X-Git-Url: https://jfr.im/git/irc/unrealircd/unrealircd-webpanel.git/blobdiff_plain/b9fd24d6f2672e15c024b108b3d992d94ffe2989..41aad10cbe0755aee50f597cb2cadd3029de7e1d:/login/index.php

diff --git a/login/index.php b/login/index.php
index 283dd0a..0a920f1 100644
--- a/login/index.php
+++ b/login/index.php
@@ -1,6 +1,5 @@
-
 <?php
-require_once "../common.php";
+require_once "../inc/common.php";
 
 $logout = false;
 
@@ -33,19 +32,35 @@ if (!empty($_POST))
 {
 	if ($_POST['username'] && $_POST['password'])
 	{
-		/* securitah */
 		$user = new PanelUser($_POST['username']);
 		/* not being too informative with the login error in case of attackers */
-		if (isset($user->id) && $user->password_verify($_POST['password']))
+		$hash_needs_updating = false;
+		if (isset($user->id) && $user->password_verify($_POST['password'], $hash_needs_updating))
 		{
+			/* SUCCESSFUL LOGIN */
+			if ($hash_needs_updating)
+			{
+				/* Set password again so it is freshly hashed */
+				$hash = PanelUser::password_hash($_POST['password']);
+				$ar = ["update_pass_conf"=>$hash];
+				$user->update_core_info($ar);
+				unset($ar);
+				unset($hash);
+			}
+			panel_start_session($user);
 			$_SESSION['id'] = $user->id;
-			header('Location: ' . $redirect);
 			$user->add_meta("last_login", date("Y-m-d H:i:s"));
 			Hook::run(HOOKTYPE_USER_LOGIN, $user);
+
+			/* Middle of install? Override redirect: */
+			if (!isset($config['unrealircd']))
+				$redirect = get_config("base_url")."settings/install2.php";
+			header('Location: ' . $redirect);
 			die();
 		}
 		else
 		{
+			/* LOGIN FAILED */
 			$fail = [
 				"login" => htmlspecialchars($_POST['username']),
 				"IP" => $_SERVER['REMOTE_ADDR']
@@ -150,4 +165,4 @@ if (!empty($_POST))
 	});
 </script>
 
-<?php require_once "../footer.php";
\ No newline at end of file
+<?php require_once "../inc/footer.php";
\ No newline at end of file