ryzom/server/www/login/libs/validate_cookie.php

   1 <?php
   2 include_once(dirname(__DIR__).'/../config.php');
   3
   4 function convertCookieForActionHandler($cookie)
   5 {
   6         $ret = "";
   7         for ($i = 0; $i<strlen($cookie); ++$i)
   8         {
   9                 if ($cookie[$i] == '|')
  10                         $ret .= '_';
  11                 else
  12                         $ret .= $cookie[$i];
  13         }
  14         return $ret;
  15 }
  16
  17 function validateCookie(&$userId, &$domainId, &$charId)
  18 {
  19         global $DBHost, $DBUserName, $DBPassword, $DBName, $RingDBName, $AcceptUnknownUser;
  20
  21         if (!isset($_COOKIE["ryzomId"]))
  22         {
  23                 echo "Cookie not found<BR>";
  24                 return false;
  25         }
  26
  27         // read the ip and compare with client ip
  28         $cookie = $_COOKIE["ryzomId"];
  29         echo "Cookie is $cookie<BR>";
  30         sscanf($cookie, "%02X%02X%02X%02X", $b0, $b1, $b2, $b3);
  31         $addr = $b0 + ($b1<<8) + ($b2<<16) + ($b3<<24);
  32         printf("Addr is %X<BR>", $addr);
  33         $addrStr = long2ip($addr);
  34         echo "addrStr is $addrStr<br>";
  35
  36         if ($_SERVER["REMOTE_ADDR"] != $addrStr)
  37         {
  38                 echo "Client ip don't match cookie<BR>";
  39                 return false;
  40         }
  41
  42         // check the cookie in the database
  43         $link = mysqli_connect($DBHost, $DBUserName, $DBPassword) or die ("Can't connect to database host:$DBHost user:$DBUserName");
  44         mysqli_select_db($link, $RingDBName) or die ("Can't access to the table dbname:$RingDBName");
  45         $query = "SELECT user_id, current_status, current_domain_id FROM ring_users where cookie='$cookie'";
  46         $result = mysqli_query($link, $query) or die ("Can't execute the query: ".$query);
  47
  48         if (mysqli_num_rows($result) == 0)
  49         {
  50                 echo "Can't find cookie $cookie in database<BR>";
  51                 return false;
  52         }
  53
  54         $row = mysqli_fetch_array($result);
  55
  56         if ($row["current_status"] != "cs_logged" && $row["current_status"] != "cs_online" )
  57         {
  58                 echo "User $row[user_id] is not looged or online<BR>";
  59                 return false;
  60         }
  61
  62         $userId = $row["user_id"];
  63         $domainId = $row["current_domain_id"];
  64 //              $charId = ($userId*16) + (getCharSlot()) & 0xf;
  65         $charId = $userId*16 + getCharSlot();
  66
  67         return true;
  68 }
  69
  70 function getCharSlot()
  71 {
  72         global $_GET, $_POST;
  73         if (isset($_GET["charSlot"]))
  74                 return $_GET["charSlot"];
  75         else if (isset($_POST["charSlot"]))
  76                 return $_POST["charSlot"];
  77         else
  78                 return 0; // temp dev: use 0 as the "ring character"
  79 }