diff --git a/ajax.php b/ajax.php index 617e9b57..0acea550 100644 --- a/ajax.php +++ b/ajax.php @@ -3,7 +3,7 @@ * @Author: printempw * @Date: 2016-01-16 23:01:33 * @Last Modified by: printempw - * @Last Modified time: 2016-03-12 16:34:14 + * @Last Modified time: 2016-03-13 14:03:58 * * - login, register, logout * - upload, change, delete @@ -67,7 +67,7 @@ if ($action == "login") { // then reject the registration. if ($user->db->getNumRows('ip', $ip) < REGS_PER_IP) { // use once md5 to encrypt password - if ($user->register(md5($_POST['passwd']), $ip)) { + if ($user->register($_POST['passwd'], $ip)) { $json['errno'] = 0; $json['msg'] = "注册成功~"; } else { diff --git a/config.example.php b/config.example.php index c049ddc3..f7a5e6ac 100644 --- a/config.example.php +++ b/config.example.php @@ -14,19 +14,10 @@ define('DB_PORT', 3306); /* MySQL 主机 */ define('DB_HOST', 'localhost'); -/** - * 数据表前缀 - * - * 如果您有在同一数据库内安装多个 Blessing Skin Server 的需求, - * 或者需要与 Authme、Discuz 等程序对接时,请为每个皮肤站设置 - * 不同的数据表前缀。前缀名只能为数字、字母加下划线。 - */ -define('DB_PREFIX', 'bs_'); - /* 盐,用于 token 加密,修改为任意随机字符串 */ -define('SALT', '9tvsh55d*s'); +define('SALT', '9tvsE+1._%R4@VLaX(I|.U+h_d*s'); -/* 调试模式,开启后将会显示所有错误提示 */ +/* 调试模式,开启后将会显示所有用于错误提示 */ define('DEBUG_MODE', false); /* 同一 IP 最大可注册账户数 */ @@ -37,3 +28,20 @@ define('API_TYPE', 0); /* 站点名称,推荐英文(字体原因) */ define('SITE_TITLE', 'Blessing Skin Server'); + +/** + * 数据表前缀 + * + * 如果您有在同一数据库内安装多个 Blessing Skin Server 的需求, + * 或者需要与 Authme、Discuz 等程序对接时,请为每个皮肤站设置 + * 不同的数据表前缀。前缀名只能为数字、字母加下划线。 + */ +define('DB_PREFIX', ''); + +/** + * 数据对接适配器 + * + * 目前可进行数据对接的程序有 Authme、Crazylogin、Discuz + * 只可填写 `Authme`,`Crazy` 或者 `Discuz`,留空即为不进行数据对接 + */ +define('DATA_ADAPTER', ''); diff --git a/includes/AuthmeDatabase.class.php b/includes/AuthmeDatabase.class.php new file mode 100644 index 00000000..d6cb8363 --- /dev/null +++ b/includes/AuthmeDatabase.class.php @@ -0,0 +1,70 @@ +table_name." (username, password, ip) + VALUES ('$username', '$password', '$ip')"; + return $this->query($sql); + + } + + public function sync($username) { + $exist_in_bs_table = $this->checkRecordExist('username', $username); + $exist_in_authme_table = ($this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->num_rows) ? true : false; + + if ($exist_in_bs_table && !$exist_in_authme_table) { + $result = $this->select('username', $username); + $this->createRecord($username, $result['password'], $result['ip']); + return $this->sync($username); + } + + if (!$exist_in_bs_table && $exist_in_authme_table) { + $result = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array(); + $this->insert(array( + "uname" => $username, + "passwd" => $result['password'], + "ip" => $result['ip'] + )); + return $this->sync($username); + } + + if (!($exist_in_bs_table || $exist_in_authme_table)) + return false; + + if ($exist_in_bs_table && $exist_in_authme_table) { + $passwd1 = $this->select('username', $username)['password']; + $passwd2 = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array()['password']; + if ($passwd1 == $passwd2) { + return true; + } else { + // sync password + $this->update($username, 'password', $passwd2); + return $this->sync($username); + } + } + + } +} diff --git a/includes/CrazyDatabase.class.php b/includes/CrazyDatabase.class.php new file mode 100644 index 00000000..59a98b31 --- /dev/null +++ b/includes/CrazyDatabase.class.php @@ -0,0 +1,74 @@ +table_name." (username, password, ips) + VALUES ('$username', '$password', '$ip')"; + return $this->query($sql); + + } + + public function sync($username) { + $exist_in_bs_table = $this->checkRecordExist('username', $username); + $exist_in_crazy_table = ($this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->num_rows) ? true : false; + + if ($exist_in_bs_table && !$exist_in_crazy_table) { + $result = $this->select('username', $username); + $this->createRecord($username, $result['password'], $result['ip']); + return $this->sync($username); + } + + if (!$exist_in_bs_table && $exist_in_crazy_table) { + $result = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array(); + $this->insert(array( + "uname" => $username, + "passwd" => $result['password'], + "ip" => $result['ips'] + )); + return $this->sync($username); + } + + if (!($exist_in_bs_table || $exist_in_crazy_table)) + return false; + + if ($exist_in_bs_table && $exist_in_crazy_table) { + $passwd1 = $this->select('username', $username)['password']; + $passwd2 = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array()['password']; + if ($passwd1 == $passwd2) { + return true; + } else { + // sync password + $this->update($username, 'password', $passwd2); + return $this->sync($username); + } + } + + } + +} diff --git a/includes/Database.class.php b/includes/Database.class.php index 032b6ed4..8f81f632 100644 --- a/includes/Database.class.php +++ b/includes/Database.class.php @@ -3,10 +3,10 @@ * @Author: printempw * @Date: 2016-02-02 21:59:06 * @Last Modified by: printempw - * @Last Modified time: 2016-03-13 11:27:11 + * @Last Modified time: 2016-03-13 14:21:10 */ -class Database +class Database implements EncryptInterface, SyncInterface { private $connection = null; @@ -85,4 +85,13 @@ class Database return $this->query("DELETE FROM ".DB_PREFIX."users WHERE username='$uname'"); } + public function encryptPassword($raw_passwd, $username="") { + $encrypt = md5($raw_passwd); + return $encrypt; + } + + public function sync($username) { + return ($this->checkRecordExist('username', $username)) ? true : false; + } + } diff --git a/includes/DiscuzDatabase.class.php b/includes/DiscuzDatabase.class.php new file mode 100644 index 00000000..da00313f --- /dev/null +++ b/includes/DiscuzDatabase.class.php @@ -0,0 +1,68 @@ +query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array()['salt']; + $encrypt = md5(md5($raw_passwd).$salt); + return $encrypt; + } + + public function createRecord($username, $password, $ip) { + $sql = "INSERT INTO ".$this->table_name." (username, password, regip) + VALUES ('$username', '$password', '$ip')"; + return $this->query($sql); + } + + public function sync($username) { + $exist_in_bs_table = $this->checkRecordExist('username', $username); + $exist_in_discuz_table = ($this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->num_rows) ? true : false; + + if ($exist_in_bs_table && !$exist_in_discuz_table) { + $result = $this->select('username', $username); + $this->createRecord($username, $result['password'], $result['ip']); + return $this->sync($username); + } + + if (!$exist_in_bs_table && $exist_in_discuz_table) { + $result = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array(); + $this->insert(array( + "uname" => $username, + "passwd" => $result['password'], + "ip" => $result['regip'] + )); + return $this->sync($username); + } + + if (!($exist_in_bs_table || $exist_in_discuz_table)) + return false; + + if ($exist_in_bs_table && $exist_in_discuz_table) { + $passwd1 = $this->select('username', $username)['password']; + $passwd2 = $this->query("SELECT * FROM ".$this->table_name." + WHERE username='$username'")->fetch_array()['password']; + if ($passwd1 == $passwd2) { + return true; + } else { + // sync password + $this->update($username, 'password', $passwd2); + return $this->sync($username); + } + } + + } +} diff --git a/includes/EncryptInterface.class.php b/includes/EncryptInterface.class.php new file mode 100644 index 00000000..b0c26bf4 --- /dev/null +++ b/includes/EncryptInterface.class.php @@ -0,0 +1,20 @@ +uname = Utils::convertString($uname); - $this->db = new Database(); - if ($this->db->checkRecordExist('username', $this->uname)) { + $class_name = DATA_ADAPTER."Database"; + $this->db = new $class_name(); + + if ($this->db->sync($this->uname)) { $this->passwd = $this->db->select('username', $this->uname)['password']; - $this->token = md5($this->uname . $this->passwd.SALT); + $this->token = md5($this->uname . $this->passwd . SALT); $this->is_registered = true; if ($this->db->select('username', $this->uname)['uid'] == 1) { $this->is_admin = true; @@ -30,7 +32,7 @@ class User } public function checkPasswd($raw_passwd) { - if (md5($raw_passwd) == $this->passwd) { + if ($this->db->encryptPassword($raw_passwd, $this->uname) == $this->passwd) { return true; } else { return false; @@ -61,7 +63,7 @@ class User public function register($passwd, $ip) { return $this->db->insert(array( "uname" => $this->uname, - "passwd" => $passwd, + "passwd" => $this->db->encryptPassword($passwd), "ip" => $ip )); }