alert('未开启登录');window.location.href='./';");
}
if(isset($_GET['logout'])){
if(!checkRefererHost())exit();
setcookie("user_token", "", time() - 1, '/');
@header('Content-Type: text/html; charset=UTF-8');
exit("");
}elseif(isset($_REQUEST['act']) && $_REQUEST['act']=='connect'){
@header('Content-Type: application/json; charset=UTF-8');
$type = isset($_POST['type'])?$_POST['type']:(isset($_GET['type'])?$_GET['type']:exit('{"code":-1,"msg":"no type"}'));
$bind = isset($_POST['bind'])?$_POST['bind']:(isset($_GET['bind'])?$_GET['bind']:'');
if(!$conf['login_apiurl'] || !$conf['login_appid'] || !$conf['login_appkey'])exit('{"code":-1,"msg":"未配置好快捷登录接口信息"}');
if($bind=='1'){
if($islogin2!=1)exit('{"code":-1,"msg":"请先登录"}');
$_SESSION['bind_type'] = $type;
}
$Oauth = new \lib\Oauth($conf['login_apiurl'], $conf['login_appid'], $conf['login_appkey']);
$res = $Oauth->login($type);
if(isset($res['code']) && $res['code']==0){
$result = ['code'=>0, 'url'=>$res['url']];
}elseif(isset($res['code'])){
$result = ['code'=>-1, 'msg'=>$res['msg']];
}else{
$result = ['code'=>-1, 'msg'=>'快捷登录接口请求失败'];
}
exit(json_encode($result));
}elseif(isset($_GET['code']) && $_GET['type'] && $_GET['state']){
if($_GET['state'] != $_SESSION['Oauth_state']){
sysmsg("The state does not match. You may be a victim of CSRF.
");
}
$type = $_GET['type'];
$typename = $type=='wx'?'微信':'QQ';
$Oauth = new \lib\Oauth($conf['login_apiurl'], $conf['login_appid'], $conf['login_appkey']);
$arr = $Oauth->callback();
if(isset($arr['code']) && $arr['code']==0){
$openid=$arr['social_uid'];
$access_token=$arr['access_token'];
$nickname=trim($arr['nickname']);
if(empty($nickname) || $nickname=='-') $nickname = $typename.'用户';
$faceimg=$arr['faceimg'];
}elseif(isset($arr['code'])){
sysmsg('error:
'.$arr['errcode'].'msg :
'.$arr['msg']);
}else{
sysmsg('获取登录数据失败');
}
if(isset($_SESSION['bind_type']) && $islogin2==1){
$bindtype = $_SESSION['bind_type'];
unset($_SESSION['bind_type']);
if($bindtype != $type){
sysmsg('绑定类型不匹配，请重新操作');
}
$bindfield = $type=='wx'?'wx_openid':'qq_openid';
$exists=$DB->find('user','uid',[$bindfield=>$openid], null, '1');
if(!$exists){
$exists=$DB->find('user','uid',['type'=>$type,'openid'=>$openid], null, '1');
}
if($exists && $exists['uid'] != $userrow['uid']){
sysmsg('该'.$typename.'账号已被其他用户绑定');
}
$DB->update('user', [$bindfield => $openid], ['uid'=>$userrow['uid']]);
@header('Content-Type: text/html; charset=UTF-8');
exit("");
}
$userrow=$DB->find('user','*',['type'=>$type, 'openid'=>$openid], null, '1');
if(!$userrow){
$bindfield = $type=='wx'?'wx_openid':'qq_openid';
$userrow=$DB->find('user','*',[$bindfield=>$openid], null, '1');
}
if(!$userrow){
if(!$DB->insert('user', [
'type' => $type,
'openid' => $openid,
'nickname' => $nickname,
'faceimg' => $faceimg,
'enable' => 1,
'regip' => $clientip,
'loginip' => $clientip,
'addtime' => 'NOW()',
'lasttime' => 'NOW()',
]))sysmsg('用户注册失败 '.$DB->error());
$uid = $DB->lastInsertId();
$userrow = $DB->getRow("SELECT * FROM pre_user WHERE uid='{$uid}' LIMIT 1");
}else{
if($userrow['enable']==0){
$_SESSION['user_block'] = true;
sysmsg('当前用户已被禁止登录');
}
$uid = $userrow['uid'];
$DB->update('user', ['loginip' => $clientip, 'lasttime'=>'NOW()'], ['uid'=>$uid]);
}
if($_SESSION['user_block']){
$DB->update('user', ['enable' => 0], ['uid'=>$uid]);
sysmsg('当前用户已被禁止登录');
}
if(isset($_SESSION['fileids']) && count($_SESSION['fileids'])>0){
$ids = array_reverse($_SESSION['fileids']);
if(count($ids) > 60){
$ids = array_splice($ids, 0, 60);
}
$ids = implode(',',$ids);
$DB->exec("UPDATE pre_file SET uid='{$uid}' WHERE id IN ({$ids}) AND uid=0");
}
$session=md5($userrow['type'].$userrow['openid'].$password_hash);
$expiretime=time()+2592000;
$token=authcode("{$uid}\t{$session}\t{$expiretime}", 'ENCODE', SYS_KEY);
ob_clean();
setcookie("user_token", $token, time() + 2592000, '/');
exit("");
}elseif($islogin2==1){
@header('Content-Type: text/html; charset=UTF-8');
exit("");
}elseif(isset($_POST['act']) && $_POST['act']=='login'){
@header('Content-Type: application/json; charset=UTF-8');
$username = trim(isset($_POST['username'])?daddslashes($_POST['username']):'');
$password = isset($_POST['password'])?$_POST['password']:'';
if(empty($username) || empty($password)){
exit('{"code":-1,"msg":"用户名和密码不能为空"}');
}
$userrow=$DB->find('user','*',['type'=>'local','username'=>$username], null, '1');
if(!$userrow || !password_verify($password, $userrow['password'])){
exit('{"code":-1,"msg":"用户名或密码错误"}');
}
if($userrow['enable']==0){
exit('{"code":-1,"msg":"当前用户已被禁止登录"}');
}
$uid=$userrow['uid'];
$DB->update('user', ['loginip' => $clientip, 'lasttime'=>'NOW()'], ['uid'=>$uid]);
if(isset($_SESSION['fileids']) && count($_SESSION['fileids'])>0){
$ids = array_reverse($_SESSION['fileids']);
if(count($ids) > 60){
$ids = array_splice($ids, 0, 60);
}
$ids = implode(',',$ids);
$DB->exec("UPDATE pre_file SET uid='{$uid}' WHERE id IN ({$ids}) AND uid=0");
}
$session=md5($userrow['type'].$userrow['openid'].$password_hash);
$expiretime=time()+2592000;
$token=authcode("{$uid}\t{$session}\t{$expiretime}", 'ENCODE', SYS_KEY);
setcookie("user_token", $token, time() + 2592000, '/');
exit('{"code":0,"msg":"登录成功"}');
}
$title = '用户登录 - ' . $conf['title'];
$authTitle = '账号密码登录';
$authSub = '欢迎回来，请登录你的账号';
$authIcon = 'fa-sign-in';
include SYSTEM_ROOT.'auth_header.php';
?>