| [ Index ] |
PHP Cross Reference of MyBB 1.8.37 |
[Summary view] [Print] [Text view]
1 <?php 2 /** 3 * MyBB 1.8 4 * Copyright 2014 MyBB Group, All Rights Reserved 5 * 6 * Website: http://www.mybb.com 7 * License: http://www.mybb.com/about/license 8 * 9 */ 10 11 class session 12 { 13 /** 14 * @var int 15 */ 16 public $sid = 0; 17 /** 18 * @var int 19 */ 20 public $uid = 0; 21 /** 22 * @var string 23 */ 24 public $ipaddress = ''; 25 /** 26 * @var string 27 */ 28 public $packedip = ''; 29 /** 30 * @var string 31 */ 32 public $useragent = ''; 33 /** 34 * @var bool 35 */ 36 public $is_spider = false; 37 38 /** 39 * Request parameters that are to be ignored for location storage 40 * 41 * @var array 42 */ 43 public $ignore_parameters = array( 44 'my_post_key', 45 'logoutkey', 46 ); 47 48 /** 49 * Initialize a session 50 */ 51 function init() 52 { 53 global $db, $mybb, $cache, $plugins; 54 55 // Get our visitor's IP. 56 $this->ipaddress = get_ip(); 57 $this->packedip = my_inet_pton($this->ipaddress); 58 59 // Find out the user agent. 60 if(isset($_SERVER['HTTP_USER_AGENT'])) 61 { 62 $this->useragent = $_SERVER['HTTP_USER_AGENT']; 63 } 64 65 // Attempt to find a session id in the cookies. 66 if(isset($mybb->cookies['sid']) && !defined('IN_UPGRADE')) 67 { 68 $sid = $db->escape_string($mybb->cookies['sid']); 69 70 // Load the session if not using a bot sid 71 if(substr($sid, 3, 1) !== '=') 72 { 73 $query = $db->simple_select("sessions", "*", "sid='{$sid}'"); 74 $session = $db->fetch_array($query); 75 if($session) 76 { 77 $this->sid = $session['sid']; 78 } 79 } 80 } 81 82 if(isset($plugins)) 83 { 84 $plugins->run_hooks('pre_session_load', $this); 85 } 86 87 // If we have a valid session id and user id, load that users session. 88 if(!empty($mybb->cookies['mybbuser'])) 89 { 90 $logon = explode("_", $mybb->cookies['mybbuser'], 2); 91 $this->load_user($logon[0], $logon[1]); 92 } 93 94 // If no user still, then we have a guest. 95 if(!isset($mybb->user['uid'])) 96 { 97 // Detect if this guest is a search engine spider. (bots don't get a cookied session ID so we first see if that's set) 98 if(!$this->sid) 99 { 100 $spiders = $cache->read("spiders"); 101 if(is_array($spiders)) 102 { 103 foreach($spiders as $spider) 104 { 105 if(my_strpos(my_strtolower($this->useragent), my_strtolower($spider['useragent'])) !== false) 106 { 107 $this->load_spider($spider['sid']); 108 } 109 } 110 } 111 } 112 113 // Still nothing? JUST A GUEST! 114 if(!$this->is_spider) 115 { 116 $this->load_guest(); 117 } 118 } 119 120 // As a token of our appreciation for getting this far (and they aren't a spider), give the user a cookie 121 if($this->sid && (!isset($mybb->cookies['sid']) || $mybb->cookies['sid'] != $this->sid) && $this->is_spider != true) 122 { 123 my_setcookie("sid", $this->sid, -1, true); 124 } 125 } 126 127 /** 128 * Load a user via the user credentials. 129 * 130 * @param int $uid The user id. 131 * @param string $loginkey The user's loginkey. 132 * @return bool 133 */ 134 function load_user($uid, $loginkey='') 135 { 136 global $mybb, $db, $time, $lang, $mybbgroups, $cache; 137 138 $uid = (int)$uid; 139 $query = $db->query(" 140 SELECT u.*, f.* 141 FROM ".TABLE_PREFIX."users u 142 LEFT JOIN ".TABLE_PREFIX."userfields f ON (f.ufid=u.uid) 143 WHERE u.uid='$uid' 144 LIMIT 1 145 "); 146 $mybb->user = $db->fetch_array($query); 147 148 // Check the password if we're not using a session 149 if(!$mybb->user || empty($loginkey) || $loginkey !== $mybb->user['loginkey']) 150 { 151 unset($mybb->user); 152 $this->uid = 0; 153 return false; 154 } 155 $this->uid = $mybb->user['uid']; 156 157 // Set the logout key for this user 158 $mybb->user['logoutkey'] = md5($mybb->user['loginkey']); 159 160 // Sort out the private message count for this user. 161 if(($mybb->user['totalpms'] == -1 || $mybb->user['unreadpms'] == -1) && $mybb->settings['enablepms'] != 0) // Forced recount 162 { 163 $update = 0; 164 if($mybb->user['totalpms'] == -1) 165 { 166 $update += 1; 167 } 168 if($mybb->user['unreadpms'] == -1) 169 { 170 $update += 2; 171 } 172 173 require_once MYBB_ROOT."inc/functions_user.php"; 174 $pmcount = update_pm_count('', $update); 175 if(is_array($pmcount)) 176 { 177 $mybb->user = array_merge($mybb->user, $pmcount); 178 } 179 } 180 $mybb->user['pms_total'] = $mybb->user['totalpms']; 181 $mybb->user['pms_unread'] = $mybb->user['unreadpms']; 182 183 if($mybb->user['lastip'] != $this->packedip && array_key_exists('lastip', $mybb->user) && !defined('IN_UPGRADE')) 184 { 185 $lastip_add = ", lastip=".$db->escape_binary($this->packedip); 186 } 187 else 188 { 189 $lastip_add = ''; 190 } 191 192 // If the last visit was over 900 seconds (session time out) ago then update lastvisit. 193 $time = TIME_NOW; 194 if($time - $mybb->user['lastactive'] > 900) 195 { 196 $db->shutdown_query("UPDATE ".TABLE_PREFIX."users SET lastvisit='{$mybb->user['lastactive']}', lastactive='$time'{$lastip_add} WHERE uid='{$mybb->user['uid']}'"); 197 $mybb->user['lastvisit'] = $mybb->user['lastactive']; 198 require_once MYBB_ROOT."inc/functions_user.php"; 199 update_pm_count('', 2); 200 } 201 else 202 { 203 $timespent = TIME_NOW - $mybb->user['lastactive']; 204 $db->shutdown_query("UPDATE ".TABLE_PREFIX."users SET lastactive='$time', timeonline=timeonline+$timespent{$lastip_add} WHERE uid='{$mybb->user['uid']}'"); 205 } 206 207 // Sort out the language and forum preferences. 208 if($mybb->user['language'] && $lang->language_exists($mybb->user['language'])) 209 { 210 $mybb->settings['bblanguage'] = $mybb->user['language']; 211 } 212 if($mybb->user['dateformat'] != 0 && $mybb->user['dateformat'] != '') 213 { 214 global $date_formats; 215 if(!empty($date_formats[$mybb->user['dateformat']])) 216 { 217 $mybb->settings['dateformat'] = $date_formats[$mybb->user['dateformat']]; 218 } 219 } 220 221 // Choose time format. 222 if($mybb->user['timeformat'] != 0 && $mybb->user['timeformat'] != '') 223 { 224 global $time_formats; 225 if(!empty($time_formats[$mybb->user['timeformat']])) 226 { 227 $mybb->settings['timeformat'] = $time_formats[$mybb->user['timeformat']]; 228 } 229 } 230 231 // Find out the threads per page preference. 232 if($mybb->user['tpp']) 233 { 234 $mybb->settings['threadsperpage'] = $mybb->user['tpp']; 235 } 236 237 // Find out the posts per page preference. 238 if($mybb->user['ppp']) 239 { 240 $mybb->settings['postsperpage'] = $mybb->user['ppp']; 241 } 242 243 // Does this user prefer posts in classic mode? 244 if($mybb->user['classicpostbit']) 245 { 246 $mybb->settings['postlayout'] = 'classic'; 247 } 248 else 249 { 250 $mybb->settings['postlayout'] = 'horizontal'; 251 } 252 253 $usergroups = $cache->read('usergroups'); 254 255 if(!empty($usergroups[$mybb->user['usergroup']]) && $usergroups[$mybb->user['usergroup']]['isbannedgroup'] == 1) 256 { 257 $ban = $db->fetch_array( 258 $db->simple_select('banned', '*', 'uid='.(int)$mybb->user['uid'], array('limit' => 1)) 259 ); 260 261 if($ban) 262 { 263 $mybb->user['banned'] = 1; 264 $mybb->user['bandate'] = $ban['dateline']; 265 $mybb->user['banlifted'] = $ban['lifted']; 266 $mybb->user['banoldgroup'] = $ban['oldgroup']; 267 $mybb->user['banolddisplaygroup'] = $ban['olddisplaygroup']; 268 $mybb->user['banoldadditionalgroups'] = $ban['oldadditionalgroups']; 269 $mybb->user['banreason'] = $ban['reason']; 270 } 271 else 272 { 273 $mybb->user['banned'] = 0; 274 } 275 } 276 277 // Check if this user is currently banned and if we have to lift it. 278 if(!empty($mybb->user['bandate']) && (isset($mybb->user['banlifted']) && !empty($mybb->user['banlifted'])) && $mybb->user['banlifted'] < $time) // hmmm...bad user... how did you get banned =/ 279 { 280 // must have been good.. bans up :D 281 $db->shutdown_query("UPDATE ".TABLE_PREFIX."users SET usergroup='".(int)$mybb->user['banoldgroup']."', additionalgroups='".$db->escape_string($mybb->user['banoldadditionalgroups'])."', displaygroup='".(int)$mybb->user['banolddisplaygroup']."' WHERE uid='".$mybb->user['uid']."'"); 282 $db->shutdown_query("DELETE FROM ".TABLE_PREFIX."banned WHERE uid='".$mybb->user['uid']."'"); 283 // we better do this..otherwise they have dodgy permissions 284 $mybb->user['usergroup'] = $mybb->user['banoldgroup']; 285 $mybb->user['displaygroup'] = $mybb->user['banolddisplaygroup']; 286 $mybb->user['additionalgroups'] = $mybb->user['banoldadditionalgroups']; 287 288 $mybbgroups = $mybb->user['usergroup']; 289 if($mybb->user['additionalgroups']) 290 { 291 $mybbgroups .= ','.$mybb->user['additionalgroups']; 292 } 293 } 294 else if(!empty($mybb->user['bandate']) && (empty($mybb->user['banlifted']) || !empty($mybb->user['banlifted']) && $mybb->user['banlifted'] > $time)) 295 { 296 $mybbgroups = $mybb->user['usergroup']; 297 } 298 else 299 { 300 // Gather a full permission set for this user and the groups they are in. 301 $mybbgroups = $mybb->user['usergroup']; 302 if($mybb->user['additionalgroups']) 303 { 304 $mybbgroups .= ','.$mybb->user['additionalgroups']; 305 } 306 } 307 308 $mybb->usergroup = usergroup_permissions($mybbgroups); 309 if(!$mybb->user['displaygroup']) 310 { 311 $mybb->user['displaygroup'] = $mybb->user['usergroup']; 312 } 313 314 $mydisplaygroup = usergroup_displaygroup($mybb->user['displaygroup']); 315 if(is_array($mydisplaygroup)) 316 { 317 $mybb->usergroup = array_merge($mybb->usergroup, $mydisplaygroup); 318 } 319 320 if(!$mybb->user['usertitle']) 321 { 322 $mybb->user['usertitle'] = $mybb->usergroup['usertitle']; 323 } 324 325 // Update or create the session. 326 if(!defined("NO_ONLINE") && !defined('IN_UPGRADE')) 327 { 328 if(!empty($this->sid)) 329 { 330 $this->update_session($this->sid, $mybb->user['uid']); 331 } 332 else 333 { 334 $this->create_session($mybb->user['uid']); 335 } 336 } 337 return true; 338 } 339 340 /** 341 * Load a guest user. 342 * 343 */ 344 function load_guest() 345 { 346 global $mybb, $time, $db, $lang; 347 348 // Set up some defaults 349 $time = TIME_NOW; 350 $mybb->user['usergroup'] = 1; 351 $mybb->user['additionalgroups'] = ''; 352 $mybb->user['username'] = ''; 353 $mybb->user['uid'] = 0; 354 $mybbgroups = 1; 355 $mybb->user['displaygroup'] = 1; 356 $mybb->user['invisible'] = 0; 357 $mybb->user['moderateposts'] = 0; 358 $mybb->user['showquickreply'] = 1; 359 $mybb->user['signature'] = ''; 360 $mybb->user['suspendposting'] = 0; 361 362 // Has this user visited before? Lastvisit need updating? 363 if(isset($mybb->cookies['mybb']['lastvisit'])) 364 { 365 if(!isset($mybb->cookies['mybb']['lastactive'])) 366 { 367 $mybb->user['lastactive'] = $time; 368 $mybb->cookies['mybb']['lastactive'] = $mybb->user['lastactive']; 369 } 370 else 371 { 372 $mybb->user['lastactive'] = (int)$mybb->cookies['mybb']['lastactive']; 373 } 374 if($time - $mybb->cookies['mybb']['lastactive'] > 900) 375 { 376 my_setcookie("mybb[lastvisit]", $mybb->user['lastactive']); 377 $mybb->user['lastvisit'] = $mybb->user['lastactive']; 378 } 379 else 380 { 381 $mybb->user['lastvisit'] = (int)$mybb->cookies['mybb']['lastactive']; 382 } 383 } 384 385 // No last visit cookie, create one. 386 else 387 { 388 my_setcookie("mybb[lastvisit]", $time); 389 $mybb->user['lastvisit'] = $time; 390 } 391 392 // Update last active cookie. 393 my_setcookie("mybb[lastactive]", $time); 394 395 // Gather a full permission set for this guest 396 $mybb->usergroup = usergroup_permissions($mybbgroups); 397 $mydisplaygroup = usergroup_displaygroup($mybb->user['displaygroup']); 398 if(is_array($mydisplaygroup)) 399 { 400 $mybb->usergroup = array_merge($mybb->usergroup, $mydisplaygroup); 401 } 402 403 // Update the online data. 404 if(!defined("NO_ONLINE") && !defined('IN_UPGRADE')) 405 { 406 if(!empty($this->sid)) 407 { 408 $this->update_session($this->sid); 409 } 410 else 411 { 412 $this->create_session(); 413 } 414 } 415 } 416 417 /** 418 * Load a search engine spider. 419 * 420 * @param int $spider_id The ID of the search engine spider 421 */ 422 function load_spider($spider_id) 423 { 424 global $mybb, $time, $db, $lang; 425 426 // Fetch the spider preferences from the database 427 $query = $db->simple_select("spiders", "*", "sid='{$spider_id}'"); 428 $spider = $db->fetch_array($query); 429 430 // Set up some defaults 431 $time = TIME_NOW; 432 $this->is_spider = true; 433 if($spider['usergroup']) 434 { 435 $mybb->user['usergroup'] = $spider['usergroup']; 436 } 437 else 438 { 439 $mybb->user['usergroup'] = 1; 440 } 441 $mybb->user['username'] = ''; 442 $mybb->user['uid'] = 0; 443 $mybb->user['displaygroup'] = $mybb->user['usergroup']; 444 $mybb->user['additionalgroups'] = ''; 445 $mybb->user['invisible'] = 0; 446 447 // Set spider language 448 if($spider['language'] && $lang->language_exists($spider['language'])) 449 { 450 $mybb->settings['bblanguage'] = $spider['language']; 451 } 452 453 // Set spider theme 454 if($spider['theme']) 455 { 456 $mybb->user['style'] = $spider['theme']; 457 } 458 459 // Gather a full permission set for this spider. 460 $mybb->usergroup = usergroup_permissions($mybb->user['usergroup']); 461 $mydisplaygroup = usergroup_displaygroup($mybb->user['displaygroup']); 462 if(is_array($mydisplaygroup)) 463 { 464 $mybb->usergroup = array_merge($mybb->usergroup, $mydisplaygroup); 465 } 466 467 // Update spider last minute (only do so on two minute intervals - decrease load for quick spiders) 468 if($spider['lastvisit'] < TIME_NOW-120) 469 { 470 $updated_spider = array( 471 "lastvisit" => TIME_NOW 472 ); 473 $db->update_query("spiders", $updated_spider, "sid='{$spider_id}'"); 474 } 475 476 // Update the online data. 477 if(!defined("NO_ONLINE") && !defined('IN_UPGRADE')) 478 { 479 $this->sid = "bot=".$spider_id; 480 $this->create_session(); 481 } 482 483 } 484 485 /** 486 * Update a user session. 487 * 488 * @param int $sid The session id. 489 * @param int $uid The user id. 490 */ 491 function update_session($sid, $uid=0) 492 { 493 global $db; 494 495 // Find out what the special locations are. 496 $speciallocs = $this->get_special_locations(); 497 if($uid) 498 { 499 $onlinedata['uid'] = $uid; 500 } 501 else 502 { 503 $onlinedata['uid'] = 0; 504 } 505 $onlinedata['time'] = TIME_NOW; 506 507 $onlinedata['location'] = $db->escape_string(substr(get_current_location(false, $this->ignore_parameters), 0, 150)); 508 $onlinedata['useragent'] = $db->escape_string(my_substr($this->useragent, 0, 200)); 509 510 $onlinedata['location1'] = (int)$speciallocs['1']; 511 $onlinedata['location2'] = (int)$speciallocs['2']; 512 $onlinedata['nopermission'] = 0; 513 $sid = $db->escape_string($sid); 514 515 $db->update_query("sessions", $onlinedata, "sid='{$sid}'"); 516 } 517 518 /** 519 * Create a new session. 520 * 521 * @param int $uid The user id to bind the session to. 522 */ 523 function create_session($uid=0) 524 { 525 global $db; 526 $speciallocs = $this->get_special_locations(); 527 528 // If there is a proper uid, delete by uid. 529 if($uid > 0) 530 { 531 $db->delete_query("sessions", "uid='{$uid}'"); 532 $onlinedata['uid'] = $uid; 533 } 534 else 535 { 536 // Is a spider - delete all other spider references 537 if($this->is_spider == true) 538 { 539 $db->delete_query("sessions", "sid='{$this->sid}'"); 540 } 541 542 $onlinedata['uid'] = 0; 543 } 544 545 // If the user is a search enginge spider, ... 546 if($this->is_spider == true) 547 { 548 $onlinedata['sid'] = $this->sid; 549 } 550 else 551 { 552 $onlinedata['sid'] = md5(random_str(50)); 553 } 554 $onlinedata['time'] = TIME_NOW; 555 $onlinedata['ip'] = $db->escape_binary($this->packedip); 556 557 $onlinedata['location'] = $db->escape_string(substr(get_current_location(false, $this->ignore_parameters), 0, 150)); 558 $onlinedata['useragent'] = $db->escape_string(my_substr($this->useragent, 0, 200)); 559 560 $onlinedata['location1'] = (int)$speciallocs['1']; 561 $onlinedata['location2'] = (int)$speciallocs['2']; 562 $onlinedata['nopermission'] = 0; 563 $db->replace_query("sessions", $onlinedata, "sid", false); 564 $this->sid = $onlinedata['sid']; 565 $this->uid = $onlinedata['uid']; 566 } 567 568 /** 569 * Find out the special locations. 570 * 571 * @return array Special locations array. 572 */ 573 function get_special_locations() 574 { 575 global $mybb, $db; 576 $array = array('1' => '', '2' => ''); 577 if(preg_match("#forumdisplay.php#", $_SERVER['PHP_SELF']) && $mybb->get_input('fid', MyBB::INPUT_INT) > 0 && $mybb->get_input('fid', MyBB::INPUT_INT) < 4294967296) 578 { 579 $array[1] = $mybb->get_input('fid', MyBB::INPUT_INT); 580 } 581 elseif(preg_match("#showthread.php#", $_SERVER['PHP_SELF'])) 582 { 583 if($mybb->get_input('tid', MyBB::INPUT_INT) > 0 && $mybb->get_input('tid', MyBB::INPUT_INT) < 4294967296) 584 { 585 $array[2] = $mybb->get_input('tid', MyBB::INPUT_INT); 586 } 587 588 // If there is no tid but a pid, trick the system into thinking there was a tid anyway. 589 elseif(isset($mybb->input['pid']) && !empty($mybb->input['pid'])) 590 { 591 $options = array( 592 "limit" => 1 593 ); 594 $query = $db->simple_select("posts", "tid", "pid=".$mybb->get_input('pid', MyBB::INPUT_INT), $options); 595 $post = $db->fetch_array($query); 596 if($post) 597 { 598 $array[2] = $post['tid']; 599 } 600 } 601 602 $thread = get_thread($array[2]); 603 if($thread) 604 { 605 $array[1] = $thread['fid']; 606 } 607 } 608 return $array; 609 } 610 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
| 2005 - 2021 © MyBB.de | Alle Rechte vorbehalten! | Sponsor: netcup | Cross-referenced by PHPXref |