"Not active" in Login Admin file allowing access
Posted: Mon Jun 04, 2018 12:10 am
Hello,
I am using the login script and have just realised that instead of going to the error page, a "Not active" login is allowing access in the same way as an "Active" one. I've puzzled over this for ages, please tell me where I'm going wrong.
I have copied the existing files across to a dummy login, which is at http://www.trenoweth.co.uk/Test/Login/login.php
file name : login.php
User name is: Logintest and p/w is: test
************************************************************************************************************************
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['form_name']) && $_POST['form_name'] == 'loginform')
{
$success_page = 'http://www.trenoweth.co.uk/Test/logintest.html';
$error_page = 'http://www.trenoweth.co.uk/Test/Login/loginfail.php';
$database = '../usersdb.php';
$crypt_pass = md5($_POST['password']);
$found = false;
$fullname = '';
$session_timeout = 600;
if(filesize($database) > 0)
{
$items = file($database, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
foreach($items as $line)
{
list($username, $password, $email, $name, $active) = explode('|', trim($line));
if ($username == $_POST['username'] && $active != "0" && $password == $crypt_pass)
{
$found = true;
$fullname = $name;
}
}
}
if($found == false)
{
header('Location: '.$error_page);
exit;
}
else
{
if (session_id() == "")
{
session_start();
}
$_SESSION['username'] = $_POST['username'];
$_SESSION['fullname'] = $fullname;
$_SESSION['expires_by'] = time() + $session_timeout;
$_SESSION['expires_timeout'] = $session_timeout;
header('Location: '.$success_page);
exit;
}
}
$username = isset($_COOKIE['username']) ? $_COOKIE['username'] : '';
$password = isset($_COOKIE['password']) ? $_COOKIE['password'] : '';
?>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>-</title>
<link href="login.css" rel="stylesheet">
</head>
<body>
<blockquote>
<p>Please remember that your user name and password are case sensitive - if a character is in the
incorrect case you'll simply be returned to this screen.</p>
</blockquote>
<div id="wb_Login1" style="position:absolute;left:150px;top:200px;width:300px;height:214px;z-index:0;">
<form name="loginform" method="post" accept-charset="UTF-8" action="<?php echo basename(__FILE__); ?>" id="loginform">
<input type="hidden" name="form_name" value="loginform">
<table id="Login1">
<tr>
<td class="header">Log In</td>
</tr>
<tr>
<td class="label"><label for="username">User Name</label></td>
</tr>
<tr>
<td class="row"><input class="input" name="username" type="text" id="username" value="<?php echo $username; ?>"></td>
</tr>
<tr>
<td class="label"><label for="password">Password</label></td>
</tr>
<tr>
<td class="row"><input class="input" name="password" type="password" id="password" value="<?php echo $password; ?>"></td>
</tr>
<tr>
<td style="text-align:center;vertical-align:bottom"><input class="button" type="submit" name="login" value="Log In" id="login"></td>
</tr>
</table>
</form>
</div>
</body>
</html>
************************************************************************************************************************
file name: loginfail.php
The same as above but with a message that either User name or Password was incorrect. This ought to show when the Login is set to "not active" (as it is at present) but instead it goes the the success file, logintest.html
************************************************************************************************************************
file name: http://www.trenoweth.co.uk/Test/logintest.html
A basic file advising successful login.
************************************************************************************************************************
admin file: http://www.trenoweth.co.uk/Test/LoginAdmin.php
P/w for this is: test2018
************************************************************************************************************************
I am using the login script and have just realised that instead of going to the error page, a "Not active" login is allowing access in the same way as an "Active" one. I've puzzled over this for ages, please tell me where I'm going wrong.
I have copied the existing files across to a dummy login, which is at http://www.trenoweth.co.uk/Test/Login/login.php
file name : login.php
User name is: Logintest and p/w is: test
************************************************************************************************************************
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['form_name']) && $_POST['form_name'] == 'loginform')
{
$success_page = 'http://www.trenoweth.co.uk/Test/logintest.html';
$error_page = 'http://www.trenoweth.co.uk/Test/Login/loginfail.php';
$database = '../usersdb.php';
$crypt_pass = md5($_POST['password']);
$found = false;
$fullname = '';
$session_timeout = 600;
if(filesize($database) > 0)
{
$items = file($database, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
foreach($items as $line)
{
list($username, $password, $email, $name, $active) = explode('|', trim($line));
if ($username == $_POST['username'] && $active != "0" && $password == $crypt_pass)
{
$found = true;
$fullname = $name;
}
}
}
if($found == false)
{
header('Location: '.$error_page);
exit;
}
else
{
if (session_id() == "")
{
session_start();
}
$_SESSION['username'] = $_POST['username'];
$_SESSION['fullname'] = $fullname;
$_SESSION['expires_by'] = time() + $session_timeout;
$_SESSION['expires_timeout'] = $session_timeout;
header('Location: '.$success_page);
exit;
}
}
$username = isset($_COOKIE['username']) ? $_COOKIE['username'] : '';
$password = isset($_COOKIE['password']) ? $_COOKIE['password'] : '';
?>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>-</title>
<link href="login.css" rel="stylesheet">
</head>
<body>
<blockquote>
<p>Please remember that your user name and password are case sensitive - if a character is in the
incorrect case you'll simply be returned to this screen.</p>
</blockquote>
<div id="wb_Login1" style="position:absolute;left:150px;top:200px;width:300px;height:214px;z-index:0;">
<form name="loginform" method="post" accept-charset="UTF-8" action="<?php echo basename(__FILE__); ?>" id="loginform">
<input type="hidden" name="form_name" value="loginform">
<table id="Login1">
<tr>
<td class="header">Log In</td>
</tr>
<tr>
<td class="label"><label for="username">User Name</label></td>
</tr>
<tr>
<td class="row"><input class="input" name="username" type="text" id="username" value="<?php echo $username; ?>"></td>
</tr>
<tr>
<td class="label"><label for="password">Password</label></td>
</tr>
<tr>
<td class="row"><input class="input" name="password" type="password" id="password" value="<?php echo $password; ?>"></td>
</tr>
<tr>
<td style="text-align:center;vertical-align:bottom"><input class="button" type="submit" name="login" value="Log In" id="login"></td>
</tr>
</table>
</form>
</div>
</body>
</html>
************************************************************************************************************************
file name: loginfail.php
The same as above but with a message that either User name or Password was incorrect. This ought to show when the Login is set to "not active" (as it is at present) but instead it goes the the success file, logintest.html
************************************************************************************************************************
file name: http://www.trenoweth.co.uk/Test/logintest.html
A basic file advising successful login.
************************************************************************************************************************
admin file: http://www.trenoweth.co.uk/Test/LoginAdmin.php
P/w for this is: test2018
************************************************************************************************************************
