MyBB Community Forums

so i made a strategy page for the game i play i and want to "lock" it so only members that registed at forums can access
so this the code i had

Quote:<?php

session_start();

require_once 'db.php';

$page_mode = isset($_POST['page_mode']) ? $_POST['page_mode'] : '';

$error_string = '';

if ($page_mode == 'login')
{
$username = $_POST['username'];
$password = $_POST['password'];
$salt = $_POST['salt'];

if (trim($username) == '' || trim($password) == '')
$error_string .= 'Please enter your username and password.<br>';
else
{
$result = db_query("SELECT username,password,salt FROM mybb_users WHERE username='" . mysql_real_escape_string($username) . "'");
if (!($row = mysql_fetch_assoc($result)))
$error_string .= 'The username was not found.<br>';
elseif ($row['password'] != md5(md5($row['salt']).$password))

$error_string .= 'The password did not match.<br>';
else
{
$_SESSION['user_id'] = $row['id'];
$_SESSION['username'] = $row['username'];
$_SESSION['password'] = $row['password'];
$_SESSION['salt'] = $row['salt'];
header('Location: index.php');
exit();
}
}
}

?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Register</title>
<style type="text/css">
.error_text {
color: #FF0000;
width: 400px;
text-align: center;
}
.left_box {
float: left;
width: 150px;
text-align: right;
padding-right: 5px;
}
.right_box {
clear: right;
}
</style>
</head>
<body>
<div class="error_text"><?php echo $error_string; ?></div>

<form action="login.php" method="post">
<input type="hidden" name="page_mode" value="login">

<div class="left_box">Username</div>
<div class="right_box"><input type="text" name="username" size="30" maxlength="255" value="<?php if (isset($username)) echo $username; ?>"></div>

<div class="left_box">Password</div>
<div class="right_box"><input type="password" name="password" size="30"></div>

<div class="left_box"> </div>
<div class="right_box"><input type="submit" value="Log In" size="30"></div>

</form>
<?php
echo "From database: " . $row['password'] . "<br />";
echo "From database-salt: " . $row['salt'] . "<br />";
echo "Input: " . md5($password);?>
</body>
</html>

Add an if( $mybb->user[uid] == "0") somewhere.

You SHOULD be including the global.php in the file too...it would save you some code.

somewhere is....where ??

ksclans Wrote:somewhere is....where ??

You can try at the top of your file, after <?php

<?php
require './global.php'; // assuming your file is in the same directory as the forum

//... the rest of your code...

If your file is not in the same folder, you'll need to use

<?php
chdir('forum/'); // the path to your forum directory.
require './global.php'; // doesn't change

//... the rest of your code...

Direct initialization of this file is not allowed.

Please make sure IN_MYBB is defined.

so how to define ?

define("IN_MYBB", 1);

ok , so idk what that do but now i can't login ... the input is different from database, but i already turn it to md5 code see
<?php

session_start();

require_once 'db.php';

chdir('../forums/');
define("IN_MYBB", 1);
require '../forums/global.php';

$page_mode = isset($_POST['page_mode']) ? $_POST['page_mode'] : '';

$error_string = '';

if ($page_mode == 'login')
{
$username = $_POST['username'];
$password = $_POST['password'];
$salt = $_POST['salt'];

if (trim($username) == '' || trim($password) == '')
$error_string .= 'Please enter your username and password.<br>';
else
{
$result = db_query("SELECT username,password,salt FROM mybb_users WHERE username='" . mysql_real_escape_string($username) . "'");
if (!($row = mysql_fetch_assoc($result)))
$error_string .= 'The username was not found.<br>';

elseif ($row['password'] != md5(md5($row['salt']).$password))

$error_string .= 'The password did not match.<br>';
else
{
$_SESSION['user_id'] = $row['id'];
$_SESSION['username'] = $row['username'];
$_SESSION['password'] = $row['password'];
$_SESSION['salt'] = $row['salt'];
header('Location: index.php');
exit();
}
}
}

?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Register</title>
<style type="text/css">
.error_text {
color: #FF0000;
width: 400px;
text-align: center;
}
.left_box {
float: left;
width: 150px;
text-align: right;
padding-right: 5px;
}
.right_box {
clear: right;
}
</style>
</head>
<body>
<div class="error_text"><?php echo $error_string; ?></div>

<form action="login.php" method="post">
<input type="hidden" name="page_mode" value="login">

<div class="left_box">Username</div>
<div class="right_box"><input type="text" name="username" size="30" maxlength="255" value="<?php if (isset($username)) echo $username; ?>"></div>

<div class="left_box">Password</div>
<div class="right_box"><input type="password" name="password" size="30"></div>

<div class="left_box"> </div>
<div class="right_box"><input type="submit" value="Log In" size="30"></div>

</form>
<?php
echo "From database: " . $row['password'] . "<br />";
echo "From database-salt: " . $row['salt'] . "<br />";
echo "Input: " .md5($password);?>
</body>
</html>

You don't really need all that if you have included MyBB's global, you can use the Cookie you already have to work out if someone is logged in.

This is just an example. You will need to modify it.

// Check to see if a user is logged in
if($mybb->user['username'] == "")
{
	echo('Welcome Guest.<br /><br />');
			
	// Show log in form.
	echo('<div class="subheading">Login</div>');
	echo("<div class=\"general\">
	<form action=\"{$conf_forumurl}/member.php\" method=\"post\">
	Username:<br /><input type=\"text\" name=\"username\" size=\"15\" maxlength=\"30\" /><br />
	Password:<br /><input type=\"password\" name=\"password\" size=\"15\" />
	<input type=\"hidden\" name=\"action\" value=\"do_login\" />
	<input type=\"hidden\" name=\"url\" value=\"YOUR_RETURN_URL\" />
	<br /><input type=\"submit\" class=\"submit\" name=\"submit\" value=\"Login\" /></form></div><br />");
			
	echo("<div class=\"subheading\">Actions</div>
	<ul>
	<li><a href=\"{$conf_forumurl}/member.php?action=register\">Register</a></li>
	</ul>");
}
else
{
	echo("Welcome {$mybb->user['username']}<br /><br />");
}

umm i want to ask like y you don;t need to make the input passowrd into md5 then match it with database ? and how do i like if login then show rest of the page... do i echo "html code..." like that?

Because the login is handled then by MyBB itself, it will sanitise all input so you don't have to.

Yeah, to show something if they are logged in you will probably have to echo the HTML.

ksclans

User 2877

ksclans

Dennis Tsang

ksclans

MrD.

ksclans

MrD.

ksclans

MrD.