get_value('select val from repo_version');
else
$version = $rep->get_value('select val from version');
$http=new HttpInput();
/**
* If p_user is set , it means that the user tries to connect, the $_SESSION
* does not exist yet
*/
if ( isset ($_POST["p_user"] ) )
{
$http=new HttpInput();
// clean OLD session
Noalyss_user::clean_session($http->post("p_user"));
$User=new Noalyss_user($rep);
$User->Check(false,'LOGIN');
/*
* Check repository version
*/
if ($version != DBVERSIONREPO)
{
echo html_page_start();
echo h1(_("Version base de donneés incorrecte"));
echo span(_('Un instant svp'));
echo alert(_('Version de base de données incorrectes, vous devez mettre à jour'));
echo "";
exit();
}
if (defined('NOALYSS_CAPTCHA') && NOALYSS_CAPTCHA==true)
{
include("securimage/securimage.php");
$img = new Securimage();
$valid = $img->check($_POST['captcha_code']);
if ( $valid == false )
{
echo alert(_('Code invalide'));
header("Location: ".NOALYSS_URL."/index.php");
exit();
}
}
// if auth method = 1 send an email with number but only for PC access
if ($User->get_access_mode() =='PC' && $User->get_authent_method() == 1) {
// send an email and get the uuid of the request
$uuid=$User->send_code_otp ();
// var $backurl (string url) url before being disconnected
$backurl=(isset($_POST['backurl']))?$_POST['backurl']:"";
// display form to enter digit from email
$User->input_otp($uuid,$backurl);
// end
return;
}
// if auth method = 2 , only for PC access ask code from freeOTP
if ($User->get_access_mode() =='PC' && $User->get_authent_method() ==2 ) {
// var $backurl (string url) url before being disconnected
$backurl=(isset($_POST['backurl']))?$_POST['backurl']:"";
// display form to enter digit from email
$User->input_otp(url:$backurl);
// end
return;
}
if ($User->get_access_mode()=='PC')
{
// retrieve the previous locationforce the nocache
$backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
if ( isset ($_POST['backurl'])) {
$backurl=urldecode($_POST['backurl']);
// check that backurl is valid
$backurl=preg_replace('/^.*\?/','',$backurl);
$backurl=NOALYSS_URL."/do.php?$backurl";
}
header("Location: $backurl");
exit();
} else {
header("Location: ".NOALYSS_URL."/mobile.php");
exit();
}
}
else
{
/**
* User has a session
*/
$rep=new Database();
/*
* Check repository version
*/
if ( $version != DBVERSIONREPO)
{
echo html_page_start();
echo h1(_("Version base de donneés incorrecte"));
echo span(_('Un instant svp'));
echo alert(_('Version de base de données incorrectes, vous devez mettre à jour'));
echo "";
exit();
}
$User=new Noalyss_user($rep);
/**
* OTP is asked and authentication method is via OTP
*/
if (isset($_POST['to_validate']) || $User->get_authent_method() != 0) {
// remove also old one
$rep->exec_sql("delete from otp_send_secret where os_valid_time < now()");
try {
$request = $http->post("rq", "string", "");
$vrf_code = $http->post("vrf_code");
// if code was sent by email
if ($request != "") {
// find the row concerning this request
$os_id = $rep->get_value("select os_id from otp_send_secret
where os_request=$1
and use_id=$2
",
[$request, $User->id]);
if ($os_id == "") {
echo "Désolé, votre code a expiré";
echo "";
return;
}
$otp_send_secret = new Otp_Send_Secret_SQL($rep, $os_id);
/**
* second code is valid, so delete it
*/
if (
$vrf_code == $otp_send_secret->get('os_code')
|| $User->check_otp($vrf_code)
) {
$User->set_identified();
// var $backurl (string url) url before being disconnected
$backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
if ( isset ($_POST['backurl'])) {
$backurl=urldecode($_POST['backurl']);
// check that backurl is valid
$backurl=preg_replace('/^.*\?/','',$backurl);
$backurl=NOALYSS_URL."/do.php?$backurl";
$otp_send_secret->delete();
}
header("Location: $backurl");
return;
} else {
// var $backurl (string url) url before being disconnected
$backurl=(isset($_POST['backurl']))?$_POST['backurl']:"";
$User->input_otp(uuid:$request,url:$backurl);
return;
}
} else {
// connection avec freeOTP / Google Authenticator
if ($User->check_otp($vrf_code) == true) {
$User->set_identified();
// var $backurl (string url) url before being disconnected
$backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
if ( isset ($_POST['backurl'])) {
// var $backurl (string url) url before being disconnected
$backurl=urldecode($_POST['backurl']);
// check that backurl is valid
$backurl=preg_replace('/^.*\?/','',$backurl);
$backurl=NOALYSS_URL."/do.php?$backurl";
}
header("Location: $backurl");
return;
} else {
// var $backurl (string url) url before being disconnected
$backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
$User->input_otp(url:$backurl);
return;
}
}
} catch (Exception $exc) {
record_log($exc);
}
}
$User->Check();
echo "";
}
html_page_stop();
?>