File Manager

✏️ Edit File: /home/coemyoza/sms.coeminna.edu.ng/fps/process_login.php

<?php include '../db/dbc.php';

//$url = web_root;

sleep(3);

//Login Scripts	
if (isset($_POST['login']) == 'Login')
	{
			
		$user = $_POST['username'];
		$pass = $_POST['password'];
		
		if (strpos($user,'@') === false) {
			$user_cond = "username = '$user'";
		} else {
			  $user_cond = "email = '$user'";
		}
		
//start script to determine the Academic Session and compare it with student level	
		$total_cont = mysqli_query($link,"SELECT MAX(id) AS max_id FROM default_academic");
		list($max_id) = mysqli_fetch_row($total_cont);
//end script to determine the Academic Session and compare it with student level

//select from default_users table	
		$result = mysqli_query($link,"SELECT id, username, password, access_level, dept_id, level_id, academic_statusid, status, document_type, last_login FROM default_users WHERE $user_cond AND `banned` = '0'");
		$num = mysqli_num_rows($result);
		// Match row found with more than 1 results  - the user is authenticated. 
		if ($num > 0) {
			list($id, $username, $password, $access_level, $dept_id, $level_id, $academic_statusid, $status, $document_type, $last_login) = mysqli_fetch_row($result);
			
if($status == 0) {
	$return['error'] = true;
	$return['msg'] = 'OOPS! Account not active. Please check your email for activation code.';
	}
	
			//check against salt
	elseif ($password === PwdHash($pass,substr($password,0,9))) {
				$return['error'] = false;
				
		 		// this sets session and logs user in  
				session_start();
				session_regenerate_id (true); //prevent against session fixation attacks.
				
//compare student level with academic status
if(($access_level=='1') && ($max_id > $academic_statusid)) { $ac_level = $level_id + 1; } else { $ac_level = $level_id + 0; }
	
		
				// this sets variables in the session 
				$_SESSION['uid'] = $id;
				$_SESSION['username'] = $username;
				$_SESSION['password'] = $password;
				$_SESSION['access_level'] = $access_level;    
				$_SESSION['dept_id'] = $dept_id;
				$_SESSION['level_id'] = $ac_level;//store student level in a session
				$_SESSION['last_login'] = $last_login;
				$ip = $_SERVER['REMOTE_ADDR'];
				$_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);
				
				$token = getToken(); //Generates 10 digits Alphanumeric token
				
		//update the timestamp and key for cookie
		$stamp = time();
		$ckey = GenKey();
	
		//update users table
		mysqli_query($link,"update default_users set level_id = '$ac_level', academic_statusid = '$max_id', `ctime`='$stamp', `ckey` = '$ckey', `last_login`= now(), `user_ip`= '$ip' where id = '$id'");
		
		//set a cookie 
	   			if(isset($_POST['remember'])){
				  setcookie("uid", $_SESSION['uid'], time()+60*60*24*COOKIE_TIME_OUT, "/");
				  setcookie("userkey", sha1($ckey), time()+60*60*24*COOKIE_TIME_OUT, "/");
				  setcookie("username", $_SESSION['username'], time()+60*60*24*COOKIE_TIME_OUT, "/");
				   }
		//if(empty($err)){
			
//redirect to students page
if($access_level == Students && $document_type == 0) { 
$_SESSION['user_home'] = web_root. 'students/?Account=PortalAccount&token='.$token.'&view=42020201&Authentication=true'; }

elseif($access_level == Students && $document_type == 1) { 
$_SESSION['user_home'] = web_root. 'record_verification/?Account=PortalAccount&token='.$token.'&view=42020301&Authentication=true'; }

elseif($access_level == Students && $document_type == 2) { 
$_SESSION['user_home'] = web_root. 'transcript_application/?Account=PortalAccount&token='.$token.'&view=42020301&Authentication=true'; }

//redirect to admins page					
elseif(($access_level == SuperAdmin) || ($access_level == Admins) || ($_SESSION['access_level'] == Bursar) || ($_SESSION['access_level'] == Records) || ($_SESSION['access_level'] == Liberians) || ($_SESSION['access_level'] == Lecturers)) { 
$_SESSION['user_home'] = web_root. 'admins/?Account=PortalAccount&token='.$token.'&view=42020201&Authentication=true'; }
				
				$return['msg'] = 'Login successful, please wait.';
				$return['access'] = $access_level;
				$return['dtype'] = $document_type;
				$return['token'] = $token;
						
		}
		else
		{
		//$msg = urlencode("Invalid Login. Please try again with correct user email and password. ");
		$return['error'] = true;
		$return['msg'] = "Use correct username and/or password";
		//header("Location: login.php?msg=$msg");
		}
	} else {
		$return['error'] = true;
		$return['msg'] = "No such user exists";
	  }	
}

//Scripts to reset password
if(isset($_POST['recover'])) {
	
//scripts to check if user's old password is valid or not
$result = mysqli_query($link,"SELECT email FROM default_users WHERE `email` = '$_POST[email_address]'"); 
$num = mysqli_num_rows($result);
// Match row found with more than 1 results  - the user is authenticated. 
if($num > 0) { list($email) = mysqli_fetch_row($result); }

///------------Do Validations-------------
if(empty($_POST['email_address'])) {
	$return['error'] = true;
	$return['msg'] = "ERROR! Email fields is required.";
	}
		
	// Validate Email
elseif(!isEmail($_POST['email_address'])) {
	$return['error'] = true;
	$return['msg'] = "OOPS! Please enter valid email address.";
	}

elseif($email == $_POST['email_address']) {
	 $return['error'] = false;
		$new_pwd = GenPwd; //System generated Password
		$pwd_reset = PwdHash($new_pwd); //convert generated password to MD5			
//set update sha1 of new password + salt
mysqli_query($link,"update default_users set password = '$pwd_reset' WHERE email = '$_POST[email_address]'");

$host  = $_SERVER['HTTP_HOST'];
$host_upper = strtoupper($host);						 
						 
//send email
$message =  
"Your password for this account has been changed. You don’t need to reply the mail, this message is simply a notification to protect the security of your account.\n

Below are your new login details ...\n

New Password: $new_pwd
Email: $_POST[email_address]\n

Please note: If your new password doesn’t work on your first try, please try it again later

For further help or support, please contact System administrator\n

You can always change your password by doing the following:\n

1. Sign in to School Management System (SMS) portal from any device \n
2. Click on 'Settings' link \n
3. Choose 'My Account' \n
4. Choose 'Change Password' \n\n

Thank You

Administrator
WWW.$host_upper
______________________________________________________
THIS IS AN AUTOMATED RESPONSE. 
***DO NOT RESPOND TO THIS EMAIL****
";

// boundary
$boundary = uniqid();

//Header for sender info 
$headers = "From: COEMinna <auto-reply@$host>\r\n"; 
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: multipart/mixed; boundary=\"".$boundary."\"\r\n";

// send email
	@mail($_POST['email_address'], "Password Reset", $message, $headers);						 
	
	$return['msg'] = "Done! New Password successfully generated.\n Check your mail '$_POST[email_address]' for details.";									
											
	}
	else {
		$return['error'] = true;
		$return['msg'] = "No such user exist with email '$_POST[email_address]'. Please, check and try again.";
	  }	
}

/******************* ACTIVATION BY FORM**************************/
if(isset($_POST['activate']))
{
//check if activ code and user is valid as precaution
$rs_check = mysqli_query($link,"select * from default_users where email = '$_POST[email]' and activation_code = '$_POST[acode]'"); 
$num = mysqli_num_rows($rs_check);
  // Match row found with more than 1 results  - the user is authenticated. 
    if($num <= 0) { 
	$return['error'] = true;
	$return['msg'] = "ERROR! Invalid email and/or activation code. Kindly check your mailbox for activation code or Contact system administrator for details.";
	}
	
//set active field to 1 to activate the user
elseif($num >= 1) {
	$return['error'] = false;
	mysqli_query($link,"update default_users set status = '1' where email = '$_POST[email]' and activation_code = '$_POST[acode]'");
	
$return['msg'] = "Congratulations! Your account has been activated. Kindly click on 'Back' button to login.";
	}
}

echo json_encode($return);

Batal

⬅ Naik ke sms.coeminna.edu.ng 1 item

Nama	Tipe	Ukuran	Diubah	Aksi
🐘process_login.php	php	7.8 KB	2024-08-07 10:17	✏️ Edit 👁️ View