I am having an issue with something I have already posted but I thought I would ask the problem again as I have more code with it now.
The ORIGINAL code that I have used for the tutorial
function checkLoggedIn($page)
{
$loginDiv = '';
$action = '';
if (isset($_POST['action']))
{
$action = stripslashes ($_POST['action']);
}
session_start ();
// Check if we're already logged in, and check session information against cookies
// credentials to protect against session hijacking
if (isset ($_COOKIE['project-name']['userID']) &&
crypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'],
$_COOKIE['project-name']['secondDigest']) ==
$_COOKIE['project-name']['secondDigest'] &&
(!isset ($_COOKIE['project-name']['username']) ||
(isset ($_COOKIE['project-name']['username']) &&
Users::checkCredentials($_COOKIE['project-name']['username'],
$_COOKIE['project-name']['digest']))))
{
// Regenerate the ID to prevent session fixation
session_regenerate_id ();
// Restore the session variables, if they don't exist
if (!isset ($_SESSION['project-name']['userID']))
{
$_SESSION['project-name']['userID'] = $_COOKIE['project-name']['userID'];
}
// Only redirect us if we're not already on a secured page and are not
// receiving a logout request
if (!isSecuredPage ($page) &&
$action != 'logout')
{
header ('Location: ./');
exit;
}
}
else
{
// If we're not already the login page, redirect us to the login page
if ($page != Page::LOGIN)
{
header ('Location: login.php');
exit;
}
}
// If we're not already logged in, check if we're trying to login or logout
if ($page == Page::LOGIN && $action != '')
{
switch ($action)
{
case 'login':
{
$userData = Users::checkCredentials (stripslashes ($_POST['login-username']),
stripslashes ($_POST['password']));
if ($userData[0] != 0)
{
$_SESSION['project-name']['userID'] = $userData[0];
$_SESSION['project-name']['ip'] = $_SERVER['REMOTE_ADDR'];
$_SESSION['project-name']['userAgent'] = $_SERVER['HTTP_USER_AGENT'];
if (isset ($_POST['remember']))
{
// We set a cookie if the user wants to remain logged in after the
// browser is closed
// This will leave the user logged in for 168 hours, or one week
setcookie('project-name[userID]', $userData[0], time () + (3600 * 168));
setcookie('project-name[username]',
$userData[1], time () + (3600 * 168));
setcookie('project-name[digest]', $userData[2], time () + (3600 * 168));
setcookie('project-name[secondDigest]',
DatabaseHelpers::blowfishCrypt($_SERVER['REMOTE_ADDR'] .
$_SERVER['HTTP_USER_AGENT'], 10), time () + (3600 * 168));
}
else
{
setcookie('project-name[userID]', $userData[0], false);
setcookie('project-name[username]', '', false);
setcookie('project-name[digest]', '', false);
setcookie('project-name[secondDigest]',
DatabaseHelpers::blowfishCrypt($_SERVER['REMOTE_ADDR'] .
$_SERVER['HTTP_USER_AGENT'], 10), time () + (3600 * 168));
}
header ('Location: ./');
exit;
}
else
{
$loginDiv = '<div id="login-box" class="error">The username or password ' .
'you entered is incorrect.</div>';
}
break;
}
// Destroy the session if we received a logout or don't know the action received
case 'logout':
default:
{
// Destroy all session and cookie variables
$_SESSION = array ();
setcookie('project-name[userID]', '', time () - (3600 * 168));
setcookie('project-name[username]', '', time () - (3600 * 168));
setcookie('project-name[digest]', '', time () - (3600 * 168));
setcookie('project-name[secondDigest]', '', time () - (3600 * 168));
// Destory the session
session_destroy ();
$loginDiv = '<div id="login-box" class="info">Thank you. Come again!</div>';
break;
}
}
}
return $loginDiv;
}
My code:
<?php
function encrypt($input)
{
$hash = password_hash($input, PASSWORD_DEFAULT);
return $hash;
}
function checkUserCreds($username, $password)
{
$id = 0;
$hash = '';
$db = new PDO('$dbDNS', '$dbuser', '$dbpass');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //Set error mode
try
{
$st = $db->prepare("SELECT id, login, email, pass FROM users WHERE login =:username");
$st->bindParam(':username', $username, PDO::PARAM_STR);
$success = $st->execute();
if($success)
{
$userData = $st->fetch();
$hash = $userData['pass'];
if (password_verify($password, $hash) == $hash)
{
$id = $userData['id'];
}
}
}
catch (PDOException $e)
{
$id = 0;
$hash = '';
}
$db = null;
return array ($id, $username, $hash);
}
function checkLoggedIn($page)
{
$loginMess='';
$action='';
if (isset($_POST['action']))
{
$action = stripslashes($_POST['action']);
}
session_start();
//Check if already logged in and check session information against cookies
if (isset($_COOKIE['sukd']['id']) && encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) == $_COOKIE['sukd']['hashv2'] && (!isset ($_COOKIE['sukd']['username']) || (isset ($_COOKIE['sukd']['username']) && checkUserCreds($_COOKIE['sukd']['username'], $_COOKIE['sukd']['hash']))))
{
echo "isset cookies: ON, GOOD <br>";
// Regenerate the ID to prevent session fixation
//session_regenerate_id ();
}
else
{
// If we are not on the login page, redirect.
if ($page != 'login')
{
header ('Location login.php');
exit;
}
}
if ($page = 'login' && $action != '')
{
switch($action)
{
case 'login':
{
$userData = checkUserCreds(stripslashes($_POST['username']), stripslashes($_POST['password']));
if ($userData[0] != 0)
{
$_SESSION['sukd']['id']=$userData[0];
$_SESSION['sukd']['ip']=$_SERVER['REMOTE_ADDR'];
$_SESSION['sukd']['userAgent']=$_SERVER['HTTP_USER_AGENT'];
if(isset($_POST['remember']))
{
//remember for 7 days
setcookie('sukd[id]', $userData[0], time () + (3600 * 168));
setcookie('sukd[username]', $userData[1], time() + (3600 * 168));
setcookie('sukd[hash]', $userData[2], time() + (3600 * 168));
setcookie('sukd[hashv2]', encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']), time () + (3600 * 168));
}
else
{
setcookie('sukd[id]', $userData[0], false);
setcookie('sukd[username]', '', false);
setcookie('sukd[hash]', '', false);
setcookie('sukd[hashv2]', encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']), time () + (3600 * 168));
}
header ('Location: ./');
exit;
}
else
{
$loginMess = "The username or password you entered is incorrect <br>";
}
break;
}
case 'logout':
default:
{
$_SESSION = array();
setcookie('sukd[id]', '', time () + (3600 * 168));
setcookie('sukd[username]', '', time() + (3600 * 168));
setcookie('sukd[hash]', '', time() + (3600 * 168));
setcookie('sukd[hashv2]', '', time () + (3600 * 168));
session_destroy();
$loginMess = "echo 'Successfully logged out <br>'";
break;
}
}
}
return $loginMess;
}
?>
It is called by checkLogged(login) for example and that outputs the login message if there is a problem. In addition it uses a hidden field with action to set the value, login or logout for the case switch. Currently, it logs in fine, adds the cookies etc.
However, the problem is, when a user has already logged in, it should be checking the code.
if (isset($_COOKIE['sukd']['id']) && encrypt($_SERVER['REMOTE_ADDR'] etc..
I couldn't really make much sense of the original code, so I am not even sure where to begin. The cookie array is a bit weird how it seems to be based on two different versions based on whether you setcookie or call the cookie.
If anyone has a more secure without going over the top method, I am happy for someone to enlighten me further on this.
Original to my code.
digest = hash
decondDigest = hashv2
