diff --git a/wp-admin/wp-admin.css b/wp-admin/wp-admin.css index bd959cbc3f..269a15bb79 100644 --- a/wp-admin/wp-admin.css +++ b/wp-admin/wp-admin.css @@ -325,27 +325,48 @@ textarea, input, select { } #login { - background: url(../wp-images/wp-small.png) #fff no-repeat top center; - border: 2px solid #333; - color: #333; - height: 170px; - left: 50%; - margin-left: -120px; /* half of width and height */ - margin-top: -85px; - padding: 40px 5px 5px 5px; - position: absolute; - text-align: right; - top: 45%; - width: 240px; + background: #fff; + border: 2px solid #a2a2a2; + width: 25em; + margin: 5em auto; + padding: 1.5em; } -#login textarea, #login input, #login select { - background: #f0f0f0; - border-color: #ccc; - border-style: solid; - border-width: 1px; - margin: 1px; - padding: 2px; +#login form { + text-align: right; +} +#login #login_error { + background: #c00; + color: #fff; + padding: .5em; + border: 1px solid #a40000; + text-align: center; + font-weight: bold; + font-size: 16px; +} +#login h1 { + background: url(../wp-images/wp-small.png) no-repeat; + margin-top: 0; +} +#login h1 a { + display: block; + text-indent: -1000px; +} + +#login ul { + list-style: none; + margin: 0; + padding: 0; + +} +#login ul li { + display: inline; + text-align: center; + margin-left: 1.4em; +} + +#login input { + padding: 3px; } #metainfo, #postdiv { diff --git a/wp-includes/template-functions-general.php b/wp-includes/template-functions-general.php index 2410aa874f..0965405533 100644 --- a/wp-includes/template-functions-general.php +++ b/wp-includes/template-functions-general.php @@ -52,10 +52,14 @@ function bloginfo_unicode($show='') { function get_bloginfo($show='') { switch($show) { - case 'url': - case 'siteurl': + case 'url' : + case 'home' : + case 'siteurl' : $output = get_settings('home'); break; + case 'wpurl' : + $output = get_settings('siteurl'); + break; case 'description': $output = get_settings('blogdescription'); break; diff --git a/wp-login.php b/wp-login.php index 033e6c5d4d..59144d9083 100644 --- a/wp-login.php +++ b/wp-login.php @@ -1,54 +1,37 @@ Error: the login field is empty.'); +function login($username, $password, $already_md5 = false) { + global $wpdb, $error; + if ( !$already_md5 ) + $pwd = md5($password); + + if ( !$username ) + return false; + + if ( !$password ) { + $error = __('Error: The password field is empty.'); return false; } - if (!$password) { - $error = __('Error: the password field is empty.'); - return false; - } - - $query = "SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$user_login' AND user_pass = '$password'"; - - $login = $wpdb->get_row($query); + $login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'"); if (!$login) { - $error = __('Error: wrong login or password.'); + $error = __('Error: Wrong login.'); $pwd = ''; return false; } else { - $user_ID = $login->ID; - if (($pass_is_md5 == 0 && $login->user_login == $user_login && $login->user_pass == $password) || ($pass_is_md5 == 1 && $login->user_login == $user_login && $login->user_pass == md5($password))) { + + if ( $login->user_login == $username && $login->user_pass == $pwd ) { return true; } else { - $error = __('Error: wrong login or password.'); + $error = __('Error: Incorrect password.'); $pwd = ''; - return false; + return false; } } } -function checklogin() { - global $user_login, $user_pass_md5, $user_ID; - - $userdata = get_userdatabylogin($user_login); - - if ($user_pass_md5 != md5($userdata->user_pass)) { - return false; - } else { - return true; - } -} - if (!function_exists('add_magic_quotes')) { function add_magic_quotes($array) { foreach ($array as $k => $v) { @@ -68,7 +51,7 @@ if (!get_magic_quotes_gpc()) { $_COOKIE = add_magic_quotes($_COOKIE); } -$wpvarstoreset = array('action','mode','error','text','popupurl','popuptitle'); +$wpvarstoreset = array('action'); for ($i = 0; $i < count($wpvarstoreset); $i = $i + 1) { $wpvar = $wpvarstoreset[$i]; @@ -84,7 +67,7 @@ for ($i = 0; $i < count($wpvarstoreset); $i = $i + 1) { } } } - +$error = ''; // If someone has moved WordPress let's try to detect it if ( dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) != get_settings('siteurl') ) update_option('siteurl', dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) ); @@ -93,27 +76,26 @@ switch($action) { case 'logout': - setcookie('wordpressuser_'.$cookiehash, " ", time() - 31536000, COOKIEPATH); - setcookie('wordpresspass_'.$cookiehash, " ", time() - 31536000, COOKIEPATH); + setcookie('wordpressuser_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH); + setcookie('wordpresspass_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH); header('Expires: Wed, 11 Jan 1984 05:00:00 GMT'); header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT'); header('Cache-Control: no-cache, must-revalidate'); header('Pragma: no-cache'); - if ($is_IIS) { + if ($is_IIS) header('Refresh: 0;url=wp-login.php'); - } else { + else header('Location: wp-login.php'); - } exit(); break; case 'login': - if(!empty($_POST)) { + if( !empty($_POST) ) { $log = $_POST['log']; - $pwd = stripslashes($_POST['pwd']); - $redirect_to = $_POST['redirect_to']; + $pwd = $_POST['pwd']; + $redirect_to = preg_replace('|[^a-z/.:_-]|i', '', $_POST['redirect_to']); } $user = get_userdatabylogin($log); @@ -122,20 +104,19 @@ case 'login': $redirect_to = get_settings('siteurl') . '/wp-admin/profile.php'; } - if (!login()) { + if ( !login($log, $pwd) ) { header('Expires: Wed, 11 Jan 1984 05:00:00 GMT'); header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT'); header('Cache-Control: no-cache, must-revalidate'); header('Pragma: no-cache'); - if ($is_IIS) { - header('Refresh: 0;url=wp-login.php'); - } else { - header('Location: wp-login.php'); - } + if ($is_IIS) + header('Refresh: 0;url=wp-login.php'); + else + header('Location: wp-login.php'); exit(); } else { $user_login = $log; - $user_pass = $pwd; + $user_pass = md5($pwd); setcookie('wordpressuser_'.$cookiehash, $user_login, time() + 31536000, COOKIEPATH); setcookie('wordpresspass_'.$cookiehash, md5($user_pass), time() + 31536000, COOKIEPATH); @@ -144,26 +125,10 @@ case 'login': header('Cache-Control: no-cache, must-revalidate'); header('Pragma: no-cache'); - switch($mode) { - case 'bookmarklet': - $location = "wp-admin/bookmarklet.php?text=$text&popupurl=$popupurl&popuptitle=$popuptitle"; - break; - case 'sidebar': - $location = "wp-admin/sidebar.php?text=$text&popupurl=$popupurl&popuptitle=$popuptitle"; - break; - case 'profile': - $location = "wp-admin/profile.php?text=$text&popupurl=$popupurl&popuptitle=$popuptitle"; - break; - default: - $location = "$redirect_to"; - break; - } - - if ($is_IIS) { - header("Refresh: 0;url=$location"); - } else { - header("Location: $location"); - } + if ($is_IIS) + header("Refresh: 0;url=$redirect_to"); + else + header("Location: $redirect_to"); } break; @@ -175,8 +140,8 @@ case 'lostpassword': - <?php _e('WordPress » Lost password ?') ?> - + WordPress » <?php _e('Lost Password') ?> + - -
-

+

WordPress

+

$error
 
"; +if ($error) + echo "
$error
"; ?> -
+ +

-
-
- - +
+
+

+

- - - - user_login; $user_email = $user_data->user_email; - if (!$user_email || $user_email != $_POST['email']) die(sprintf(__('Sorry, that user does not seem to exist in our database. Perhaps you have the wrong username or e-mail address? Try again.'), 'wp-login.php?action=lostpassword')); - // Generate something random for a password... md5'ing current time with a rand salt - $user_pass = substr((MD5("time" . rand(1,16000))), 0, 6); - // now insert the new pass md5'd into the db - $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$user_pass') WHERE user_login = '$user_login'"); - $message = "Login: $user_login\r\n"; - $message .= "Password: $user_pass\r\n"; - $message .= 'Login at: ' . get_settings('siteurl') . '/wp-login.php'; + if (!$user_email || $user_email != $_POST['email']) + die(sprintf(__('Sorry, that user does not seem to exist in our database. Perhaps you have the wrong username or e-mail address? Try again.'), 'wp-login.php?action=lostpassword')); - $m = mail($user_email, '[' . get_settings('blogname') . "] Your weblog's login/password", $message); + // Generate something random for a password... md5'ing current time with a rand salt + $user_pass = substr( MD5('time' . rand(1, 16000) ), 0, 6); + // now insert the new pass md5'd into the db + $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$user_pass') WHERE user_login = '$user_login'"); + $message = __('Login') . ": $user_login\r\n"; + $message .= __('Password') . ": $user_pass\r\n"; + $message .= get_settings('siteurl') . '/wp-login.php'; + + $m = mail($user_email, sprintf(__("[%s] Your login and password"), get_settings('blogname')), $message); if ($m == false) { echo '

' . __('The e-mail could not be sent.') . "
\n"; @@ -247,30 +211,29 @@ break; default: - if((!empty($_COOKIE['wordpressuser_'.$cookiehash])) && (!empty($_COOKIE['wordpresspass_'.$cookiehash]))) { - $user_login = $_COOKIE['wordpressuser_'.$cookiehash]; - $user_pass_md5 = $_COOKIE['wordpresspass_'.$cookiehash]; + if( !empty($_COOKIE['wordpressuser_' . COOKIEHASH]) && !empty($_COOKIE['wordpresspass_' . COOKIEHASH]) ) { + $user_login = $_COOKIE['wordpressuser_' . COOKIEHASH]; + $user_pass_md5 = $_COOKIE['wordpresspass_' . COOKIEHASH]; } - if ( !(checklogin()) ) { - if (!empty($_COOKIE['wordpressuser_'.$cookiehash])) { - $error="Error: wrong login/password"; //, or your session has expired."; - } + if ( !login($user_login, $user_pass_md5, true) ) { + if ( !empty($_COOKIE['wordpressuser_' . COOKIEHASH]) ) + $error = 'Your session has expired.'; } else { - header("Expires: Wed, 5 Jun 1979 23:41:00 GMT"); /* private joke: this is Michel's birthdate - though officially it's on the 6th, since he's GMT+1 :) */ - header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); /* different all the time */ - header("Cache-Control: no-cache, must-revalidate"); /* to cope with HTTP/1.1 */ - header("Pragma: no-cache"); - header("Location: wp-admin/"); + header('Expires: Wed, 5 Jun 1979 23:41:00 GMT'); // Michel's birthday + header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT'); + header('Cache-Control: no-cache, must-revalidate'); + header('Pragma: no-cache'); + header('Location: wp-admin/'); exit(); } ?> - <?php printf(__('WordPress > %s > Login form'), htmlspecialchars(get_settings('blogname'))) ?> - - + WordPress › <?php _e('Login') ?> + +