inc/auth_drupal_user.php

   1 <?php
   2 // restrict usage, based on drupal db
   3
   4 require_once($conf['drupal_site_config']);
   5
   6 // bad user, no cookie.
   7 function auth_norights($message = 'You need to be logged in to use this site.')
   8 {
   9         global $conf;
  10         header('WWW-Authenticate: Basic realm="'.$conf['app_title'].'"');
  11         header('HTTP/1.0 401 Unauthorized');
  12         die($message);
  13 }
  14
  15 // do authentication.
  16 // your auth function should get the user/pass for itself ($_REQUEST, $_SERVER['PHP_AUTH_USER'], etc)
  17 // and should do the denying itself (die(), maybe a redirect to a registration page, etc)
  18
  19 // only this function will be called, with no arguments.
  20 function auth_check()
  21 {
  22         global $conf;
  23         global $db_url, $db_prefix;
  24         @$login_user = $_SERVER['PHP_AUTH_USER'];
  25         @$login_pass = $_SERVER['PHP_AUTH_PW'];
  26
  27         if (empty($login_user)){
  28                 auth_norights();
  29         }
  30
  31         // parse drupal connect string
  32         preg_match_all("|(.+)://(.+)@(.+)/(.+)|", $db_url, $out);
  33
  34         $type = $out[1][0];
  35         $user = $out[2][0];
  36         $passwd = '';
  37         $host = $out[3][0];
  38         $db = $out[4][0];
  39
  40         $u = explode(':',$user);
  41         if (count($u)){
  42                 $user = $u[0];
  43                 @$passwd = $u[1];
  44         }
  45
  46         if($type =='mysqli'){
  47                 $type = 'mysql';
  48         }
  49
  50         try {
  51                 $dbh = new PDO("$type:host=$host;dbname=$db", $user, $passwd);
  52                 $sth = $dbh->prepare("SELECT * FROM {$db_prefix}users WHERE name=? AND pass=?");
  53                 $sth->execute(array($login_user, md5($login_pass)));
  54                 $users = $sth->fetchAll();
  55                 if (!count($users)){
  56                         auth_norights();
  57                 }
  58         } catch (Exception $e) {
  59                 auth_norights('A database exception occured!');
  60         }
  61
  62 }
  63