komisches im adminbereich

[luette]

<?
/*
Datei : session.lib.php
Änderungen in dieser Datei nur dann vornehmen wenn Sie wissen was Sie tun!
*/
@session_start();

// Variabeln definieren
if (!isset($_SESSION['login']))        $_SESSION['login']        = "";
if (!isset($_SESSION['ref']))        $_SESSION['ref']        = "0";
if (!isset($_SESSION['uid']))        $_SESSION['uid']        = "0";
if (!isset($_POST['userid']))        $_POST['userid']        = "";
if (!isset($_POST['passwort']))        $_POST['passwort']        = "";
if (!isset($_POST['checkid']))        $_POST['checkid']        = "";
if (!isset($_POST['autologin']))    $_POST['autologin']        = "";
if (!isset($_GET['logout']))        $_GET['logout']            = "";
if (!isset($_GET['ref']))            $_GET['ref']            = "0";

// Den Wartungsmodus prüfen
$pageconfig = mysql_fetch_array(db_query("SELECT * FROM ".$db_prefix."_seitenkonfig LIMIT 1"));
if ($pageconfig['wartung'] == 1 && $_SESSION['uid'] != $admin_id) {
    setCookie('uid','',time()-86400*30);
    setCookie('passwort','',time()-86400*30);
    setCookie('autologin','',time()-86400*30);
    $_SESSION['uid']        = "";
    $_SESSION['passwort']    = "";
    $_SESSION['login']        = "";
    header ("location: ".$domain."/wartung.php");
    die();
}

// Werber in die Session übertragen

// SecVMS change begin
if ($_SESSION['ref'] == "0") $_SESSION['ref'] = (int)$_GET['ref'];
// SecVMS change end

// Login
if ($_POST['checkid'] == 'Login' && $_POST['userid'] && $_POST['passwort']) {

    // SecVMS change begin
    $_POST['userid'] = (int)$_POST['userid'];
    // SecVMS change end

    $login_check = db_query("SELECT `uid`,`passwort`,`status`,`hinweis` FROM ".$db_prefix."_kontodaten WHERE uid=".$_POST['userid']." and passwort='".md5($_POST['passwort'])."' LIMIT 1");

    if (mysql_num_rows($login_check)) {
    $login_check = mysql_fetch_array($login_check);
        // Wenn User noch nicht freigeschaltet!
        if ($login_check['status'] == 0) {
        $_SESSION['uid']        = "";
        $_SESSION['passwort']    = "";
        $_SESSION['login']        = "";
        $_GET['content'] = '/error/kein_zutritt';
        }
        // Wenn beim User alles O.K. ist!
        if ($login_check['status'] == 1) {
            db_query("UPDATE ".$db_prefix."_kontodaten SET login_ip='".$ip."' , loginzeit='".time()."' WHERE uid=".$_POST['userid']." and passwort='".md5($_POST['passwort'])."'");
            $nick = mysql_fetch_array(db_query("SELECT * FROM ".$db_prefix."_userdaten WHERE uid =".$_POST['userid'].""));
            if ($_POST['autologin'] == 'true') {
            setCookie('uid',$login_check['uid'],time()+86400*30);
            setCookie('passwort',$login_check['passwort'],time()+86400*30);
            setCookie('autologin','true',time()+86400*30);
            setCookie('nickname',$nick['nickname'],time()+86400*30);
            }
            $_SESSION['uid']        = $login_check['uid'];
            $_SESSION['passwort']    = $login_check['passwort'];
            $_SESSION['nickname']   = $nick['nickname'];
            $_SESSION['login']        = "true";
            header ("location: ".$domain);
            die();
        }
        // Wenn User gesperrt wurde!
        if ($login_check['status'] == 2) {
        $_SESSION['uid']        = "";
        $_SESSION['passwort']    = "";
        $_SESSION['login']        = "";
        $_GET['content'] = '/error/user_gesperrt';
        }
    } else {
    $_GET['content'] = '/error/kein_zutritt';
    }

} else {
if ($_POST['checkid'] == 'Login') $_GET['content'] = '/error/kein_zutritt';
}

// Autologin
if ($_SESSION['login'] != 'true' && isset($_COOKIE['autologin']) && isset($_COOKIE['uid']) && isset($_COOKIE['passwort'])) {

    // SecVMS change begin
    $_COOKIE['uid'] = (int)$_COOKIE['uid'];
    $_COOKIE['passwort'] = addslashes ($_COOKIE['passwort']);
    // SecVMS change end

    $login_check = db_query("SELECT `uid`,`passwort`,`status`,`hinweis` FROM ".$db_prefix."_kontodaten WHERE uid=".$_COOKIE['uid']." and passwort='".$_COOKIE['passwort']."' LIMIT 1");
    if (mysql_num_rows($login_check)) {
    $login_check = mysql_fetch_array($login_check);
        if ($login_check['status'] == 1) {
        db_query("UPDATE ".$db_prefix."_kontodaten SET login_ip='".$ip."' , loginzeit='".time()."' WHERE uid=".$_COOKIE['uid']." and passwort='".$_COOKIE['passwort']."'");
        $nick = mysql_fetch_array(db_query("SELECT * FROM ".$db_prefix."_userdaten WHERE uid =".$_COOKIE['uid'].""));
        $_SESSION['uid']        = $login_check['uid'];
        $_SESSION['passwort']    = $login_check['passwort'];
        $_SESSION['login']        = "true";
        $_SESSION['nickname']    = $nick['nickname'];
        }
    }
}

// Logout
if ($_GET['logout'] == 'true') {
    setCookie('uid','',time()-86400*30);
    setCookie('passwort','',time()-86400*30);
    setCookie('autologin','',time()-86400*30);
    $_SESSION['uid']        = "";
    $_SESSION['passwort']    = "";
    $_SESSION['login']        = "";
    header ("location: ".$domain);
    die();
}



       // Wer ist online? Addon
       if (isset ($_SESSION['uid']) && isset ($_SESSION['passwort']) && !empty ($_SESSION['uid']) && !empty ($_SESSION['passwort']))
       {
          db_query ("UPDATE ".$db_prefix."_kontodaten SET last_active = ".time()." WHERE uid = ".$_SESSION['uid']." and passwort = '".$_SESSION['passwort']."'");
       }



?>