rendered paste body<?php/*** mod_autologin* @package Module for Joomla Open Source 1.0.x* @copyright (C) ERRor* All rights reserved* Original Release Date: Jun. 14, 2006* @version 1.0.1* @license GNU GPL*//*** Restrict direct access to this file.* @global _VALID_MOS* */defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.');global $my, $acl, $_VERSION;//Get options$target = $params->get('target' , '_blank');$popnoaccess = $params->get('popnoaccess' , 'You have no access to site backend.');$title = $params->get('title' , 'Proceed to site administration'); //This option added by John Bekker$noaccess = $params->get('noaccess' , 'No access.');//Check administrative rights$autologin = FALSE;if( $my->id != 0 ) { $grp = $acl->getAroGroup( $my->id ); $my->usertype = $grp->name; if($acl->acl_check( 'administration', 'login', 'users', $my->usertype )) $autologin = TRUE;}if (isset( $_GET['goto'] ) && $_GET['goto'] == '/administrator') { if($autologin) { //simply cut from /administrator/index.php session_name( md5( $mosConfig_live_site ) ); session_start(); // construct Session ID $logintime = time(); $session_id = md5( $my->id . $my->username . $my->usertype . $logintime ); // add Session ID entry to DB $query = "INSERT INTO #__session" . "\n SET time = '$logintime', session_id = '$session_id', userid = $my->id, usertype = '$my->usertype', username = '$my->username'" ; $database->setQuery( $query ); if (!$database->query()) { echo $database->stderr(); } // check if site designated as a production site // for a demo site allow multiple logins with same user account if ( $_VERSION->SITE == 1 ) { // delete other open admin sessions for same account $query = "DELETE FROM #__session" . "\n WHERE userid = $my->id" . "\n AND username = '$my->username'" . "\n AND usertype = '$my->usertype'" . "\n AND session_id != '$session_id'" // this ensures that frontend sessions are not purged . "\n AND guest = 1" . "\n AND gid = 0" ; $database->setQuery( $query ); if (!$database->query()) { echo $database->stderr(); } } $_SESSION['session_id'] = $session_id; $_SESSION['session_user_id'] = $my->id; $_SESSION['session_username'] = $my->username; $_SESSION['session_usertype'] = $my->usertype; $_SESSION['session_gid'] = $grp->group_id; // Not $my->grp ! $_SESSION['session_logintime'] = $logintime; $_SESSION['session_user_params'] = $my->params; $_SESSION['session_userstate'] = array(); session_write_close(); $expired = "$mosConfig_live_site/administrator/index2.php"; // enough ... /** cannot using mosredirect as this stuffs up the cookie in IIS */ // redirects page to admin homepage by default or expired page echo "<script>document.location.href='$expired';</script>\n"; exit(); } else { mosErrorAlert("$popnoaccess", "document.location.href='$mosConfig_live_site/index.php'"); } } elseif($autologin) { echo "<a target=$target href='$mosConfig_live_site/index.php?goto=/administrator'><center><b>$title</b></center></a>"; } else { echo "<center><b><font color='red'>$noaccess</font></b></center>"; } ?>