source: branches/comu-euc/html/frontparts/login_check.php @ 16814

<?php
/*
 * Copyright(c) 2000-2007 LOCKON CO.,LTD. All Rights Reserved.
 *
 * http://www.lockon.co.jp/
 */
require_once("../require.php");

// ÉÔÀµ¤ÊURL¤¬POST¤µ¤ì¤¿¾ì¹ç¤Ï¥¨¥é¡¼É½¼¨
if (isset($_POST['url']) && lfIsValidURL() !== true) {
    gfPrintLog('invalid access :login_check.php $POST["url"]=' . $_POST['url']);
    sfDispSiteError(PAGE_ERROR);
}

$objCustomer = new SC_Customer();
// ¥¯¥Ã¥­¡¼´ÉÍý¥¯¥é¥¹
$objCookie = new SC_Cookie(COOKIE_EXPIRE);
// ¥Ñ¥é¥á¡¼¥¿´ÉÍý¥¯¥é¥¹
$objFormParam = new SC_FormParam();
// ¥Ñ¥é¥á¡¼¥¿¾ðÊó¤Î½é´ü²½
lfInitParam();
// POSTÃͤμèÆÀ
$objFormParam->setParam($_POST);

switch($_POST['mode']) {
case 'login':
    $objFormParam->toLower('login_email');
    $arrErr = $objFormParam->checkError();
    $arrForm =  $objFormParam->getHashArray();
    // ¥¯¥Ã¥­¡¼ÊݸȽÄê
    if ($arrForm['login_memory'] == "1" && $arrForm['login_email'] != "") {
        $objCookie->setCookie('login_email', $_POST['login_email']);
    } else {
        $objCookie->setCookie('login_email', '');
    }

    if(count($arrErr) == 0) {
        if($objCustomer->getCustomerDataFromEmailPass($arrForm['login_pass'], $arrForm['login_email'])) {
            header("Location: " . $_POST['url']);
            exit;
        } else {
            $objQuery = new SC_Query;
            $where = "email ILIKE ? AND status = 1 AND del_flg = 0";
            $ret = $objQuery->count("dtb_customer", $where, array($arrForm['login_email']));

            if($ret > 0) {
                sfDispSiteError(TEMP_LOGIN_ERROR);
            } else {
                sfDispSiteError(SITE_LOGIN_ERROR);
            }
        }
    } else {
        // ÆþÎÏ¥¨¥é¡¼¤Î¾ì¹ç¡¢¸µ¤Î¥¢¥É¥ì¥¹¤ËÌ᤹¡£
        header("Location: " . $_POST['url']);
        exit;
    }
    break;
case 'logout':
    // ¥í¥°¥¤¥ó¾ðÊó¤Î²òÊü
    $objCustomer->EndSession();
    //¥Þ¥¤¥Ú¡¼¥¸¥í¥°¥¤¥óÃæ¤Ï¥í¥°¥¤¥ó²èÌ̤ذܹÔ
    if ( preg_match('/mypage/', $_POST['url']) ){
        header('Location: ' . URL_DIR . 'mypage/login.php');
    }else{
        header("Location: " . $_POST['url']);
    }
    exit;
    break;
}

//-----------------------------------------------------------------------------------------------------------------------------------
/* ¥Ñ¥é¥á¡¼¥¿¾ðÊó¤Î½é´ü²½ */
function lfInitParam() {
    global $objFormParam;
    $objFormParam->addParam("µ­²±¤¹¤ë", "login_memory", INT_LEN, "n", array("MAX_LENGTH_CHECK", "NUM_CHECK"));
    $objFormParam->addParam("¥á¡¼¥ë¥¢¥É¥ì¥¹", "login_email", STEXT_LEN, "a", array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
    $objFormParam->addParam("¥Ñ¥¹¥ï¡¼¥É", "login_pass", STEXT_LEN, "", array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
}

/* POST¤µ¤ì¤ëURL¤Î¥Á¥§¥Ã¥¯*/
function lfIsValidURL() {
    $arrValidUrl = array(SSL_URL, SITE_URL, '/');
    $targetUrl   = $_POST['url'];

    // $arrValidUrl¤Ë¥Þ¥Ã¥Á¤·¤Ê¤¤¾ì¹ç¤ÏÉÔÀµ¤ÊURL
    $match = false;
    foreach ($arrValidUrl as $validUrl) {
        $pattern = sprintf('/^%s/' , preg_quote($validUrl, '/'));
        gfPrintLog($pattern . ':' . $targetUrl);
        if ( preg_match($pattern, $targetUrl) ) {
            $match = true;
            break;
        }
    }
    if (!$match) return false;

    // ²þ¹Ô¥³¡¼¥É(CR¡¦LF)¡¦NULL¥Ð¥¤¥È¤ò´Þ¤à¾ì¹ç¤ÏÉÔÀµ¤ÊURL
    $pattern = '/\r|\n|\0|%0D|%0A|%00/';
    if (preg_match_all($pattern, $targetUrl, $matches)) {
        return false;
    }

    return true;
}

?>