WooYun.org

<?


$IS_LOGIN = true;


require "./includes/headinc.php";


register_shutdown_function('union_end');





if($action == 'logout') {


	$union_user = $union_pass = $gid = '';


	//clearcookies();


	//$sess_arr = array();


	$_SESSION[sess_arr] = $sess_arr = '';


	session_unregister('sess_arr');


	echo "<meta http-equiv=\"refresh\" content=\"0;url=admin.php\">";	


	//header("Location:login.php");


	exit;


}





if($action == 'login') {


	$validate_t = crypt($validate, 'ckskya576');


	if($_SESSION[md5vali] != $validate_t)


		//showmessage("验证码检验失败,请返回");





	$UNION_USER = '';


	$loginpass2 = md5($loginpass);


	$UNION_USER = $db->fetchSingle("SELECT uid AS union_uid, fig AS union_fig, username AS union_user, password AS union_pass FROM table_members WHERE username='$loginuser' && password='$loginpass2'");


	if($UNION_USER[union_uid] && !$UNION_USER[union_fig])


		showmessage('此帐号不可用');


	if ($UNION_USER) {


		//$qs_ts = $db->query_fetch("select * from table_sessions where username='$UNION_USER[union_user]' && ip!='$yip'");


		//if($qs_ts[username])


		//	showmessage('对不起, 同一帐号不能同时在多台电脑上登录');


		//echo "delete from table_sessions where ip='$yip' && sesskey!='".session_id()."'";exit;


		//$db->query("delete from table_sessions where ip='$yip' && sesskey!='".session_id()."'");


		#$db->queryDb("update table_members set loginnum=loginnum+1,lastlogin='".time()."' where uid=$UNION_USER[union_uid]",1);


		//union_setcookie("union_user_", $UNION_USER['union_user']);


		//union_setcookie("union_pass_", $UNION_USER['union_pass']);


	}else{


		$errorlog = "$loginuser\t".substr($loginpass, 0, 2);


		for($i = 3; $i < strlen($loginpass); $i++) {


			$errorlog .= "*";


		}


		$errorlog .= substr($loginpass, -1)."\t$yip\t$timestamp\n";





		@$fp = fopen("./data/log/passlog.php", "a");


		@flock($fp, 3);


		@fwrite($fp, $errorlog);


		@fclose($fp);





		//clearcookies();


	}

$errorlog = "$loginuser\t".substr($loginpass, 0, 2);


		for($i = 3; $i < strlen($loginpass); $i++) {


			$errorlog .= "*";


		}


		$errorlog .= substr($loginpass, -1)."\t$yip\t$timestamp\n";





		@$fp = fopen("./data/log/passlog.php", "a");


		@flock($fp, 3);


		@fwrite($fp, $errorlog);


		@fclose($fp);