require_once("../lib/course/Course.php"); ?> // trim any whitespace around username if (isset($_POST["username"])) $_POST["username"] = trim($_POST["username"]); // decode return address, if any $_POST["ra"] = urldecode($_POST["ra"]); // if username and password were provided, try to authenticate user against IMAP daemon if (isset($_POST["username"]) && isset($_POST["password"])) { // if username/password matched (i.e., imap_open returns an // actual resource) and user is affiliated with the course, let 'em in if (is_resource($c = imap_open("{localhost:143/imap/notls}", $_POST["username"], $_POST["password"], OP_HALFOPEN, 0)) && ($user = course()->user($_POST["username"]))) { // close the IMAP connection imap_close($c); // remember that this user's now logged in course()->login($user); // put their username in a cookie on their // computer to save them some keystrokes next time setcookie("username", $_POST["username"], time() + 60 * 60 * 24 * 7, "/", "." . course()->config("domain")); // stamp user's hand if requested if ($_POST["stamp"]) { // generate a stamp for user's hand $stamp = course()->strrand(64); // stamp user's hand for just 7 days (in case they never return) setcookie("stamp", $stamp, time() + 60 * 60 * 24 * 7, "/", "." . course()->config("domain")); // remember that we stamped user's hand course()->query(sprintf("INSERT INTO stamps (username, stamp) VALUES('%s', '%s') " . "ON DUPLICATE KEY UPDATE stamp=VALUES(stamp)", course()->escape($_POST["username"]), course()->escape($stamp))); } else { // wash hand setcookie("stamp", "", time() - 3600, "/", "." . course()->config("domain")); // forget stamp course()->query(sprintf("DELETE FROM stamps WHERE username='%s'", course()->escape($_POST["username"]))); } } } // if user just logged in (or is already logged in), redirect away from here if (course()->user()) { // redirect to return address (unless it's /log*), if any, else to home page if ($_POST["ra"] && !preg_match("/\/log/", $_POST["ra"])) course()->redirect($_POST["ra"]); else course()->redirect("/"); } // scrub username if (!preg_match("/^\w+$/", $_POST["username"])) unset($_POST["username"]); ?> course()->header(); ?>