436
+ − 1
/*
+ − 2
* AJAX-based intelligent login interface
+ − 3
*/
+ − 4
+ − 5
/*
+ − 6
* FRONTEND
+ − 7
*/
+ − 8
+ − 9
/**
+ − 10
* Performs a logon as a regular member.
+ − 11
*/
+ − 12
582
+ − 13
window.ajaxLogonToMember = function()
436
+ − 14
{
+ − 15
// IE <6 pseudo-compatibility
+ − 16
if ( KILL_SWITCH )
+ − 17
return true;
+ − 18
if ( auth_level >= USER_LEVEL_MEMBER )
+ − 19
return true;
+ − 20
ajaxLoginInit(function(k)
+ − 21
{
+ − 22
window.location.reload();
+ − 23
}, USER_LEVEL_MEMBER);
+ − 24
}
+ − 25
+ − 26
/**
+ − 27
* Authenticates to the highest level the current user is allowed to go to.
+ − 28
*/
+ − 29
582
+ − 30
window.ajaxLogonToElev = function()
436
+ − 31
{
+ − 32
if ( auth_level == user_level )
+ − 33
return true;
+ − 34
+ − 35
ajaxLoginInit(function(k)
+ − 36
{
+ − 37
ENANO_SID = k;
+ − 38
var url = String(' ' + window.location).substr(1);
+ − 39
url = append_sid(url);
+ − 40
window.location = url;
+ − 41
}, user_level);
+ − 42
}
+ − 43
+ − 44
/*
+ − 45
* BACKEND
+ − 46
*/
+ − 47
+ − 48
/**
+ − 49
* Holding object for various AJAX authentication information.
+ − 50
* @var object
+ − 51
*/
+ − 52
+ − 53
var logindata = {};
+ − 54
+ − 55
/**
+ − 56
* Path to the image used to indicate loading progress
+ − 57
* @var string
+ − 58
*/
+ − 59
+ − 60
if ( !ajax_login_loadimg_path )
+ − 61
var ajax_login_loadimg_path = false;
+ − 62
+ − 63
if ( !ajax_login_successimg_path )
+ − 64
var ajax_login_successimg_path = false;
+ − 65
+ − 66
/**
+ − 67
* Status variables
+ − 68
* @var int
+ − 69
*/
+ − 70
+ − 71
var AJAX_STATUS_LOADING_KEY = 1;
+ − 72
var AJAX_STATUS_GENERATING_KEY = 2;
+ − 73
var AJAX_STATUS_LOGGING_IN = 3;
+ − 74
var AJAX_STATUS_SUCCESS = 4;
+ − 75
var AJAX_STATUS_DESTROY = 65535;
+ − 76
+ − 77
/**
+ − 78
* State constants
+ − 79
* @var int
+ − 80
*/
+ − 81
+ − 82
var AJAX_STATE_EARLY_INIT = 1;
+ − 83
var AJAX_STATE_LOADING_KEY = 2;
+ − 84
+ − 85
/**
+ − 86
* Performs the AJAX request to get an encryption key and from there spawns the login form.
+ − 87
* @param function The function that will be called once authentication completes successfully.
+ − 88
* @param int The security level to authenticate at - see http://docs.enanocms.org/Help:Appendix_B
+ − 89
*/
+ − 90
582
+ − 91
window.ajaxLoginInit = function(call_on_finish, user_level)
436
+ − 92
{
582
+ − 93
load_component('messagebox');
+ − 94
load_component('flyin');
+ − 95
load_component('SpryEffects');
+ − 96
load_component('l10n');
+ − 97
load_component('crypto');
+ − 98
436
+ − 99
logindata = {};
+ − 100
+ − 101
var title = ( user_level > USER_LEVEL_MEMBER ) ? $lang.get('user_login_ajax_prompt_title_elev') : $lang.get('user_login_ajax_prompt_title');
550
685e839d934e
Added ability to delete the draft revision; [SECURITY] fixed lack of permission check on draft save; renamed messagebox() constructor to MessageBox() (backward compat. maintained)
Dan
diff
changeset
+ − 102
logindata.mb_object = new MessageBox(MB_OKCANCEL | MB_ICONLOCK, title, '');
436
+ − 103
+ − 104
logindata.mb_object.onclick['Cancel'] = function()
+ − 105
{
+ − 106
// Hide the error message and captcha
+ − 107
if ( document.getElementById('ajax_login_error_box') )
+ − 108
{
+ − 109
document.getElementById('ajax_login_error_box').parentNode.removeChild(document.getElementById('ajax_login_error_box'));
+ − 110
}
+ − 111
if ( document.getElementById('autoCaptcha') )
+ − 112
{
+ − 113
var to = fly_out_top(document.getElementById('autoCaptcha'), false, true);
+ − 114
setTimeout(function() {
+ − 115
var d = document.getElementById('autoCaptcha');
+ − 116
d.parentNode.removeChild(d);
+ − 117
}, to);
+ − 118
}
471
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 119
// Ask the server to clean our key
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 120
ajaxLoginPerformRequest({
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 121
mode: 'clean_key',
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 122
key_aes: logindata.key_aes,
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 123
key_dh: logindata.key_dh
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 124
});
436
+ − 125
};
+ − 126
+ − 127
logindata.mb_object.onbeforeclick['OK'] = function()
+ − 128
{
+ − 129
ajaxLoginSubmitForm();
+ − 130
return true;
+ − 131
}
+ − 132
+ − 133
// Fetch the inner content area
+ − 134
logindata.mb_inner = document.getElementById('messageBox').getElementsByTagName('div')[0];
+ − 135
+ − 136
// Initialize state
+ − 137
logindata.showing_status = false;
+ − 138
logindata.user_level = user_level;
+ − 139
logindata.successfunc = call_on_finish;
+ − 140
+ − 141
// Build the "loading" window
+ − 142
ajaxLoginSetStatus(AJAX_STATUS_LOADING_KEY);
+ − 143
+ − 144
// Request the key
+ − 145
ajaxLoginPerformRequest({ mode: 'getkey' });
+ − 146
}
+ − 147
+ − 148
/**
532
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 149
* For compatibility only.
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 150
*/
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 151
582
+ − 152
window.ajaxLogonInit = function(call_on_finish, user_level)
532
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 153
{
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 154
return ajaxLoginInit(call_on_finish, user_level);
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 155
}
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 156
03429d7b1537
Finally fixed link coloring settings in Oxygen Bleu; added compatibility wrapper for people that "ajaxLogonInit" over "ajaxLoginInit"
Dan
diff
changeset
+ − 157
/**
436
+ − 158
* Sets the contents of the AJAX login window to the appropriate status message.
+ − 159
* @param int One of AJAX_STATUS_*
+ − 160
*/
+ − 161
582
+ − 162
window.ajaxLoginSetStatus = function(status)
436
+ − 163
{
+ − 164
if ( !logindata.mb_inner )
+ − 165
return false;
+ − 166
if ( logindata.showing_status )
+ − 167
{
+ − 168
var div = document.getElementById('ajax_login_status');
+ − 169
if ( div )
+ − 170
logindata.mb_inner.removeChild(div);
+ − 171
}
+ − 172
switch(status)
+ − 173
{
+ − 174
case AJAX_STATUS_LOADING_KEY:
+ − 175
+ − 176
// Create the status div
+ − 177
var div = document.createElement('div');
+ − 178
div.id = 'ajax_login_status';
+ − 179
div.style.marginTop = '10px';
+ − 180
div.style.textAlign = 'center';
+ − 181
+ − 182
// The circly ball ajaxy image + status message
+ − 183
var status_msg = $lang.get('user_login_ajax_fetching_key');
+ − 184
+ − 185
// Insert the status message
+ − 186
div.appendChild(document.createTextNode(status_msg));
+ − 187
+ − 188
// Append a br or two to space things properly
+ − 189
div.appendChild(document.createElement('br'));
+ − 190
div.appendChild(document.createElement('br'));
+ − 191
+ − 192
var img = document.createElement('img');
+ − 193
img.src = ( ajax_login_loadimg_path ) ? ajax_login_loadimg_path : scriptPath + '/images/loading-big.gif';
+ − 194
div.appendChild(img);
+ − 195
+ − 196
// Another coupla brs
+ − 197
div.appendChild(document.createElement('br'));
+ − 198
div.appendChild(document.createElement('br'));
+ − 199
+ − 200
// The link to the full login form
+ − 201
var small = document.createElement('small');
+ − 202
small.innerHTML = $lang.get('user_login_ajax_link_fullform', { link_full_form: makeUrlNS('Special', 'Login/' + title) });
+ − 203
div.appendChild(small);
+ − 204
+ − 205
// Insert the entire message into the login window
+ − 206
logindata.mb_inner.innerHTML = '';
+ − 207
logindata.mb_inner.appendChild(div);
+ − 208
+ − 209
break;
+ − 210
case AJAX_STATUS_GENERATING_KEY:
+ − 211
+ − 212
// Create the status div
+ − 213
var div = document.createElement('div');
+ − 214
div.id = 'ajax_login_status';
+ − 215
div.style.marginTop = '10px';
+ − 216
div.style.textAlign = 'center';
+ − 217
+ − 218
// The circly ball ajaxy image + status message
+ − 219
var status_msg = $lang.get('user_login_ajax_generating_key');
+ − 220
+ − 221
// Insert the status message
+ − 222
div.appendChild(document.createTextNode(status_msg));
+ − 223
+ − 224
// Append a br or two to space things properly
+ − 225
div.appendChild(document.createElement('br'));
+ − 226
div.appendChild(document.createElement('br'));
+ − 227
+ − 228
var img = document.createElement('img');
+ − 229
img.src = ( ajax_login_loadimg_path ) ? ajax_login_loadimg_path : scriptPath + '/images/loading-big.gif';
+ − 230
div.appendChild(img);
+ − 231
+ − 232
// Another coupla brs
+ − 233
div.appendChild(document.createElement('br'));
+ − 234
div.appendChild(document.createElement('br'));
+ − 235
+ − 236
// The link to the full login form
+ − 237
var small = document.createElement('small');
+ − 238
small.innerHTML = $lang.get('user_login_ajax_link_fullform_dh', { link_full_form: makeUrlNS('Special', 'Login/' + title) });
+ − 239
div.appendChild(small);
+ − 240
+ − 241
// Insert the entire message into the login window
+ − 242
logindata.mb_inner.innerHTML = '';
+ − 243
logindata.mb_inner.appendChild(div);
+ − 244
+ − 245
break;
+ − 246
case AJAX_STATUS_LOGGING_IN:
+ − 247
+ − 248
// Create the status div
+ − 249
var div = document.createElement('div');
+ − 250
div.id = 'ajax_login_status';
+ − 251
div.style.marginTop = '10px';
+ − 252
div.style.textAlign = 'center';
+ − 253
+ − 254
// The circly ball ajaxy image + status message
+ − 255
var status_msg = $lang.get('user_login_ajax_loggingin');
+ − 256
+ − 257
// Insert the status message
+ − 258
div.appendChild(document.createTextNode(status_msg));
+ − 259
+ − 260
// Append a br or two to space things properly
+ − 261
div.appendChild(document.createElement('br'));
+ − 262
div.appendChild(document.createElement('br'));
+ − 263
+ − 264
var img = document.createElement('img');
+ − 265
img.src = ( ajax_login_loadimg_path ) ? ajax_login_loadimg_path : scriptPath + '/images/loading-big.gif';
+ − 266
div.appendChild(img);
+ − 267
+ − 268
// Insert the entire message into the login window
+ − 269
logindata.mb_inner.innerHTML = '';
+ − 270
logindata.mb_inner.appendChild(div);
+ − 271
+ − 272
break;
+ − 273
case AJAX_STATUS_SUCCESS:
+ − 274
+ − 275
// Create the status div
+ − 276
var div = document.createElement('div');
+ − 277
div.id = 'ajax_login_status';
+ − 278
div.style.marginTop = '10px';
+ − 279
div.style.textAlign = 'center';
+ − 280
+ − 281
// The circly ball ajaxy image + status message
+ − 282
var status_msg = $lang.get('user_login_success_short');
+ − 283
+ − 284
// Insert the status message
+ − 285
div.appendChild(document.createTextNode(status_msg));
+ − 286
+ − 287
// Append a br or two to space things properly
+ − 288
div.appendChild(document.createElement('br'));
+ − 289
div.appendChild(document.createElement('br'));
+ − 290
+ − 291
var img = document.createElement('img');
+ − 292
img.src = ( ajax_login_successimg_path ) ? ajax_login_successimg_path : scriptPath + '/images/check.png';
+ − 293
div.appendChild(img);
+ − 294
+ − 295
// Insert the entire message into the login window
+ − 296
logindata.mb_inner.innerHTML = '';
+ − 297
logindata.mb_inner.appendChild(div);
+ − 298
+ − 299
case AJAX_STATUS_DESTROY:
+ − 300
case null:
+ − 301
case undefined:
+ − 302
logindata.showing_status = false;
+ − 303
return null;
+ − 304
break;
+ − 305
}
+ − 306
logindata.showing_status = true;
+ − 307
}
+ − 308
+ − 309
/**
+ − 310
* Performs an AJAX logon request to the server and calls ajaxLoginProcessResponse() on the result.
+ − 311
* @param object JSON packet to send
+ − 312
*/
+ − 313
582
+ − 314
window.ajaxLoginPerformRequest = function(json)
436
+ − 315
{
+ − 316
json = toJSONString(json);
+ − 317
json = ajaxEscape(json);
+ − 318
ajaxPost(makeUrlNS('Special', 'Login/action.json'), 'r=' + json, function()
+ − 319
{
+ − 320
if ( ajax.readyState == 4 && ajax.status == 200 )
+ − 321
{
+ − 322
// parse response
+ − 323
var response = String(ajax.responseText + '');
651
ce9d78d7251d
Improved JSON validation and error interface when validation fails; made rank manager support custom CSS
Dan
diff
changeset
+ − 324
if ( !check_json_response(response) )
436
+ − 325
{
+ − 326
handle_invalid_json(response);
+ − 327
return false;
+ − 328
}
+ − 329
response = parseJSON(response);
+ − 330
ajaxLoginProcessResponse(response);
+ − 331
}
+ − 332
}, true);
+ − 333
}
+ − 334
+ − 335
/**
+ − 336
* Processes a response from the login server
+ − 337
* @param object JSON response
+ − 338
*/
+ − 339
582
+ − 340
window.ajaxLoginProcessResponse = function(response)
436
+ − 341
{
+ − 342
// Did the server send a plaintext error?
+ − 343
if ( response.mode == 'error' )
+ − 344
{
+ − 345
logindata.mb_object.destroy();
478
+ − 346
var error_msg = $lang.get('user_' + ( response.error.toLowerCase() ));
550
685e839d934e
Added ability to delete the draft revision; [SECURITY] fixed lack of permission check on draft save; renamed messagebox() constructor to MessageBox() (backward compat. maintained)
Dan
diff
changeset
+ − 347
new MessageBox(MB_ICONSTOP | MB_OK, $lang.get('user_err_login_generic_title'), error_msg);
436
+ − 348
return false;
+ − 349
}
+ − 350
// Main mode switch
+ − 351
switch ( response.mode )
+ − 352
{
+ − 353
case 'build_box':
471
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 354
// Rid ourselves of any loading windows
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 355
ajaxLoginSetStatus(AJAX_STATUS_DESTROY);
436
+ − 356
// The server wants us to build the login form, all the information is there
+ − 357
ajaxLoginBuildForm(response);
+ − 358
break;
+ − 359
case 'login_success':
+ − 360
ajaxLoginSetStatus(AJAX_STATUS_SUCCESS);
+ − 361
logindata.successfunc(response.key);
+ − 362
break;
+ − 363
case 'login_failure':
471
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 364
// Rid ourselves of any loading windows
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 365
ajaxLoginSetStatus(AJAX_STATUS_DESTROY);
436
+ − 366
document.getElementById('messageBox').style.backgroundColor = '#C0C0C0';
+ − 367
var mb_parent = document.getElementById('messageBox').parentNode;
+ − 368
new Spry.Effect.Shake(mb_parent, {duration: 1500}).start();
+ − 369
setTimeout(function()
+ − 370
{
+ − 371
document.getElementById('messageBox').style.backgroundColor = '#FFF';
+ − 372
ajaxLoginBuildForm(response.respawn_info);
+ − 373
ajaxLoginShowFriendlyError(response);
+ − 374
}, 2500);
+ − 375
break;
472
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 376
case 'login_success_reset':
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 377
var conf = confirm($lang.get('user_login_ajax_msg_used_temp_pass'));
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 378
if ( conf )
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 379
{
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 380
var url = makeUrlNS('Special', 'PasswordReset/stage2/' + response.user_id + '/' + response.temp_password);
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 381
window.location = url;
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 382
}
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 383
else
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 384
{
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 385
// treat as a failure
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 386
ajaxLoginSetStatus(AJAX_STATUS_DESTROY);
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 387
document.getElementById('messageBox').style.backgroundColor = '#C0C0C0';
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 388
var mb_parent = document.getElementById('messageBox').parentNode;
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 389
new Spry.Effect.Shake(mb_parent, {duration: 1500}).start();
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 390
setTimeout(function()
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 391
{
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 392
document.getElementById('messageBox').style.backgroundColor = '#FFF';
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 393
ajaxLoginBuildForm(response.respawn_info);
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 394
// don't show an error here, just silently respawn
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 395
}, 2500);
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 396
}
bc4b58034f4d
Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Dan
diff
changeset
+ − 397
break;
471
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 398
case 'noop':
7906fb190fc1
Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Dan
diff
changeset
+ − 399
break;
436
+ − 400
}
+ − 401
}
+ − 402
+ − 403
/*
+ − 404
* RESPONSE HANDLERS
+ − 405
*/
+ − 406
+ − 407
/**
+ − 408
* Builds the login form.
+ − 409
* @param object Metadata to build off of
+ − 410
*/
+ − 411
582
+ − 412
window.ajaxLoginBuildForm = function(data)
436
+ − 413
{
+ − 414
// let's hope this effectively preloads the image...
+ − 415
var _ = document.createElement('img');
+ − 416
_.src = ( ajax_login_successimg_path ) ? ajax_login_successimg_path : scriptPath + '/images/check.png';
+ − 417
+ − 418
var div = document.createElement('div');
+ − 419
div.id = 'ajax_login_form';
+ − 420
+ − 421
var show_captcha = ( data.locked_out && data.lockout_info.lockout_policy == 'captcha' ) ? data.lockout_info.captcha : false;
+ − 422
+ − 423
// text displayed on re-auth
+ − 424
if ( logindata.user_level > USER_LEVEL_MEMBER )
+ − 425
{
+ − 426
div.innerHTML += $lang.get('user_login_ajax_prompt_body_elev') + '<br /><br />';
+ − 427
}
+ − 428
+ − 429
// Create the form
+ − 430
var form = document.createElement('form');
+ − 431
form.action = 'javascript:void(ajaxLoginSubmitForm());';
+ − 432
form.onsubmit = function()
+ − 433
{
+ − 434
ajaxLoginSubmitForm();
+ − 435
return false;
+ − 436
}
460
+ − 437
if ( IE )
+ − 438
{
+ − 439
form.style.marginTop = '-20px';
+ − 440
}
436
+ − 441
+ − 442
// Using tables to wrap form elements because it results in a
+ − 443
// more visually appealing form. Yes, tables suck. I don't really
+ − 444
// care - they make forms look good.
+ − 445
+ − 446
var table = document.createElement('table');
+ − 447
table.style.margin = '0 auto';
+ − 448
+ − 449
// Field - username
+ − 450
var tr1 = document.createElement('tr');
+ − 451
var td1_1 = document.createElement('td');
+ − 452
td1_1.appendChild(document.createTextNode($lang.get('user_login_field_username') + ':'));
+ − 453
tr1.appendChild(td1_1);
+ − 454
var td1_2 = document.createElement('td');
+ − 455
var f_username = document.createElement('input');
+ − 456
f_username.id = 'ajax_login_field_username';
+ − 457
f_username.name = 'ajax_login_field_username';
+ − 458
f_username.type = 'text';
+ − 459
f_username.size = '25';
+ − 460
if ( data.username )
+ − 461
f_username.value = data.username;
+ − 462
td1_2.appendChild(f_username);
+ − 463
tr1.appendChild(td1_2);
+ − 464
table.appendChild(tr1);
+ − 465
+ − 466
// Field - password
+ − 467
var tr2 = document.createElement('tr');
+ − 468
var td2_1 = document.createElement('td');
+ − 469
td2_1.appendChild(document.createTextNode($lang.get('user_login_field_password') + ':'));
+ − 470
tr2.appendChild(td2_1);
+ − 471
var td2_2 = document.createElement('td');
+ − 472
var f_password = document.createElement('input');
+ − 473
f_password.id = 'ajax_login_field_password';
+ − 474
f_password.name = 'ajax_login_field_username';
+ − 475
f_password.type = 'password';
+ − 476
f_password.size = '25';
+ − 477
if ( !show_captcha )
+ − 478
{
+ − 479
f_password.onkeyup = function(e)
+ − 480
{
461
+ − 481
if ( !e )
436
+ − 482
e = window.event;
461
+ − 483
if ( !e && IE )
436
+ − 484
return true;
+ − 485
if ( e.keyCode == 13 )
+ − 486
{
+ − 487
ajaxLoginSubmitForm();
+ − 488
}
+ − 489
}
+ − 490
}
+ − 491
td2_2.appendChild(f_password);
+ − 492
tr2.appendChild(td2_2);
+ − 493
table.appendChild(tr2);
+ − 494
+ − 495
// Field - captcha
+ − 496
if ( show_captcha )
+ − 497
{
+ − 498
var tr3 = document.createElement('tr');
+ − 499
var td3_1 = document.createElement('td');
+ − 500
td3_1.appendChild(document.createTextNode($lang.get('user_login_field_captcha') + ':'));
+ − 501
tr3.appendChild(td3_1);
+ − 502
var td3_2 = document.createElement('td');
+ − 503
var f_captcha = document.createElement('input');
+ − 504
f_captcha.id = 'ajax_login_field_captcha';
+ − 505
f_captcha.name = 'ajax_login_field_username';
+ − 506
f_captcha.type = 'text';
+ − 507
f_captcha.size = '25';
+ − 508
f_captcha.onkeyup = function(e)
+ − 509
{
+ − 510
if ( !e )
+ − 511
e = window.event;
+ − 512
if ( !e.keyCode )
+ − 513
return true;
+ − 514
if ( e.keyCode == 13 )
+ − 515
{
+ − 516
ajaxLoginSubmitForm();
+ − 517
}
+ − 518
}
+ − 519
td3_2.appendChild(f_captcha);
+ − 520
tr3.appendChild(td3_2);
+ − 521
table.appendChild(tr3);
+ − 522
}
+ − 523
+ − 524
// Done building the main part of the form
+ − 525
form.appendChild(table);
+ − 526
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 527
// Field: remember login
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 528
if ( logindata.user_level <= USER_LEVEL_MEMBER )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 529
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 530
var lbl_remember = document.createElement('label');
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 531
lbl_remember.style.fontSize = 'smaller';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 532
lbl_remember.style.display = 'block';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 533
lbl_remember.style.textAlign = 'center';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 534
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 535
// figure out what text to put in the "remember me" checkbox
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 536
// infinite session length?
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 537
if ( data.extended_time == 0 )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 538
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 539
// yes, infinite
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 540
var txt_remember = $lang.get('user_login_ajax_check_remember_infinite');
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 541
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 542
else
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 543
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 544
if ( data.extended_time % 7 == 0 )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 545
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 546
// number of days is a multiple of 7
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 547
// use weeks as our unit
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 548
var sess_time = data.extended_time / 7;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 549
var unit = 'week';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 550
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 551
else
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 552
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 553
// use days as our unit
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 554
var sess_time = data.extended_time;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 555
var unit = 'day';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 556
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 557
// more than one week or day?
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 558
if ( sess_time != 1 )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 559
unit += 's';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 560
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 561
// assemble the string
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 562
var txt_remember = $lang.get('user_login_ajax_check_remember', {
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 563
session_length: sess_time,
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 564
length_units: $lang.get('etc_unit_' + unit)
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 565
});
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 566
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 567
var check_remember = document.createElement('input');
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 568
check_remember.type = 'checkbox';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 569
// this onclick attribute changes the cookie whenever the checkbox or label is clicked
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 570
check_remember.setAttribute('onclick', 'var ck = ( this.checked ) ? "enable" : "disable"; createCookie("login_remember", ck, 3650);');
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 571
if ( readCookie('login_remember') != 'disable' )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 572
check_remember.setAttribute('checked', 'checked');
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 573
check_remember.id = 'ajax_login_field_remember';
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 574
lbl_remember.appendChild(check_remember);
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 575
lbl_remember.innerHTML += ' ' + txt_remember;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 576
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 577
form.appendChild(lbl_remember);
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 578
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 579
436
+ − 580
// Field: enable Diffie Hellman
509
175df10e0b56
Added a copy of Firebug Lite for debugging purposes. License is uncertain but being treated as MPL. (If is is not MPL then it is under something more permissive that permits relicensing anyway)
Dan
diff
changeset
+ − 581
if ( IE || is_iPhone )
460
+ − 582
{
+ − 583
var lbl_dh = document.createElement('span');
+ − 584
lbl_dh.style.fontSize = 'smaller';
+ − 585
lbl_dh.style.display = 'block';
+ − 586
lbl_dh.style.textAlign = 'center';
+ − 587
lbl_dh.innerHTML = $lang.get('user_login_ajax_check_dh_ie');
+ − 588
form.appendChild(lbl_dh);
+ − 589
}
+ − 590
else
+ − 591
{
+ − 592
var lbl_dh = document.createElement('label');
+ − 593
lbl_dh.style.fontSize = 'smaller';
+ − 594
lbl_dh.style.display = 'block';
+ − 595
lbl_dh.style.textAlign = 'center';
+ − 596
var check_dh = document.createElement('input');
+ − 597
check_dh.type = 'checkbox';
+ − 598
// this onclick attribute changes the cookie whenever the checkbox or label is clicked
+ − 599
check_dh.setAttribute('onclick', 'var ck = ( this.checked ) ? "enable" : "disable"; createCookie("diffiehellman_login", ck, 3650);');
+ − 600
if ( readCookie('diffiehellman_login') != 'disable' )
+ − 601
check_dh.setAttribute('checked', 'checked');
+ − 602
check_dh.id = 'ajax_login_field_dh';
+ − 603
lbl_dh.appendChild(check_dh);
+ − 604
lbl_dh.innerHTML += $lang.get('user_login_ajax_check_dh');
+ − 605
form.appendChild(lbl_dh);
+ − 606
}
436
+ − 607
460
+ − 608
if ( IE )
+ − 609
{
+ − 610
div.innerHTML += form.outerHTML;
+ − 611
}
+ − 612
else
+ − 613
{
+ − 614
div.appendChild(form);
+ − 615
}
436
+ − 616
+ − 617
// Diagnostic / help links
+ − 618
// (only displayed in login, not in re-auth)
+ − 619
if ( logindata.user_level == USER_LEVEL_MEMBER )
+ − 620
{
+ − 621
form.style.marginBottom = '10px';
+ − 622
var links = document.createElement('small');
+ − 623
links.style.display = 'block';
+ − 624
links.style.textAlign = 'center';
+ − 625
links.innerHTML = '';
+ − 626
if ( !show_captcha )
+ − 627
links.innerHTML += $lang.get('user_login_ajax_link_fullform', { link_full_form: makeUrlNS('Special', 'Login/' + title) }) + '<br />';
+ − 628
// Always shown
+ − 629
links.innerHTML += $lang.get('user_login_ajax_link_forgotpass', { forgotpass_link: makeUrlNS('Special', 'PasswordReset') }) + '<br />';
+ − 630
if ( !show_captcha )
+ − 631
links.innerHTML += $lang.get('user_login_createaccount_blurb', { reg_link: makeUrlNS('Special', 'Register') });
+ − 632
div.appendChild(links);
+ − 633
}
+ − 634
+ − 635
// Insert the entire form into the login window
+ − 636
logindata.mb_inner.innerHTML = '';
+ − 637
logindata.mb_inner.appendChild(div);
+ − 638
+ − 639
// Post operations: field focus
460
+ − 640
if ( IE )
+ − 641
{
+ − 642
setTimeout(
+ − 643
function()
+ − 644
{
+ − 645
if ( logindata.loggedin_username )
+ − 646
document.getElementById('ajax_login_field_password').focus();
+ − 647
else
+ − 648
document.getElementById('ajax_login_field_username').focus();
+ − 649
}, 200);
+ − 650
}
436
+ − 651
else
460
+ − 652
{
+ − 653
if ( data.username )
+ − 654
f_password.focus();
+ − 655
else
+ − 656
f_username.focus();
+ − 657
}
436
+ − 658
+ − 659
// Post operations: show captcha window
+ − 660
if ( show_captcha )
+ − 661
ajaxShowCaptcha(show_captcha);
+ − 662
+ − 663
// Post operations: stash encryption keys and All That Jazz(TM)
+ − 664
logindata.key_aes = data.aes_key;
+ − 665
logindata.key_dh = data.dh_public_key;
+ − 666
logindata.captcha_hash = show_captcha;
460
+ − 667
logindata.loggedin_username = data.username
436
+ − 668
+ − 669
// Are we locked out? If so simulate an error and disable the controls
+ − 670
if ( data.lockout_info.lockout_policy == 'lockout' && data.locked_out )
+ − 671
{
+ − 672
f_username.setAttribute('disabled', 'disabled');
+ − 673
f_password.setAttribute('disabled', 'disabled');
+ − 674
var fake_packet = {
+ − 675
error_code: 'locked_out',
+ − 676
respawn_info: data
+ − 677
};
+ − 678
ajaxLoginShowFriendlyError(fake_packet);
+ − 679
}
+ − 680
}
+ − 681
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 682
window.ajaxLoginSubmitForm = function(real, username, password, captcha, remember)
436
+ − 683
{
+ − 684
// Perform AES test to make sure it's all working
+ − 685
if ( !aes_self_test() )
+ − 686
{
+ − 687
alert('BUG: AES self-test failed');
+ − 688
login_cache.mb_object.destroy();
+ − 689
return false;
+ − 690
}
+ − 691
// Hide the error message and captcha
+ − 692
if ( document.getElementById('ajax_login_error_box') )
+ − 693
{
+ − 694
document.getElementById('ajax_login_error_box').parentNode.removeChild(document.getElementById('ajax_login_error_box'));
+ − 695
}
+ − 696
if ( document.getElementById('autoCaptcha') )
+ − 697
{
+ − 698
var to = fly_out_top(document.getElementById('autoCaptcha'), false, true);
+ − 699
setTimeout(function() {
+ − 700
var d = document.getElementById('autoCaptcha');
+ − 701
d.parentNode.removeChild(d);
+ − 702
}, to);
+ − 703
}
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 704
// "Remember session" switch
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 705
if ( typeof(remember) == 'boolean' )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 706
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 707
var remember_session = remember;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 708
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 709
else
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 710
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 711
if ( document.getElementById('ajax_login_field_remember') )
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 712
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 713
var remember_session = ( document.getElementById('ajax_login_field_remember').checked ) ? true : false;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 714
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 715
else
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 716
{
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 717
var remember_session = false;
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 718
}
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 719
}
436
+ − 720
// Encryption: preprocessor
+ − 721
if ( real )
+ − 722
{
+ − 723
var do_dh = true;
+ − 724
}
+ − 725
else if ( document.getElementById('ajax_login_field_dh') )
+ − 726
{
+ − 727
var do_dh = document.getElementById('ajax_login_field_dh').checked;
+ − 728
}
+ − 729
else
+ − 730
{
509
175df10e0b56
Added a copy of Firebug Lite for debugging purposes. License is uncertain but being treated as MPL. (If is is not MPL then it is under something more permissive that permits relicensing anyway)
Dan
diff
changeset
+ − 731
if ( IE || is_iPhone )
460
+ − 732
{
509
175df10e0b56
Added a copy of Firebug Lite for debugging purposes. License is uncertain but being treated as MPL. (If is is not MPL then it is under something more permissive that permits relicensing anyway)
Dan
diff
changeset
+ − 733
// IE/MobileSafari doesn't have this control, continue silently IF the rest
460
+ − 734
// of the login form is there
+ − 735
if ( !document.getElementById('ajax_login_field_username') )
+ − 736
{
+ − 737
return false;
+ − 738
}
+ − 739
}
+ − 740
else
+ − 741
{
+ − 742
// The user probably clicked ok when the form wasn't in there.
+ − 743
return false;
+ − 744
}
436
+ − 745
}
+ − 746
if ( !username )
+ − 747
{
+ − 748
var username = document.getElementById('ajax_login_field_username').value;
+ − 749
}
+ − 750
if ( !password )
+ − 751
{
+ − 752
var password = document.getElementById('ajax_login_field_password').value;
+ − 753
}
+ − 754
if ( !captcha && document.getElementById('ajax_login_field_captcha') )
+ − 755
{
+ − 756
var captcha = document.getElementById('ajax_login_field_captcha').value;
+ − 757
}
+ − 758
+ − 759
if ( do_dh )
+ − 760
{
+ − 761
ajaxLoginSetStatus(AJAX_STATUS_GENERATING_KEY);
+ − 762
if ( !real )
+ − 763
{
+ − 764
// Wait while the browser updates the login window
+ − 765
setTimeout(function()
+ − 766
{
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 767
ajaxLoginSubmitForm(true, username, password, captcha, remember_session);
436
+ − 768
}, 200);
+ − 769
return true;
+ − 770
}
+ − 771
// Perform Diffie Hellman stuff
+ − 772
var dh_priv = dh_gen_private();
+ − 773
var dh_pub = dh_gen_public(dh_priv);
+ − 774
var secret = dh_gen_shared_secret(dh_priv, logindata.key_dh);
+ − 775
// secret_hash is used to verify that the server guesses the correct secret
+ − 776
var secret_hash = hex_sha1(secret);
+ − 777
// crypt_key is the actual AES key
+ − 778
var crypt_key = (hex_sha256(secret)).substr(0, (keySizeInBits / 4));
+ − 779
}
+ − 780
else
+ − 781
{
+ − 782
var crypt_key = logindata.key_aes;
+ − 783
}
+ − 784
+ − 785
ajaxLoginSetStatus(AJAX_STATUS_LOGGING_IN);
+ − 786
+ − 787
// Encrypt the password and username
+ − 788
var userinfo = toJSONString({
+ − 789
username: username,
+ − 790
password: password
+ − 791
});
+ − 792
var crypt_key_ba = hexToByteArray(crypt_key);
+ − 793
userinfo = stringToByteArray(userinfo);
+ − 794
+ − 795
userinfo = rijndaelEncrypt(userinfo, crypt_key_ba, 'ECB');
+ − 796
userinfo = byteArrayToHex(userinfo);
+ − 797
// Encrypted username and password (serialized with JSON) are now in the userinfo string
+ − 798
+ − 799
// Collect other needed information
+ − 800
if ( logindata.captcha_hash )
+ − 801
{
+ − 802
var captcha_hash = logindata.captcha_hash;
+ − 803
var captcha_code = captcha;
+ − 804
}
+ − 805
else
+ − 806
{
+ − 807
var captcha_hash = false;
+ − 808
var captcha_code = false;
+ − 809
}
+ − 810
+ − 811
// Ship it across the 'net
+ − 812
if ( do_dh )
+ − 813
{
+ − 814
var json_packet = {
+ − 815
mode: 'login_dh',
+ − 816
userinfo: userinfo,
+ − 817
captcha_code: captcha_code,
+ − 818
captcha_hash: captcha_hash,
+ − 819
dh_public_key: logindata.key_dh,
+ − 820
dh_client_key: dh_pub,
+ − 821
dh_secret_hash: secret_hash,
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 822
level: logindata.user_level,
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 823
remember: remember_session
436
+ − 824
}
+ − 825
}
+ − 826
else
+ − 827
{
+ − 828
var json_packet = {
+ − 829
mode: 'login_aes',
+ − 830
userinfo: userinfo,
+ − 831
captcha_code: captcha_code,
+ − 832
captcha_hash: captcha_hash,
+ − 833
key_aes: hex_md5(crypt_key),
688
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 834
level: logindata.user_level,
f2a824ce5f18
Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Dan
diff
changeset
+ − 835
remember: remember_session
436
+ − 836
}
+ − 837
}
+ − 838
ajaxLoginPerformRequest(json_packet);
+ − 839
}
+ − 840
582
+ − 841
window.ajaxLoginShowFriendlyError = function(response)
436
+ − 842
{
+ − 843
if ( !response.respawn_info )
+ − 844
return false;
+ − 845
if ( !response.error_code )
+ − 846
return false;
+ − 847
var text = ajaxLoginGetErrorText(response);
+ − 848
if ( document.getElementById('ajax_login_error_box') )
+ − 849
{
+ − 850
// console.info('Reusing existing error-box');
+ − 851
document.getElementById('ajax_login_error_box').innerHTML = text;
+ − 852
return true;
+ − 853
}
+ − 854
+ − 855
// console.info('Drawing new error-box');
+ − 856
+ − 857
// calculate position for the top of the box
+ − 858
var mb_bottom = $('messageBoxButtons').Top() + $('messageBoxButtons').Height();
+ − 859
// if the box isn't done flying in yet, just estimate
+ − 860
if ( mb_bottom < ( getHeight() / 2 ) )
+ − 861
{
+ − 862
mb_bottom = ( getHeight() / 2 ) + 120;
+ − 863
}
+ − 864
var win_bottom = getHeight() + getScrollOffset();
+ − 865
var top = mb_bottom + ( ( win_bottom - mb_bottom ) / 2 ) - 32;
+ − 866
// left position = 0.2 * window_width, seeing as the box is 60% width this works hackishly but nice and quick
+ − 867
var left = getWidth() * 0.2;
+ − 868
+ − 869
// create the div
+ − 870
var errbox = document.createElement('div');
+ − 871
errbox.className = 'error-box-mini';
+ − 872
errbox.style.position = 'absolute';
+ − 873
errbox.style.width = '60%';
+ − 874
errbox.style.top = top + 'px';
+ − 875
errbox.style.left = left + 'px';
+ − 876
errbox.innerHTML = text;
+ − 877
errbox.id = 'ajax_login_error_box';
+ − 878
+ − 879
var body = document.getElementsByTagName('body')[0];
+ − 880
body.appendChild(errbox);
+ − 881
}
+ − 882
582
+ − 883
window.ajaxLoginGetErrorText = function(response)
436
+ − 884
{
+ − 885
switch ( response.error_code )
+ − 886
{
+ − 887
default:
+ − 888
return $lang.get('user_err_' + response.error_code);
+ − 889
break;
+ − 890
case 'locked_out':
+ − 891
if ( response.respawn_info.lockout_info.lockout_policy == 'lockout' )
+ − 892
{
+ − 893
return $lang.get('user_err_locked_out', {
+ − 894
lockout_threshold: response.respawn_info.lockout_info.lockout_threshold,
+ − 895
lockout_duration: response.respawn_info.lockout_info.lockout_duration,
+ − 896
time_rem: response.respawn_info.lockout_info.time_rem,
+ − 897
plural: ( response.respawn_info.lockout_info.time_rem == 1 ) ? '' : $lang.get('meta_plural'),
+ − 898
captcha_blurb: ''
+ − 899
});
+ − 900
break;
+ − 901
}
+ − 902
case 'invalid_credentials':
+ − 903
var base = $lang.get('user_err_invalid_credentials');
+ − 904
if ( response.respawn_info.locked_out )
+ − 905
{
+ − 906
base += ' ';
+ − 907
var captcha_blurb = '';
+ − 908
switch(response.respawn_info.lockout_info.lockout_policy)
+ − 909
{
+ − 910
case 'captcha':
+ − 911
captcha_blurb = $lang.get('user_err_locked_out_captcha_blurb');
+ − 912
break;
+ − 913
case 'lockout':
+ − 914
break;
+ − 915
default:
+ − 916
base += 'WTF? Shouldn\'t be locked out with lockout policy set to disable.';
+ − 917
break;
+ − 918
}
+ − 919
base += $lang.get('user_err_locked_out', {
+ − 920
captcha_blurb: captcha_blurb,
+ − 921
lockout_threshold: response.respawn_info.lockout_info.lockout_threshold,
+ − 922
lockout_duration: response.respawn_info.lockout_info.lockout_duration,
+ − 923
time_rem: response.respawn_info.lockout_info.time_rem,
+ − 924
plural: ( response.respawn_info.lockout_info.time_rem == 1 ) ? '' : $lang.get('meta_plural')
+ − 925
});
+ − 926
}
+ − 927
else if ( response.respawn_info.lockout_info.lockout_policy == 'lockout' || response.respawn_info.lockout_info.lockout_policy == 'captcha' )
+ − 928
{
+ − 929
// if we have a lockout policy of captcha or lockout, then warn the user
+ − 930
switch ( response.respawn_info.lockout_info.lockout_policy )
+ − 931
{
+ − 932
case 'captcha':
+ − 933
base += $lang.get('user_err_invalid_credentials_lockout', {
+ − 934
fails: response.respawn_info.lockout_info.lockout_fails,
+ − 935
lockout_threshold: response.respawn_info.lockout_info.lockout_threshold,
+ − 936
lockout_duration: response.respawn_info.lockout_info.lockout_duration
+ − 937
});
+ − 938
break;
+ − 939
case 'lockout':
+ − 940
break;
+ − 941
}
+ − 942
}
+ − 943
return base;
+ − 944
break;
+ − 945
}
+ − 946
}
+ − 947
585
+ − 948
window.ajaxShowCaptcha = function(code)
+ − 949
{
+ − 950
var mydiv = document.createElement('div');
+ − 951
mydiv.style.backgroundColor = '#FFFFFF';
+ − 952
mydiv.style.padding = '10px';
+ − 953
mydiv.style.position = 'absolute';
+ − 954
mydiv.style.top = '0px';
+ − 955
mydiv.id = 'autoCaptcha';
+ − 956
mydiv.style.zIndex = String( getHighestZ() + 1 );
+ − 957
var img = document.createElement('img');
+ − 958
img.onload = function()
+ − 959
{
+ − 960
if ( this.loaded )
+ − 961
return true;
+ − 962
var mydiv = document.getElementById('autoCaptcha');
+ − 963
var width = getWidth();
+ − 964
var divw = $dynano(mydiv).Width();
+ − 965
var left = ( width / 2 ) - ( divw / 2 );
+ − 966
mydiv.style.left = left + 'px';
+ − 967
fly_in_top(mydiv, false, true);
+ − 968
this.loaded = true;
+ − 969
};
+ − 970
img.src = makeUrlNS('Special', 'Captcha/' + code);
+ − 971
img.onclick = function() { this.src = this.src + '/a'; };
+ − 972
img.style.cursor = 'pointer';
+ − 973
mydiv.appendChild(img);
+ − 974
domObjChangeOpac(0, mydiv);
+ − 975
var body = document.getElementsByTagName('body')[0];
+ − 976
body.appendChild(mydiv);
+ − 977
}
+ − 978
582
+ − 979
window.ajaxInitLogout = function()
+ − 980
{
+ − 981
load_component('messagebox');
+ − 982
load_component('l10n');
+ − 983
var mb = new MessageBox(MB_YESNO|MB_ICONQUESTION, $lang.get('user_logout_confirm_title'), $lang.get('user_logout_confirm_body'));
+ − 984
mb.onclick['Yes'] = function()
+ − 985
{
+ − 986
window.location = makeUrlNS('Special', 'Logout/' + csrf_token + '/' + title);
+ − 987
}
+ − 988
}
+ − 989
+ − 990
window.mb_logout = function()
+ − 991
{
+ − 992
ajaxInitLogout();
+ − 993
}
+ − 994
+ − 995
window.ajaxStartLogin = function()
+ − 996
{
+ − 997
ajaxLogonToMember();
+ − 998
}
+ − 999
+ − 1000
window.ajaxStartAdminLogin = function()
+ − 1001
{
+ − 1002
// IE <6 pseudo-compatibility
+ − 1003
if ( KILL_SWITCH )
+ − 1004
return true;
+ − 1005
if ( auth_level < USER_LEVEL_ADMIN )
+ − 1006
{
+ − 1007
ajaxLoginInit(function(k) {
+ − 1008
ENANO_SID = k;
+ − 1009
auth_level = USER_LEVEL_ADMIN;
+ − 1010
var loc = makeUrlNS('Special', 'Administration');
+ − 1011
if ( (ENANO_SID + ' ').length > 1 )
+ − 1012
window.location = loc;
+ − 1013
}, USER_LEVEL_ADMIN);
+ − 1014
return false;
+ − 1015
}
+ − 1016
var loc = makeUrlNS('Special', 'Administration');
+ − 1017
window.location = loc;
+ − 1018
}
+ − 1019
+ − 1020
window.ajaxAdminPage = function()
+ − 1021
{
+ − 1022
// IE <6 pseudo-compatibility
+ − 1023
if ( KILL_SWITCH )
+ − 1024
return true;
+ − 1025
if ( auth_level < USER_LEVEL_ADMIN )
+ − 1026
{
+ − 1027
ajaxPromptAdminAuth(function(k) {
+ − 1028
ENANO_SID = k;
+ − 1029
auth_level = USER_LEVEL_ADMIN;
+ − 1030
var loc = String(window.location + '');
+ − 1031
window.location = append_sid(loc);
+ − 1032
var loc = makeUrlNS('Special', 'Administration', 'module=' + namespace_list['Admin'] + 'PageManager&source=ajax&page_id=' + ajaxEscape(title));
+ − 1033
if ( (ENANO_SID + ' ').length > 1 )
+ − 1034
window.location = loc;
+ − 1035
}, 9);
+ − 1036
return false;
+ − 1037
}
+ − 1038
var loc = makeUrlNS('Special', 'Administration', 'module=' + namespace_list['Admin'] + 'PageManager&source=ajax&page_id=' + ajaxEscape(title));
+ − 1039
window.location = loc;
+ − 1040
}
+ − 1041
+ − 1042
var navto_ns;
+ − 1043
var navto_pg;
+ − 1044
var navto_ul;
+ − 1045
+ − 1046
window.ajaxLoginNavTo = function(namespace, page_id, min_level)
+ − 1047
{
+ − 1048
// IE <6 pseudo-compatibility
+ − 1049
if ( KILL_SWITCH )
+ − 1050
return true;
+ − 1051
navto_pg = page_id;
+ − 1052
navto_ns = namespace;
+ − 1053
navto_ul = min_level;
+ − 1054
if ( auth_level < min_level )
+ − 1055
{
+ − 1056
ajaxPromptAdminAuth(function(k) {
+ − 1057
ENANO_SID = k;
+ − 1058
auth_level = navto_ul;
+ − 1059
var loc = makeUrlNS(navto_ns, navto_pg);
+ − 1060
if ( (ENANO_SID + ' ').length > 1 )
+ − 1061
window.location = loc;
+ − 1062
}, min_level);
+ − 1063
return false;
+ − 1064
}
+ − 1065
var loc = makeUrlNS(navto_ns, navto_pg);
+ − 1066
window.location = loc;
+ − 1067
}
+ − 1068
+ − 1069
window.ajaxAdminUser = function(username)
+ − 1070
{
+ − 1071
// IE <6 pseudo-compatibility
+ − 1072
if ( KILL_SWITCH )
+ − 1073
return true;
+ − 1074
if ( auth_level < USER_LEVEL_ADMIN )
+ − 1075
{
+ − 1076
ajaxPromptAdminAuth(function(k) {
+ − 1077
ENANO_SID = k;
+ − 1078
auth_level = USER_LEVEL_ADMIN;
+ − 1079
var loc = String(window.location + '');
+ − 1080
window.location = append_sid(loc);
+ − 1081
var loc = makeUrlNS('Special', 'Administration', 'module=' + namespace_list['Admin'] + 'UserManager&src=get&user=' + ajaxEscape(username));
+ − 1082
if ( (ENANO_SID + ' ').length > 1 )
+ − 1083
window.location = loc;
+ − 1084
}, 9);
+ − 1085
return false;
+ − 1086
}
+ − 1087
var loc = makeUrlNS('Special', 'Administration', 'module=' + namespace_list['Admin'] + 'UserManager&src=get&user=' + ajaxEscape(username));
+ − 1088
window.location = loc;
+ − 1089
}