".$clang->gT("Passed single-use password was wrong or user doesn't exist")."
";
+ $loginsummary .= "
".$clang->gT("Continue")."
\n";
+ }
+ //both passwords match
+ else
+ {
+
+ //delete one time password in database
+ $uquery = "UPDATE ".db_table_name('users')."
+ SET one_time_pw=''
+ WHERE users_name='".db_quote($user)."'";
+
+ $uresult = $connect->Execute($uquery);
+
+ //data necessary for following functions
+ $_SESSION['user'] = $srow['users_name'];
+ $_SESSION['checksessionpost'] = sRandomChars(10);
+ $_SESSION['loginID'] = $srow['uid'];
+ $_SESSION['dateformat'] = $srow['dateformat'];
+ $_SESSION['htmleditormode'] = $srow['htmleditormode'];
+ $_SESSION['questionselectormode'] = $srow['questionselectormode'];
+ $_SESSION['templateeditormode'] = $srow['templateeditormode'];
+ $_SESSION['full_name'] = $srow['full_name'];
+ GetSessionUserRights($_SESSION['loginID']);
+
+ // Check if the user has changed his default password
+ if (strtolower($srow['password'])=='password')
+ {
+ $_SESSION['pw_notify']=true;
+ $_SESSION['flashmessage']=$clang->gT("Warning: You are still using the default password ('password'). Please change your password and re-login again.");
+ }
+ else
+ {
+ $_SESSION['pw_notify']=false;
+ }
+
+ //delete passed information
+ unset($_GET['user']);
+ unset($_GET['onepass']);
+
+ } //else -> passwords match
+
+ } //else -> password found
+
+ } //else -> one time passwords enabled
+
+ } //else -> one time passwords set
+
+} //else -> data was passed by URL
+
+
+
+
+
+// check data for login
+if( isset($_POST['user']) && isset($_POST['password']) ||
+($action == "forgotpass") || ($action == "login") ||
+($action == "logout") ||
+($useWebserverAuth === true && !isset($_SESSION['loginID'])) )
+{
+ include("usercontrol.php");
+}
+
+
+
+
+// login form
+if(!isset($_SESSION['loginID']) && $action != "forgotpass" && ($action != "logout" || ($action == "logout" && !isset($_SESSION['loginID'])))) // && $action != "login") // added by Dennis
+{
+ if($action == "forgotpassword")
+ {
+ $loginsummary = '
+
+
".$clang->gT("Incorrect username and/or password!")."
".$clang->gT("Reloading screen. Please wait.")."\n";
+ }
+ $loginsummary .= "
\n";
+ GetSessionUserRights($_SESSION['loginID']);
+
+ //go to queXS
+ $loc = "";
+ if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
+ $loc = "admin";
+ else
+ {
+ $utest = $connect->GetOne("SELECT username FROM client WHERE username = '" . $_SESSION['user'] . "'");
+ if (!empty($utest))
+ $loc = "client";
+ }
+ header('Location: ' . QUEXS_URL . $loc);
+ die();
+ }
+ else
+ {
+ $query = fGetLoginAttemptUpdateQry($bLoginAttempted,$sIp);
+
+ $result = $connect->Execute($query) or safe_die ($query."
".$connect->ErrorMsg());;
+ if ($result)
+ {
+ // wrong or unknown username
+ $loginsummary .= "
".$clang->gT("Incorrect username and/or password!")."
";
+ if ($intNthAttempt+1>=$maxLoginAttempt)
+ $loginsummary .= sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))."
";
+ $loginsummary .= "
".$clang->gT("Continue")."
\n";
+ }
+
+ }
+ }
+
+ }
+ else{
+ $loginsummary .= "
".sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))."
";
+ $loginsummary .= "
".$clang->gT("Continue")."
\n";
+ }
+ }
+ }
+ elseif($useWebserverAuth === true && !isset($_SERVER['PHP_AUTH_USER'])) // LimeSurvey expects webserver auth but it has not been achieved
+ {
+ $loginsummary .= "
".$clang->gT("LimeSurvey is setup to use the webserver authentication, but it seems you have not already been authenticated")."
";
+ $loginsummary .= "
".$clang->gT("Please contact your system administrator")."
\n";
+ }
+ elseif($useWebserverAuth === true && isset($_SERVER['PHP_AUTH_USER'])) // normal login through webserver authentication
+ {
+ $action = 'login';
+ // we'll include database.php
+ // we need to unset surveyid
+ // that could be set if the user clicked on
+ // a link with all params before first auto-login
+ unset($surveyid);
+
+ $loginsummary = '';
+ // getting user name, optionnally mapped
+ if (isset($userArrayMap) && is_array($userArrayMap) &&
+ isset($userArrayMap[$_SERVER['PHP_AUTH_USER']]))
+ {
+ $mappeduser=$userArrayMap[$_SERVER['PHP_AUTH_USER']];
+ }
+ else
+ {
+ $mappeduser=$_SERVER['PHP_AUTH_USER'];
+ }
+
+ include("database.php");
+ $query = "SELECT uid, users_name, password, parent_id, email, lang, htmleditormode, questionselectormode, templateeditormode, dateformat FROM ".db_table_name('users')." WHERE users_name=".$connect->qstr($mappeduser);
+ $ADODB_FETCH_MODE = ADODB_FETCH_ASSOC; //Checked
+ $result = $connect->SelectLimit($query, 1) or safe_die ($query."
".$connect->ErrorMsg());
+ if ($result->RecordCount() < 1)
+ {
+ // In case the hook function is defined
+ // overrite the default auto-import profile
+ // by this function's result
+ if (function_exists("hook_get_autouserprofile"))
+ {
+ // If defined this function returns an array
+ // describing the defaukt profile for this user
+ $WebserverAuth_autouserprofile = hook_get_autouserprofile($mappeduser);
+ }
+
+ if (isset($WebserverAuth_autocreateUser) &&
+ $WebserverAuth_autocreateUser === true &&
+ isset($WebserverAuth_autouserprofile) &&
+ is_array ($WebserverAuth_autouserprofile) &&
+ count($WebserverAuth_autouserprofile) > 0 )
+ { // user doesn't exist but auto-create user is set
+ $isAuthenticated=false;
+ $new_pass = createPassword();
+
+ $uquery = "INSERT INTO {$dbprefix}users "
+ ."(users_name, password,full_name,parent_id,lang,email,create_survey,create_user,delete_user,superadmin,configurator,manage_template,manage_label) "
+ ."VALUES ("
+ . $connect->qstr($mappeduser).", "
+ . "'".SHA256::hashing($new_pass)."', "
+ . "'".db_quote($WebserverAuth_autouserprofile['full_name'])."', "
+ . getInitialAdmin_uid()." , "
+ . "'".$WebserverAuth_autouserprofile['lang']."', "
+ . "'".db_quote($WebserverAuth_autouserprofile['email'])."', "
+ . intval($WebserverAuth_autouserprofile['create_survey']).","
+ . intval($WebserverAuth_autouserprofile['create_user']).","
+ . intval($WebserverAuth_autouserprofile['delete_user']).","
+ . intval($WebserverAuth_autouserprofile['superadmin']).","
+ . intval($WebserverAuth_autouserprofile['configurator']).","
+ . intval($WebserverAuth_autouserprofile['manage_template']).","
+ . intval($WebserverAuth_autouserprofile['manage_label'])
+ .")";
+
+ $uresult = $connect->Execute($uquery); //Checked
+ if ($uresult)
+ {
+ $isAuthenticated=true;
+ $newqid = $connect->Insert_ID("{$dbprefix}users","uid");
+ $arrayTemplates=explode(",",$WebserverAuth_autouserprofile['templatelist']);
+ foreach ($arrayTemplates as $tplname)
+ {
+ $template_query = "INSERT INTO {$dbprefix}templates_rights VALUES('$newqid','$tplname','1')";
+ $connect->Execute($template_query); //Checked
+ }
+
+ // read again user from newly created entry
+ $result = $connect->SelectLimit($query, 1) or safe_die ($query."
".$connect->ErrorMsg());//Checked
+ }
+ else
+ {
+ $loginsummary .= "
".$clang->gT("Auto-import of user failed!")."
";
+ $loginsummary .= "
".$clang->gT("Continue")."
\n";
+ $isAuthenticated=false;
+ }
+
+ }
+ else
+ {
+ $query = fGetLoginAttemptUpdateQry($bLoginAttempted,$sIp);
+
+ $result = $connect->Execute($query) or safe_die ($query."
".$connect->ErrorMsg());;
+ if ($result)
+ {
+ // wrong or unknown username
+ $loginsummary .= "
".$clang->gT("Incorrect username and/or password!")."
";
+ if ($intNthAttempt+1>=$maxLoginAttempt)
+ $loginsummary .= sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))."
";
+ $loginsummary .= "
".$clang->gT("Continue")."
\n";
+ }
+ $isAuthenticated=false;
+ }
+
+ }
+ else
+ { // User already exists
+ $isAuthenticated=true;
+ }
+
+ if ($isAuthenticated ===true)
+ { // user exists and was authenticated by webserver
+ $fields = $result->FetchRow();
+
+ $_SESSION['loginID'] = intval($fields['uid']);
+ $_SESSION['user'] = $fields['users_name'];
+ $_SESSION['adminlang'] = $fields['lang'];
+ $_SESSION['htmleditormode'] = $fields['htmleditormode'];
+ $_SESSION['questionselectormode'] = $fields['questionselectormode'];
+ $_SESSION['templateeditormode'] = $fields['templateeditormode'];
+ $_SESSION['dateformat'] = $fields['dateformat'];
+ $_SESSION['checksessionpost'] = sRandomChars(10);
+ $_SESSION['pw_notify']=false;
+ $clang = new limesurvey_lang($_SESSION['adminlang']);
+ $login = true;
+
+ $loginsummary .= "
" .sprintf($clang->gT("Welcome %s!"),$_SESSION['user']) . "
";
+ $loginsummary .= $clang->gT("You logged in successfully.");
+
+ if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING'] &&
+ strpos($_SERVER['QUERY_STRING'], "action=logout") === FALSE)
+ {
+ $_SESSION['metaHeader']="";
+ $loginsummary .= "
".$clang->gT("Reloading screen. Please wait.")."\n";
+ }
+ $loginsummary .= "
\n";
+ GetSessionUserRights($_SESSION['loginID']);
+ }
+ }
+}
+elseif ($action == "logout")
+{
+ killSession();
+ $logoutsummary = '
'.$clang->gT("Logout successful."); +} + +elseif ($action == "adduser" && $_SESSION['USER_RIGHT_CREATE_USER']) +{ + $addsummary = "
\n"; + + $new_user = FlattenText($postnew_user,true); + $new_email = FlattenText($postnew_email,true); + $new_full_name = FlattenText($postnew_full_name,true); + + $valid_email = true; + if(!validate_email($new_email)) + { + $valid_email = false; + $addsummary .= "