From c831349dc55e2e8357127e47416b37780da4477d Mon Sep 17 00:00:00 2001
From: xiaomlove <i353856593@163.com>
Date: Thu, 25 Aug 2022 21:45:55 +0800
Subject: [PATCH] add log to userlogin()

---
 app/Http/Controllers/AuthenticateController.php | 2 +-
 include/constants.php                           | 2 +-
 include/functions.php                           | 6 ++++++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/app/Http/Controllers/AuthenticateController.php b/app/Http/Controllers/AuthenticateController.php
index 3acf7bd1..392fff18 100644
--- a/app/Http/Controllers/AuthenticateController.php
+++ b/app/Http/Controllers/AuthenticateController.php
@@ -51,7 +51,7 @@ class AuthenticateController extends Controller
             $user = User::query()->where('passkey', $passkey)->first(['id', 'passhash']);
             if ($user) {
                 $passhash = md5($user->passhash . $_SERVER["REMOTE_ADDR"]);
-                logincookie($user->id, $passhash,false,0x7fffffff, true, true, true);
+                logincookie($user->id, $passhash,false, 86400 * 30, true, true, true);
                 $user->last_login = now();
                 $user->save();
             }
diff --git a/include/constants.php b/include/constants.php
index d641ae1c..0a1a4681 100644
--- a/include/constants.php
+++ b/include/constants.php
@@ -1,6 +1,6 @@
 <?php
 defined('VERSION_NUMBER') || define('VERSION_NUMBER', '1.7.23');
-defined('RELEASE_DATE') || define('RELEASE_DATE', '2022-08-24');
+defined('RELEASE_DATE') || define('RELEASE_DATE', '2022-08-25');
 defined('IN_TRACKER') || define('IN_TRACKER', false);
 defined('PROJECTNAME') || define("PROJECTNAME","NexusPHP");
 defined('NEXUSPHPURL') || define("NEXUSPHPURL","https://nexusphp.org");
diff --git a/include/functions.php b/include/functions.php
index 7499bea3..d2d0f16f 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1926,6 +1926,7 @@ function userlogin() {
 	global $SITE_ONLINE, $oldip;
 	global $enablesqldebug_tweak, $sqldebug_tweak;
 	unset($GLOBALS["CURUSER"]);
+	$log = "cookie: " . json_encode($_COOKIE);
 
 	$ip = getip();
 	$nip = ip2long($ip);
@@ -1941,6 +1942,7 @@ function userlogin() {
 	}
 
 	if (empty($_COOKIE["c_secure_pass"]) || empty($_COOKIE["c_secure_uid"]) || empty($_COOKIE["c_secure_login"])) {
+	    do_log("$log, param not enough");
 	    return $loginResult = false;
     }
 	if ($_COOKIE["c_secure_login"] == base64("yeah"))
@@ -1951,6 +1953,7 @@ function userlogin() {
 	$b_id = base64($_COOKIE["c_secure_uid"],false);
 	$id = intval($b_id ?? 0);
 	if (!$id || !is_valid_id($id) || strlen($_COOKIE["c_secure_pass"]) != 32) {
+        do_log("$log, invalid c_secure_uid");
         return $loginResult = false;
     }
 
@@ -1963,6 +1966,7 @@ function userlogin() {
 	$res = sql_query("SELECT * FROM users WHERE users.id = ".sqlesc($id)." AND users.enabled='yes' AND users.status = 'confirmed' LIMIT 1");
 	$row = mysql_fetch_array($res);
 	if (!$row) {
+        do_log("$log, c_secure_uid not exists");
         return $loginResult = false;
     }
 
@@ -1974,12 +1978,14 @@ function userlogin() {
 	{
 
 		if ($_COOKIE["c_secure_pass"] != md5($row["passhash"].$_SERVER["REMOTE_ADDR"])) {
+            do_log("$log, secure login == yeah, c_secure_pass invalid");
             return $loginResult = false;
         }
 	}
 	else
 	{
 		if ($_COOKIE["c_secure_pass"] !== md5($row["passhash"])) {
+            do_log("$log, c_secure_pass invalid");
             return $loginResult = false;
         }
 	}