diff --git a/bookmark/bookmark.php b/bookmark/bookmark.php index 1e5b3e9..bee15a6 100644 --- a/bookmark/bookmark.php +++ b/bookmark/bookmark.php @@ -1,6 +1,7 @@ getMessage(); } -if(isset($_SESSION['admin_login']) && $_SESSION['admin_login'] == true) { - - $passQuery = $pdo->prepare("SELECT username,userid,loginid,follow,admin,role,sacinfo,blocklist FROM account WHERE userid = :userid"); - $passQuery->bindValue(':userid', safetext($_SESSION['userid'])); - $passQuery->execute(); - $res = $passQuery->fetch(); - if(empty($res["userid"])){ - header("Location: ../login.php"); - exit; - }elseif($_SESSION['loginid'] === $res["loginid"] && $_SESSION['userid'] == $res["userid"]){ - // セッションに値をセット - $userid = safetext($res['userid']); // セッションに格納されている値をそのままセット - $username = safetext($res['username']); // セッションに格納されている値をそのままセット - $loginid = safetext($res["loginid"]); - $role = safetext($res["role"]); - $sacinfo = safetext($res["sacinfo"]); - $myblocklist = safetext($res["blocklist"]); - $myfollowlist = safetext($res["follow"]); - $_SESSION['admin_login'] = true; - $_SESSION['userid'] = $userid; - $_SESSION['username'] = $username; - $_SESSION['loginid'] = $res["loginid"]; - setcookie('userid', $userid, [ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('username', $username,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('loginid', $res["loginid"],[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('admin_login', true,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - }else{ - header("Location: ../login.php"); - exit; - } - - -} elseif (isset($_COOKIE['admin_login']) && $_COOKIE['admin_login'] == true) { - - $passQuery = $pdo->prepare("SELECT username,userid,loginid,follow,admin,role,sacinfo,blocklist FROM account WHERE userid = :userid"); - $passQuery->bindValue(':userid', safetext($_COOKIE['userid'])); - $passQuery->execute(); - $res = $passQuery->fetch(); - if(empty($res["userid"])){ - header("Location: ../login.php"); - exit; - }elseif($_COOKIE['loginid'] === $res["loginid"] && $_COOKIE['userid'] == $res["userid"]){ - // セッションに値をセット - $userid = safetext($res['userid']); // クッキーから取得した値をセット - $username = safetext($res['username']); // クッキーから取得した値をセット - $loginid = safetext($res["loginid"]); - $role = safetext($res["role"]); - $sacinfo = safetext($res["sacinfo"]); - $myblocklist = safetext($res["blocklist"]); - $myfollowlist = safetext($res["follow"]); - $_SESSION['admin_login'] = true; - $_SESSION['userid'] = $userid; - $_SESSION['username'] = $username; - $_SESSION['loginid'] = $res["loginid"]; - setcookie('userid', $userid,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('username', $username,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('loginid', $res["loginid"],[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - setcookie('admin_login', true,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - }else{ - header("Location: ../login.php"); - exit; - } - - -} else { - // ログインが許可されていない場合、ログインページにリダイレクト - header("Location: ../login.php"); - exit; -} -if(empty($userid)){ - header("Location: ../login.php"); - exit; -} -if(empty($username)){ - header("Location: ../login.php"); +//ログイン認証--------------------------------------------------- +blockedIP($_SERVER['REMOTE_ADDR']); +$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); +if($is_login === false){ + header("Location: ../index.php"); exit; +}else{ + $userid = safetext($is_login['userid']); + $username = safetext($is_login['username']); + $loginid = safetext($is_login["loginid"]); + $role = safetext($is_login["role"]); + $sacinfo = safetext($is_login["sacinfo"]); + $myblocklist = safetext($is_login["blocklist"]); + $myfollowlist = safetext($is_login["follow"]); + $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); $notiQuery->bindValue(':userid', $userid); diff --git a/check.php b/check.php index 1b8ec7f..1165d20 100644 --- a/check.php +++ b/check.php @@ -61,49 +61,14 @@ try { $error_message[] = $e->getMessage(); } -if(isset($_SESSION['admin_login']) && $_SESSION['admin_login'] === true && isset($_COOKIE['loginid']) && isset($_SESSION['userid'])) { - $options = array( - // SQL実行失敗時に例外をスルー - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, - // デフォルトフェッチモードを連想配列形式に設定 - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - // バッファードクエリを使う（一度に結果セットを全て取得し、サーバー負荷を軽減） - // SELECTで得た結果に対してもrowCountメソッドを使えるようにする - PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, - ); - $dbh = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); - $acck = $dbh->prepare("SELECT userid, loginid FROM account WHERE userid = :userid"); - $acck->bindValue(':userid', $_SESSION['userid']); - $acck->execute(); - $acck_data = $acck->fetch(); - if(!empty($acck_data)){ - if($_COOKIE['loginid'] === $acck_data["loginid"] && $_SESSION['userid'] === $acck_data["userid"] ){ - header("Location: home/index.php"); - exit; - } - } -} elseif (isset($_COOKIE['admin_login']) && $_COOKIE['admin_login'] == true && isset($_COOKIE['loginid']) && isset($_COOKIE['userid'])) { - $options = array( - // SQL実行失敗時に例外をスルー - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, - // デフォルトフェッチモードを連想配列形式に設定 - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - // バッファードクエリを使う（一度に結果セットを全て取得し、サーバー負荷を軽減） - // SELECTで得た結果に対してもrowCountメソッドを使えるようにする - PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, - ); - $dbh = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); - $acck = $dbh->prepare("SELECT userid, loginid FROM account WHERE userid = :userid"); - $acck->bindValue(':userid', $_COOKIE['userid']); - $acck->execute(); - $acck_data = $acck->fetch(); - if(!empty($acck_data)){ - if($_COOKIE['loginid'] === $acck_data["loginid"] && $_COOKIE['userid'] === $acck_data["userid"] ){ - header("Location: home/index.php"); - exit; - } - } +//ログイン認証--------------------------------------------------- +blockedIP($_SERVER['REMOTE_ADDR']); +$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); +if(!($is_login === false)){ + header("Location: /home/"); + exit; } +//------------------------------------------------------------- if( !empty($_POST['btn_submit']) ) { $useragent = safetext($_SERVER['HTTP_USER_AGENT']); diff --git a/function/function.php b/function/function.php index 74bd780..879ac03 100644 --- a/function/function.php +++ b/function/function.php @@ -40,22 +40,20 @@ function uwuzuUserLogin($session, $cookie, $ip_addr, $operation_permission = "us if(isset($session['loginid'])){ $loginid = safetext($session['loginid']); - if(isset($session['loginkey'])) { - $loginkey = safetext($session['loginkey']); - } else { - $loginkey = null; - } - } elseif (isset($cookie['loginid'])){ + }else if(isset($cookie['loginid'])){ $loginid = safetext($cookie['loginid']); - if(isset($cookie['loginkey'])) { - $loginkey = safetext($cookie['loginkey']); - } else { - $loginkey = null; - } } else { return false; } + if(isset($session['loginkey'])) { + $loginkey = safetext($session['loginkey']); + }else if(isset($cookie['loginkey'])){ + $loginkey = safetext($cookie['loginkey']); + } else { + $loginkey = null; + } + $loginQuery = $pdo->prepare("SELECT * FROM account WHERE loginid = :loginid"); $loginQuery->bindValue(':loginid', $loginid); $loginQuery->execute(); @@ -95,9 +93,7 @@ function uwuzuUserLogin($session, $cookie, $ip_addr, $operation_permission = "us }else{ $is_login = false; } - } - - if(isset($cookie['userid']) && isset($cookie['username'])){ + }else if(isset($cookie['userid']) && isset($cookie['username'])){ if($cookie['userid'] === $loginResponse["userid"] && $cookie['username'] === $loginResponse["username"]){ if($operation_permission === "admin"){ if($loginResponse["admin"] == "yes"){ @@ -111,6 +107,8 @@ function uwuzuUserLogin($session, $cookie, $ip_addr, $operation_permission = "us }else{ $is_login = false; } + }else{ + $is_login = false; } } diff --git a/img/tutorial_image/image2.png b/img/tutorial_image/image2.png index 704bf76..1a49e99 100644 Binary files a/img/tutorial_image/image2.png and b/img/tutorial_image/image2.png differ diff --git a/login.php b/login.php index 5d66fc2..9d25d49 100644 --- a/login.php +++ b/login.php @@ -163,10 +163,7 @@ if( !empty($_POST['btn_submit']) ) { if($row["userid"] == $userid){ if(uwuzu_password_verify($password,$row["password"])){ if(empty($row["authcode"])){ - $_SESSION['admin_login'] = true; - $_SESSION['userid'] = $userid; - $_SESSION['loginid'] = $row["loginid"]; $_SESSION['form_data'] = array();//フォーム初期化 // リダイレクト先のURLへ転送する diff --git a/require/botbox.php b/require/botbox.php index dba78a0..9ff737d 100644 --- a/require/botbox.php +++ b/require/botbox.php @@ -27,7 +27,7 @@
サーバー情報
お知らせ
 - +
絵文字登録
お知らせ配信
サーバー設定
 diff --git a/require/tutorial.php b/require/tutorial.php index 2a6ea13..f3ab69f 100644 --- a/require/tutorial.php +++ b/require/tutorial.php @@ -48,13 +48,15 @@