DISCUZ Automatic Login function analysis

Here Discuz X2.5 For example, X3 and X2.5 almost the same when the automatic logon operation, the system did what to do contact Author: addon.discuz.com/?@12744.developer Do business website: www.dianzana.com

Check automatic login to view the page code as follows:

<form method= "POST" autocomplete= "Off" id= "Lsform" action= "member.php?mod=logging&action=login& Loginsubmit=yes&infloat=yes&lssubmit=yes "onsubmit=" return Lssubmit (); " > <div class= "FASTLG cl" > <span id= "Return_ls" style= "Display:none" ></span> <div class= "y PNs" &
Gt <table cellspacing= "0" cellpadding= "0" > <tbody><tr> <td> <span class= "Ftid" > <select Name= "Fastloginfield" id= "Ls_fastloginfield" width= "All" tabindex= "" "selecti=" 0 "style=" display:none; " > <option value= "username" ></option></select><a href= "javascript:; id=" Ls_fastloginfield_ Ctrl "Style=" width:40px "tabindex=" "> User name </a> </span> <script type=" Text/javascript "> Simulateselect (' Ls_fastloginfield ') </script> </td> <td><input type= "text" name= "username" id= " Ls_username "autocomplete=" Off "class=" px vm "tabindex=" 901 "></td> <td class=" fastlg_l "><label for= "Ls_cookietimE "><input type=" checkbox "Name=" Cookietime "id=" Ls_cookietime "class=" PC "value=" 2592000 "tabindex=" 903 "> Auto login </label></td> <td> <a href= "javascript:;" onclick= "ShowWindow (' login ', ' member.php? Mod=logging&action=login&viewlostpw=1 ') > Retrieve password </a></td> </tr> <tr> <td> <label for= "Ls_password" class= "z psw_w" > Password </label></td> <td><input type= "password" name= "Password" id= "Ls_password" class= "px vm" autocomplete= "Off" tabindex= "902" ></td> <td class= "fastlg_l" ><button type= "Submit" class= "PN vm" tabindex= "904" style= "width:75px;" ><em> login </em></button></td> <td> <a href= "Member.php?mod=register" class= "Xi2 xw1" > Register now </a></td> </tr> </tbody></table> <input type= "hidden" name= " Quickforward "value=" yes "> <input type=" hidden "name=" Handlekey "value=" ls "> </div> </div> </ Form>

It is clear that the address of the visit is: Member.php?mod=logging&action=login&loginsubmit=yes&infloat=yes&lssubmit=yes, Name= "Cookietime" For automatic logon check box

Locate the file according to the access path:

x25/member.php

x25/source/module/member/member_logging.php where new Logging_ctl () found

X25/source/class/class_member.php Below is the On_login () method

function On_login () {Global $_g;
			if ($_g[' uid ')) {$referer = Dreferer (); $ucsynlogin = $this->setting[' Allowsynlogin ')?
			Uc_user_synlogin ($_g[' uid '): '; $param = Array (' username ' = $_g[' member '] [' username '], ' usergroup ' = $_g[' group ' [' GroupTitle '], ' uid ' = $_g [' member ']
			[' UID ']); ShowMessage (' Login_succeed ', $referer? $referer: './', $param, Array (' showdialog ' = 1, ' locationtime ' = = True, ' E
		Xtrajs ' = $ucsynlogin)); } $from _connect = $this->setting[' Connect ' [' Allow '] &&!empty ($_get[' from ')?
		1:0; $seccodecheck = $from _connect?
		False: $this->setting[' Seccodestatus ') & 2; $seccodestatus =!empty ($_get[' Lssubmit ')?
		False: $seccodecheck;

		$invite = Getinvite ();
			if (!submitcheck (' Loginsubmit ', 1, $seccodestatus)) {$auth = '; $username =!empty ($_g[' cookie ' [' loginuser '])?

			Dhtmlspecialchars ($_g[' cookie ' [' Loginuser ']): '; if (!empty ($_get[' auth ')) {list ($username, $password, $questioneXist) = explode ("\ t", Authcode ($_get[' auth '], ' DECODE '));
				$username = Dhtmlspecialchars ($username);
			$auth = Dhtmlspecialchars ($_get[' auth '); } $cookietimecheck =!empty ($_g[' cookie ' [' cookietime ']) | | !empty ($_get[' cookietime ')?

			' checked= ' checked "': ';
			if ($seccodecheck) {$seccode = random (6, 1) + $seccode {0} * 1000000;
			} if ($this->extrafile && file_exists ($this->extrafile)) {require_once $this->extrafile;
			} $navtitle = lang (' Core ', ' title_login ');

		Include template ($this->template); } else {if (!empty ($_get[' auth ')) {list ($_get[' username '], $_get[' password ')) = Daddslashes (Explode ("\ t", Authco
			De ($_get[' auth '), ' DECODE ')); } if (! (
			$_g[' member_loginperm '] = Logincheck ($_get[' username '))) {showmessage (' login_strike ');
			} if ($_get[' Fastloginfield ') {$_get[' Loginfield '] = $_get[' Fastloginfield '];
			} $_g[' uid '] = $_g[' member ' [' uid '] = 0; $_g[' username ' = $_g[' member ' [' UsernamE '] = $_g[' member ' [' password '] = '; if (!$_get[' password ') | | $_get[' password ']! = addslashes ($_get[' password ')) {showmessage (' Profile_passwd_illegal '))
			; } $result = Userlogin ($_get[' username ', $_get[' password '], $_get[' QuestionID '), $_get[' answer '], $this->setting[' Autoidselect ']?
			' Auto ': $_get[' Loginfield '], $_g[' ClientIP ']);

			$uid = $result [' Ucresult '] [' uid ']; if (!empty ($_get[' lssubmit ')) && ($result [' Ucresult '] [' uid '] = =-3 | | $seccodecheck)) {$_get[' username '] = $re
				sult[' ucresult ' [' username '];
			$this->logging_more ($result [' Ucresult '] [' uid '] = =-3); if ($result [' status '] = =-1) {if (! $this->setting[' fastactivation ')} {$auth = Authcode ($result [' Ucresult ' [' username ']. " \ t ".
					Formhash, ' ENCODE '); ShowMessage (' location_activation ', ' member.php?mod= '. $this->setting[' regname ']. ' &action=activation&auth= '. Rawurlencode ($auth). '
			&referer= '. Rawurlencode (Dreferer ()), array (), Array (' location ' = true);	} else {$init _arr = explode (', ', $this->setting[' initcredits ']); $groupid = $this->setting[' regverify ')?

					8: $this->setting[' newusergroupid '; C::t (' Common_member ')->insert ($uid, $result [' Ucresult '] [' username '], MD5 (random), $result [' Ucresult '] ['
					Email '], $_g[' ClientIP '], $groupid, $init _arr);
					$result [' member '] = Getuserbyuid ($UID);
				$result [' status '] = 1;
					}} if ($result [' status '] > 0) {if ($this->extrafile && file_exists ($this->extrafile)) {
				Require_once $this->extrafile;
				} setloginstatus ($result [' member '], $_get[' cookietime ']? 2.592 million:0);

				Checkfollowfeed (); C::t (' Common_member_status ')->update ($_g[' uid '), Array (' lastip ' = $_g[' ClientIP '], ' lastvisit ' =
				TIMESTAMP, ' lastactivity ' = TIMESTAMP)); $ucsynlogin = $this->setting[' Allowsynlogin ')?

				Uc_user_synlogin ($_g[' uid '): '; if ($invite [' id ']) {$result = C::t (' common_invite ')->count_by_uid_fuid ($invite[' uid '], $uid); if (! $result) {c::t (' common_invite ')->update ($invite [' id '], array (' fuid ' = = $uid, ' fusername ' =>$_g['
						Username ']));
					Updatestat (' invite ');
					} else {$invite = array ();
					}} if ($invite [' uid ']) {require_once libfile (' function/friend ');
					Friend_make ($invite [' uid '], $invite [' username '], false);
					Dsetcookie (' Invite_auth ', ');
					if ($invite [' AppID ']) {updatestat (' appinvite '); }} $param = Array (' username ' = = $result [' Ucresult '] [' username '], ' usergroup ' = ' $_g[' group ' [' G Rouptitle '], ' uid ' = + $_g[' member ' [' UID '], ' groupid ' = ' $_g[' groupid '], ' syn ' = $ucsynlogin?

				1:0);

				$extra = Array (' ShowDialog ' = True, ' locationtime ' = = True, ' extrajs ' = ' = $ucsynlogin); $loginmessage = $_g[' groupid '] = = 8?

				' Login_succeed_inactive_member ': ' Login_succeed '; $location = $invite | | $_g[' groupid '] = = 8? ' Home.php?mod=space&do=home ': Dreferer (); if (Empty ($_get[' Handlekey ')) | |!empty ($_get[' Lssubmit ')) {if (Defined (' In_mobile ')) {showmessage (' location_l Ogin_succeed_mobile ', $location, Array (' username ' = = $result [' Ucresult '] [' username ']), array (' location ' = ' = True ')
					));
							} else {if (!empty ($_get[' Lssubmit ')) {if (! $ucsynlogin) {$extra [' location '] = true;
						} showmessage ($loginmessage, $location, $param, $extra);
							} else {$href = Str_replace ("'", "\ '", $location);
									ShowMessage (' Location_login_succeed ', $location, Array (), Array (' showid ' = ' succeedmessage ',
										' Extrajs ' = ' <script type= ' Text/javascript > '. ' SetTimeout ("Window.location.href =\". $href. '
										\ '; ', 3000); '. ' $ (\ ' succeedmessage_href\ '). href = \ '. $href. '
										\';'.
										' $ (\ ' main_message\ '). style.display = \ ' none\ '; '.
										' $ (\ ' main_succeed\ '). style.display = \ ' \ '; '. ' $ (\ ' succeedlocation\ '). Innerhtml = \ '. lang (' message ', $loginmessage, $param). '
						\ ';</script> '. $ucsynlogin, ' striptags ' = False, ' showdialog ' = true));
				}}}} else {showmessage ($loginmessage, $location, $param, $extra); }} else {$password = Preg_replace ("/^ (. {"). Round (strlen ($_get[' password ')/4). "}) (.+?) (. {". Round (strlen ($_get[' password")/6). "})
				$/s "," \\1***\\3 ", $_get[' password ']); $errorlog = Dhtmlspecialchars (TIMESTAMP. ")
					\ t ". ($result [' Ucresult '] [' username ']? $result [' Ucresult '] [' username ']: $_get[' username ']). "
					\ t ". $password. "
					\ t ". "Ques #". Intval ($_get[' QuestionID '). "
					\ t ".
				$_g[' ClientIP ');
				Writelog (' Illegallog ', $errorlog);
				loginfailed ($_get[' username '); $fmsg = $result [' Ucresult '] [' uid '] = = '-3 '? (Empty ($_get[' QuestionID ') | | $answer = = "?
				' Login_question_empty ': ' Login_question_invalid '): ' Login_invalid '; if ($_g[' member_loginperm ' > 1) {showmessage ($fmsg,", Array (' loginperm ' = $_g[' member_loginperm ')-1);
				} elseif ($_g[' member_loginperm ') = =-1) {showmessage (' login_password_invalid ');
				} else {showmessage (' login_strike '); }
			}

		}

	}

Obviously, the form was not submitted for execution:

if (!submitcheck (' Loginsubmit ', 1, $seccodestatus)) {

}

Here we are the login operation, so we just need to look at the Else section, the else part of which has the following code:

if ($result [' status '] > 0) {

	if ($this->extrafile && file_exists ($this->extrafile)) {
		require _once $this->extrafile;
	}

	Setloginstatus ($result [' member '], $_get[' cookietime ']? 2592000:0);
	Checkfollowfeed ();
..........
}

$result [' status ']>0, must be a successful login, now see function Setloginstatus ($result [' member '], $_get[' cookietime ']? 2.592 million:0);

This function file is found below source/function/function_member.php

function Setloginstatus ($member, $cookietime) {global $_g;
	$_g[' uid '] = intval ($member [' uid ']);
	$_g[' username '] = $member [' username '];
	$_g[' adminid '] = $member [' Adminid '];
	$_g[' groupid '] = $member [' GroupID '];
	$_g[' formhash '] = Formhash ();
	$_g[' Session ' [' invisible '] = getuserprofile (' invisible ');
	$_g[' member '] = $member;
	Loadcache (' Usergroup_ '. $_g[' GroupID ');
	C::app ()->session->isnew = true;

	C::app ()->session->updatesession ();
	Dsetcookie (' auth ', Authcode ("{$member [' password ']}\t{$member [' UID ']}", ' ENCODE '), $cookietime, 1, true);
	Dsetcookie (' Loginuser ');
	Dsetcookie (' Activationauth ');

	Dsetcookie (' Pmnum ');
	Include_once libfile (' Function/stat ');
	Updatestat (' login ', 1);
	if (defined (' In_mobile ')) {updatestat (' Mobilelogin ', 1);
	} if ($_g[' setting ' [' Connect '] [' Allow '] && $_g[' member ' [' Conisbind ']) {updatestat (' Connectlogin ', 1);
	} $rule = updatecreditbyaction (' daylogin ', $_g[' uid '); if (! $rule [' Updatecredit ']) {checkusergroup ($_g[' uid ')); }
}

Where code Dsetcookie (' Auth ', Authcode ("{$member [' password ']}\t{$member [' UID ']}", ' ENCODE '), $cookietime, 1, true); Save the Auth in a cookie, the cookie is valid for 2.592 million seconds, or 30 days

Open Chrome Local cookie after successful login

Today is April 23, 2014, you can see that there are 3 values in the cookie expiry time is May 23, 2014, has been circled red, may be related to our automatic login, where Zrcl_2132_auth should be the auth we just saved

The system is how to implement the next automatic login automatic login must be in the system initialization operation, after searching for these cookie names, we locate: x25/source/class/discuz/discuz_application.php This file is the system core file, executed at the entrance, and the following is the code in Method _init_input ():

if (Empty ($this->var[' cookie ' [' Saltkey '])) {
	$this->var[' cookie '] [' saltkey '] = random (8);
	Dsetcookie (' Saltkey ', $this->var[' cookie ' [' Saltkey '], 86400 *, 1, 1);
}
$this->var[' authkey ' = MD5 ($this->var[' config ' [' Security '] [' Authkey ']. $this->var[' cookie ' [' Saltkey '] );

Where $this->var is the global variable $_g, which is defined in the _init_env () method of this file:

$this->var = & $_g;

In fact, the above operation is to determine whether there is currently a cookie saltkey, no word randomly generated one, and then saved to the cookie and then MD5 encrypt the current $_config_security_authkey and Saltkey, save to $_g[' Authkey '] in the following we see what $_g[' Authkey ' is doing, see the Authcode () function in x25/source/function/function_core.php

function Authcode ($string, $operation = ' DECODE ', $key = ', $expiry = 0) {$ckey _length = 4;
	$key = MD5 ($key! = "? $key: Getglobal (' Authkey '));
	$keya = MD5 (substr ($key, 0, 16));
	$KEYB = MD5 (substr ($key, 16, 16)); $KEYC = $ckey _length?

	($operation = = ' DECODE '? substr ($string, 0, $ckey _length): substr (MD5 (Microtime ()),-$ckey _length)): ";
	$cryptkey = $keya. MD5 ($keya. $KEYC);

	$key _length = strlen ($cryptkey); $string = $operation = = = ' DECODE '? Base64_decode (substr ($string, $ckey _length)): sprintf ('%010d ', $expiry? $expiry + Time (): 0). substr (MD5 ($string. $keyb
	), 0, (+). $string;

	$string _length = strlen ($string);
	$result = ";

	$box = Range (0, 255);
	$rndkey = Array ();
	for ($i = 0; $i <= 255; $i + +) {$rndkey [$i] = Ord ($cryptkey [$i% $key _length]);
		} for ($j = $i = 0; $i <, $i + +) {$j = ($j + $box [$i] + $rndkey [$i])% 256;
		$tmp = $box [$i];
		$box [$i] = $box [$j];
	$box [$j] = $tmp; } for ($a = $j = $i = 0; $i < $string _length; $i + +) {$a = ($a +1)% 256;
		$j = ($j + $box [$a])% 256;
		$tmp = $box [$a];
		$box [$a] = $box [$j];
		$box [$j] = $tmp;
	$result. = Chr (ord ($string [$i]) ^ ($box [($box [$a] + $box [$j])% 256])); if ($operation = = ' DECODE ') {if (substr ($result, 0, ten) = = 0 | | substr ($result, 0, Ten)-time () > 0) && S
		Ubstr ($result, ten, +) = = substr (MD5 ($result, $keyb), 0, (+)) {return substr ($result, 26);
		} else {return ';
	}} else {return $KEYC. Str_replace (' = ', ' ', Base64_encode ($result)); }

}

Notice the $key = MD5 ($key! = "? $key: Getglobal (' Authkey ')); Originally Authkey is the default encryption key, it appears that the previous generated auth is related to the system configuration file $_config_security_authkey and random value saltkey, then if there is no saltkey, can not decrypt Auth, will not be able to implement automatic login.
Here's a look at the _init_user () method in discuz_application.php, which has the following code:

if ($auth = Getglobal (' auth ', ' cookie ')) {
	$auth = daddslashes (Explode ("\ t", Authcode ($auth, ' DECODE ')));
}
List ($discuz _pw, $discuz _uid) = Empty ($auth) | | Count ($auth) < 2? Array (', '): $auth;

if ($discuz _uid) {
	$user = Getuserbyuid ($discuz _uid, 1);
}

First get the auth in the current cookie, $auth = getglotal (' auth ', ' cookie '), if any, do the following:
$auth = daddslashes (Explode ("\ t", Authcode ($auth, ' DECODE ')));

Decrypt the Auth and then get the password and UID directly.
List ($discuz _pw, $discuz _uid) = Empty ($auth) | | Count ($auth) < 2? Array (', '): $auth;

This concludes .....