diff --git a/Blacklight/http/AdminPage.php b/Blacklight/http/AdminPage.php
index 81bbc8ef6..df466ac4e 100644
--- a/Blacklight/http/AdminPage.php
+++ b/Blacklight/http/AdminPage.php
@@ -4,6 +4,7 @@ namespace Blacklight\http;
use App\Models\User;
use App\Models\Category;
+use Illuminate\Support\Facades\Auth;
/**
* All admin pages implement this class. Enforces admin role for requesting user.
@@ -28,7 +29,7 @@ class AdminPage extends BasePage
]
);
- if (! isset($this->userdata['user_roles_id']) || (int) $this->userdata['user_roles_id'] !== User::ROLE_ADMIN || ! User::isLoggedIn()) {
+ if (! Auth::check()) {
$this->show403(true);
}
diff --git a/Blacklight/http/BasePage.php b/Blacklight/http/BasePage.php
index ccab4c580..019da118e 100644
--- a/Blacklight/http/BasePage.php
+++ b/Blacklight/http/BasePage.php
@@ -129,6 +129,7 @@ class BasePage
$this->page = request()->input('page') ?? 'content';
if (Auth::check()) {
+ $this->userdata = User::find(Auth::id());
$this->setUserPreferences();
} else {
$this->theme = $this->getSettingValue('site.main.style');
@@ -196,10 +197,19 @@ class BasePage
/**
* Show 403 page.
+ *
+ *
+ * @param bool $from_admin
*/
- public function show403(): void
+ public function show403($from_admin = false): void
{
- die(view('errors.403'));
+ header(
+ 'Location: '.
+ ($from_admin ? str_replace('/admin', '', WWW_TOP) : WWW_TOP).
+ '/login?redirect='.
+ urlencode(request()->getRequestUri())
+ );
+ exit();
}
/**
@@ -273,7 +283,6 @@ class BasePage
*/
protected function setUserPreferences(): void
{
- $this->userdata = User::find(Auth::id());
$this->userdata['categoryexclusions'] = User::getCategoryExclusion(Auth::id());
$this->userdata['rolecategoryexclusions'] = RoleExcludedCategory::getRoleCategoryExclusion($this->userdata['user_roles_id']);
diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index c167d055b..89e271770 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -70,9 +70,4 @@ class LoginController extends Controller
'login' => 'These credentials do not match our records.',
]);
}
-
- public function logout()
- {
- Auth::logout();
- }
}
diff --git a/app/Http/Controllers/Auth/RegisterController.php b/app/Http/Controllers/Auth/RegisterController.php
index 2a13047db..510888674 100644
--- a/app/Http/Controllers/Auth/RegisterController.php
+++ b/app/Http/Controllers/Auth/RegisterController.php
@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
use App\Models\User;
use Blacklight\utility\Utility;
use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Facades\Validator;
use Illuminate\Foundation\Auth\RegistersUsers;
diff --git a/app/Models/User.php b/app/Models/User.php
index 5fba9ab9e..bc127b3ae 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -575,7 +575,7 @@ class User extends Authenticatable
}
/**
- * Generate a stron password.
+ * Generate a strong password.
*
*
* @param int $length
@@ -757,52 +757,6 @@ class User extends Authenticatable
)->id;
}
- /**
- * Verify if the user is logged in.
- *
- * @return bool
- * @throws \Exception
- */
- public static function isLoggedIn(): bool
- {
- if (isset($_SESSION['uid'])) {
- return true;
- }
- if (isset($_COOKIE['uid'], $_COOKIE['idh'])) {
- $u = self::find($_COOKIE['uid']);
-
- if ((int) $u['user_roles_id'] !== self::ROLE_DISABLED && $_COOKIE['idh'] === self::hashSHA1($u['userseed'].$_COOKIE['uid'])) {
- self::login($_COOKIE['uid'], $_SERVER['REMOTE_ADDR']);
- }
- }
-
- return isset($_SESSION['uid']);
- }
-
- /**
- * Log in a user.
- *
- * @param int $userID ID of the user.
- * @param string $host
- * @param bool $remember Save the user in cookies to keep them logged in.
- *
- * @throws \Exception
- */
- public static function login($userID, $host = '', $remember = false): void
- {
- $_SESSION['uid'] = $userID;
-
- if ((int) Settings::settingValue('..storeuserips') !== 1) {
- $host = '';
- }
-
- self::updateSiteAccessed($userID, $host);
-
- if ($remember === true) {
- self::setCookies($userID);
- }
- }
-
/**
* When a user logs in, update the last time they logged in.
*
@@ -819,41 +773,6 @@ class User extends Authenticatable
);
}
- /**
- * Set up cookies for a user.
- *
- * @param int $userID
- */
- public static function setCookies($userID): void
- {
- $user = self::find($userID);
- $secure_cookie = request()->secure();
- setcookie('uid', $userID, time() + 2592000, '/', null, $secure_cookie, true);
- setcookie('idh', self::hashSHA1($user['userseed'].$userID), time() + 2592000, '/', null, $secure_cookie, true);
- }
-
- /**
- * Return the User ID of the user.
- *
- * @return int
- */
- public static function currentUserId(): int
- {
- return $_SESSION['uid'] ?? -1;
- }
-
- /**
- * Logout the user, destroying his cookies and session.
- */
- public static function logout(): void
- {
- session_unset();
- session_destroy();
- $secure_cookie = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? '1' : '0');
- setcookie('uid', null, -1, '/', null, $secure_cookie, true);
- setcookie('idh', null, -1, '/', null, $secure_cookie, true);
- }
-
/**
* @param $uid
*/
diff --git a/public/admin/index.php b/public/admin/index.php
index 5746c58a3..b5b902450 100644
--- a/public/admin/index.php
+++ b/public/admin/index.php
@@ -4,6 +4,14 @@ use Blacklight\http\AdminPage;
require_once dirname(__DIR__, 2).DIRECTORY_SEPARATOR.'resources/views/themes/smarty.php';
+$kernel = $app->make(Illuminate\Contracts\Http\Kernel::class);
+
+$response = $kernel->handle(
+ $request = Illuminate\Http\Request::capture()
+);
+$response->send();
+$kernel->terminate($request, $response);
+
$page = new AdminPage();
$page->title = 'Admin Hangout';
diff --git a/public/admin/site-edit.php b/public/admin/site-edit.php
index b093a6a03..ba3de831e 100644
--- a/public/admin/site-edit.php
+++ b/public/admin/site-edit.php
@@ -8,9 +8,14 @@ use App\Models\Category;
use App\Models\Settings;
use Blacklight\http\AdminPage;
use Blacklight\utility\Utility;
+use Illuminate\Support\Facades\Auth;
$page = new AdminPage();
+if (! Auth::check()) {
+ $page->show403(true);
+}
+
$sites = new Sites();
$id = 0;
@@ -19,7 +24,6 @@ $action = request()->input('action') ?? 'view';
switch ($action) {
case 'submit':
-
if (! request()->has('book_reqids')) {
request()->merge(['book_reqids' => []]);
}
@@ -48,7 +52,7 @@ switch ($action) {
if ($error === '') {
$site = $ret;
$returnid = $site['id'];
- header('Location:'.WWW_TOP.'/site-edit.php?id='.$returnid);
+ request()->header('Location:'.WWW_TOP.'/site-edit.php?id='.$returnid);
} else {
$page->smarty->assign('error', $error);
$site = $sites->row2Object(request()->all());
diff --git a/public/pages/register.php b/public/pages/register.php
index 243d3c954..e70fceebf 100644
--- a/public/pages/register.php
+++ b/public/pages/register.php
@@ -36,23 +36,22 @@ if ($showRegister === 1) {
switch ($action) {
case 'submit':
if ($captcha->getError() === false) {
- if (Utility::checkCSRFToken() === true) {
- $userName = request()->input('username');
- $password = request()->input('password');
- $confirmPassword = request()->input('confirmpassword');
- $email = request()->input('email');
- if (! empty(request()->input('invitecode'))) {
- $inviteCode = request()->input('invitecode');
- }
+ $userName = request()->input('username');
+ $password = request()->input('password');
+ $confirmPassword = request()->input('confirmpassword');
+ $email = request()->input('email');
+ if (! empty(request()->input('invitecode'))) {
+ $inviteCode = request()->input('invitecode');
+ }
- // Check uname/email isn't in use, password valid. If all good create new user account and redirect back to home page.
- if ($password !== $confirmPassword) {
- $error = 'Password Mismatch';
- } else {
- // Get the default user role.
- $userDefault = UserRole::getDefaultRole();
+ // Check uname/email isn't in use, password valid. If all good create new user account and redirect back to home page.
+ if ($password !== $confirmPassword) {
+ $error = 'Password Mismatch';
+ } else {
+ // Get the default user role.
+ $userDefault = UserRole::getDefaultRole();
- $ret = User::signup(
+ $ret = User::signup(
$userName,
$password,
$email,
@@ -63,11 +62,11 @@ if ($showRegister === 1) {
$inviteCode
);
- if ($ret > 0) {
- User::login($ret, request()->ip());
- header('Location: '.WWW_TOP.'/');
- } else {
- switch ($ret) {
+ if ($ret > 0) {
+ session()->flash('You are already a member!');
+ redirect('/');
+ } else {
+ switch ($ret) {
case User::ERR_SIGNUP_BADUNAME:
$error = 'Your username must be at least five characters.';
break;
@@ -90,10 +89,7 @@ if ($showRegister === 1) {
$error = 'Failed to register.';
break;
}
- }
}
- } else {
- $page->showTokenError();
}
}
break;
diff --git a/resources/views/themes/Gentele/basepage.tpl b/resources/views/themes/Gentele/basepage.tpl
index 2e085a0d4..f32687beb 100755
--- a/resources/views/themes/Gentele/basepage.tpl
+++ b/resources/views/themes/Gentele/basepage.tpl
@@ -117,8 +117,10 @@
API
- Sign Out
+
+ Sign Out
+
+
{else}
Sign In
@@ -228,6 +230,10 @@
});
+
+