Flat File Login

[TKennedy]

I'm having trouble getting my login login to actually validate the user and log me in. I am able to open the text file that holds the users and passwords, but they never validate and I can't figure out why.

This is the code the calls the validation function:

/* Password login validation */
if ($authenticate == 0) {
	// this will happen if authentication is turned off
	$_SESSION['AUTH'] = 1;
	$_SESSION['USER'] = 'default';
}
else {

ini_set('session.use_cookies', FALSE);
ini_set('session.use_trans_sid', FALSE);
session_start();

if ($login) {

	$tmparray=VerifyPwd($user,$password);

	if($tmparray["AUTH"]==0) {
 		unset($_SESSION["USER"]);
		unset($_SESSION["HOME"]);
		unset($_SESSION["AUTH"]);

		// $msg = "Authentication Failed: Either your username or password are incorrect. Check your credentials and try again.";
		$msg = "Authentication Failed: $user or $password are invalid. Check your credentials and try again.";
			}
		else {
   			$_SESSION["AUTH"] = $tmparray["AUTH"];
			$_SESSION["USER"] = $tmparray["USER"];
			$_SESSION["HOME"] = $tmparray["HOME"];
			$_SESSION["TIME"] = time();

   			$navbar .= "<font face=verdana size=1> | <a href=\"$PHP_SELF\" name=\"logoff\">Logout</a></font>";
		}
}
}

This is the actual login function:

function VerifyPwd($user,$password) {
   global $data_file;

   $found=false;
   $ret = array();
   $pwdcrypted=md5($password);

   if (($fileopen = file($data_file)) == false) {

   echo "File Open Error: Unable to read file $data_file";
   }

   while (list($linenum, $line) = each($fileopen) && !$found) {
      $line=trim($line);
  	  if(!preg_match("{^#}",$line) && $line!="") {
  	  	  $array=explode("|",$line);		  

	  if($array[0]==$user && $array[1]==$pwdcrypted) {
	  	  $ret["AUTH"]=1;
		  $ret["USER"]=$user;
		  $ret["HOME"]=$array[2];
		  $found=true;
		}
	}
}
if(!$found)	{
	$ret["AUTH"]=0;
	$ret["USER"]="";
	$ret["HOME"]="";
}
  return $ret;
}

[LordShryku]

Quick test showed that the while statement is confused with your !$found on the end. Parens would do you good...

while((list($linenum, $line) = each($fileopen)) && !$found) {

[TKennedy]

Hmm, tried the parens and it still doesn't validate. Any other ideas? 😕

[Weedpacket]

Well, you can get rid of the !$found condition.

foreach($fileopen as $linenum=>$line) {
	$line=trim($line);
	if(preg_match('{^#}', $line) || $line=='')
		break;

$array = explode("|",$line);          
if($array[0]==$user && $array[1]==$pwdcrypted) {
	$ret["AUTH"]=1;
	$ret["USER"]=$user;
	$ret["HOME"]=$array[2];
	$found=true;
	break;
}
}
if(!$found) {
	$ret["AUTH"]=0;
	$ret["USER"]="";
	$ret["HOME"]="";
}

Beyond that; have you looked at $array[0]/$user and $array[1]/$pwdcrypted
by eye to make sure they match when they should? Are you sure the session data
is being passed? Since you've turned use_cookies OFF and use_trans_sid OFF, how
are you passing the session ID back to the client? As far as I can tell, you're not.

[TKennedy]

Hey that got it!
Thanks for the help. I modified the above code a tiny bit, and I was able to get the login to work. You were right about the session data not being returned also. I turned use_trans_sid ON and voila! Thanks a lot for your help! here is the final version of the function.

function VerifyPwd($user,$password) {
   global $datafile,$user,$password;

   $found=false;
   $ret = array();
   $pwdcrypted=md5($password);

   if (($fileopen = file($datafile)) == false) {		  

	   echo "File Open Error: Unable to open $datafile";
   }
   foreach($fileopen as $linenum=>$line) { 
   	$line=trim($line); 
   	if(!preg_match('{^#}', $line) && $line !== '') {
   		$array = explode("|",$line);           

   		if(($array[0]==$user) && ($array[1]==$pwdcrypted)) { 
	        $ret["AUTH"]=1; 
   		    $ret["USER"]=$user; 
        	$ret["HOME"]=$array[2]; 
       		break; 
   		}
   		else {
	   		$ret["AUTH"]=0; 
    		$ret["USER"]=""; 
    		$ret["HOME"]="";
	   		}
		}		
	} 
		return $ret;
}