I find Jfusion sufferes from random logouts and other oddities. I will be also looking into making a wordpress dual login after this as well.
So I didn't have much of a chance to work on this today, but have been able to do the following (I will break this out to a new thread soon).
So I altered the queries for Joomla and this is my login functions
- Set Cookie function
function mybb_setcookie($name, $value="", $expires="", $httponly=false)
{
$db = JFactory::getDBO();
$mybbcookiepath = $this->mybb_get_setting('cookiepath');
$mybbcookiedomain = $this->mybb_get_setting('cookiedomain');
$mybbcookieprefix = $this->mybb_get_setting('cookieprefix');
//echo "cookie: ".$mybbcookiepath;
//exit;
if($expires == -1)
{
$expires = 0;
}
elseif($expires == "" || $expires == null)
{
$expires = TIME() + (60*60*24*365); // Make the cookie expire in a years time
}
else
{
$expires = TIME() + intval($expires);
}
$mybbcookiepath = str_replace(array("\n","\r"), "", $mybbcookiepath);
$mybbcookiedomain = str_replace(array("\n","\r"), "", $mybbcookiedomain);
$mybbcookieprefix = str_replace(array("\n","\r", " "), "", $mybbcookieprefix);
// Versions of PHP prior to 5.2 do not support HttpOnly cookies and IE is buggy when specifying a blank domain so set the cookie manually
$cookie = "Set-Cookie: {$mybbcookieprefix}{$name}=".urlencode($value);
if($expires > 0)
{
$cookie .= "; expires=".@gmdate('D, d-M-Y H:i:s \\G\\M\\T', $expires);
}
if(!empty($mybbcookiepath))
{
$cookie .= "; path={$mybbcookiepath}";
}
if(!empty($mybbcookiedomain))
{
$cookie .= "; domain={$mybbcookiedomain}";
}
if($httponly == true)
{
$cookie .= "; HttpOnly";
}
$mybb->cookies[$name] = $value;
header($cookie, false);
}
login function
function mybb_log_me_in($name, $password) {
$db = JFactory::getDBO();
// !! Use w/ caution this logs a user in without a password
// auth is already done above
// You now have the MyBB username currently stored in $name
$query = "select uid,username,password,salt,loginkey,email,usergroup from mybb_users where username='".$name."' limit 1";
$db->setQuery($query);
$user = $db->loadRow();
if(md5(md5($user[3]).md5($password))== $user[2]) {
// The password matches the password in the database so lets log them in
$this->mybb_setcookie('loginattempts', 1, null);
$db->setQuery("Delete from mybb_sessions where ip='".$_SESSION['IPADDR']." AND sid !='".session_id()."'");
$result = $db->query();
$newsession = array(
"uid" => $user['uid'],
);
$db->setQuery("Update mybb_sessions set uid=".$user[0]." where sid='".session_id()."'");
$result = $db->query();
if(!$result) {
echo $db->getErrorMsg()."<br/>";
exit;
}
//$db->setQuery("Updaye mybb_users set uid=".$user['id']." where sid='".$session->sid."'");
//$result = $db->query();
//$db->update_query("users", array("loginattempts" => 1), "uid='{$user['uid']}'");
//Skipped above 3 lines, this just increases the login attemps by 1, however given we are succesful in our Joomla login we shouldn't need this
// Temporarily set the cookie remember option for the login cookies
//$mybb->user['remember'] = $user['remember'];
$this->mybb_setcookie("mybbuser", $user[0]."_".$user[4], null, true);
$this->mybb_setcookie("sid", session_id(), -1, true);
}
}
- small function to grab myBB settings by name
function mybb_get_setting($setting) {
$db = JFactory::getDBO();
$db->setQuery("select value from mybb_settings where name='".$setting."'", 'mybb_');
$result = $db->loadResult();
//echo "Query: select value from mybb_settings where name='".$setting."' result: ".$result[0]." <br>";
if(!$result) {
echo $db->getErrorMsg()."<br/>";
}
return $result;
}
As you can see I added a salt check, it really shouldn't be needed as if you are authenticated with Joomla you should be authenticated with mybb, however adding an extra security layer never really hurt anyone. (I forgot about Joomla not using named arrays in the loadRow() query eek.
Of course this all assumes the tables for myBB and Joomla are in the same database, and assumes that the table prefix for mybb is mybb_
None of this will work without calling the $this->mybb_log_me_in($credentials['username'], $credentials['password']);
Which I am doing inside the joomla.php auth script in the onAuthenticate area, you call it where the success messsage is and you should be good to go.
I need to write all of this into a proper user plugin for joomla with parameters for setting the table prefix and I need to fix the "remember me" stuff.
I will package it with a user function and a sync system if I get the chance that can be called on registration on Joomla side and also on changing passwords so that they are properly inserted on both sides, name change really shouldn't matter, if data is pushed from both tables it really is no big deal. I have already written this for my site and jFusion anyway.
After I am done with that I will write one for the myBB side so that the login system of myBB also logs you into Joomla and does all of the same actions as above. I believe that way for most people all bases will be covered for the user integration and login systems and we can break the need for jFusion.
After all that is complete I will adapt the scripts to wordpress and we should have a system that works for good user integration in both and we can expand them later to synch and manage profiles better.
Of course if the interest is not there I will keep them to myself
I couldn't have really gotten to this point without your code above, so for that I thank you.
Dan
Oh additionally once I have completed all this work, it should be pretty simple for anyone to adapt this to other systems and CMS, in fact I should be able to help with that, once I go through the learning curve.
The hardest part is getting the right cookies set correctly and handling the password to make sure they are all correctly hashed. However that should be relatively simple information to find out I would imagine. My coding style is not too formal but it is effective enough.
