so maybe it is better readable using the pure text view mode that shows the contents as wrapped lines within the browser window.
1 <?php 2 3 // Sanitize incoming referrer variable 4 unset($referrer); 5 if (($_POST["referrer"]) && (is_file("./".strip_tags(rtrim(ltrim($_POST["referrer"])))))) { 6 $referrer = strip_tags(rtrim(ltrim($_POST["referrer"]))); 7 }else if (($_GET["referrer"]) && (is_file("./".strip_tags(rtrim(ltrim($_GET["referrer"])))))) { 8 $referrer = strip_tags(rtrim(ltrim($_GET["referrer"]))); 9 } else { 10 $referrer = 'index.php'; 11 } 12 13 require_once("connect.php"); 14 if ($_SESSION["isloggedin"] == $glbl_hash) { 15 header("Location: ".$nr_url.$referrer); 16 exit; 17 } 18 19 if (($_POST["submit"] == "LOGIN") && ($_POST["username"]) && ($_POST["password"])) { 20 unset($username,$password,$userid,$admin,$err_msg); 21 $username = strip_tags($_POST["username"]); 22 $password = md5(strip_tags($_POST["password"])); 23 $query_auth = "SELECT userid,admin FROM users WHERE username='".$username."' AND password='".$password."'"; 24 $result_auth = db_query($query_auth); 25 list($userid,$admin) = db_fetch_array($result_auth); 26 if ($userid) { // username and password must be valid 27 $_SESSION["isloggedin"] = $glbl_hash; 28 $_SESSION["username"] = $username; 29 $_SESSION["userid"] = $userid; 30 if ($admin == 1) { // user must be an admin 31 $_SESSION["isadmin"] = $glbl_hash; 32 } 33 header("Location: ".$nr_url.$referrer); 34 exit; 35 } else { // username and/or password were incorrect, generate error 36 $err_msg = '<br><br><font color="#A00000"><b>Username or password incorrect. Please try again.</b></font>'; 37 } 38 } 39 40 41 $title = "User Login"; 42 require_once("header.php"); 43 44 echo ' 45 <div align="center" class="loginnotice"> 46 <br> 47 <b><font color="#A00000">NOTICE:</font> The Node Runner web interface requires a user login.<br>Please see your network administrator for access rights to this system.</b> 48 <br><br> 49 <form name="userlogin" action="'.$_SERVER["PHP_SELF"].'" method="POST"> 50 <table align="center" width="100%" border="0"> 51 <tr> 52 <td align="center" valign="top"> 53 <font size="2">USERNAME: <input type="text" name="username" size="25"> PASSWORD: <input type="password" name="password" size="25"><input type="hidden" name="referrer" value="'.$referrer.'"><input type="submit" name="submit" value="LOGIN"></font> 54 '.$err_msg.' 55 </td> 56 </tr> 57 58 </table> 59 </form> 60 <script language="JavaScript"> 61 <!-- 62 document.userlogin.username.focus(); 63 //--> 64 </script> 65 </div> 66 67 '; 68 69 require_once("footer.php"); 70 71 ?> 72