I made a log in script. It was working at first then i added a few things on the code to make it more protective. Now i cant log in. I keep on getting “A critical session or form token post was not set|”
i have 2 php files with a javascript file.
1st php file
[php]<?php
include_once(“check_login_status.php”);
if($user_ok == true){
header(“location: user.php?u=”.$_SESSION[“username”]);
exit();
}
?><?php
//SET TIMESTAMP
//ADD TIMER JAVASCRIPT
//ADD TOKEN TO AJAX POST
$salt = “h89zxKYassa40832”;
$timestamp = time();
$tk = str_shuffle(md5(uniqid().md5($salt)));
$tk = preg_replace(’#[^a-z0-9.-]#i’, ‘’, $tk);
$ses_array = array(“tm” => $timestamp, “tk” => $tk);
if(!isset($_SESSION[‘login’])){
$_SESSION[‘login’] = $ses_array;
} else {
unset($_SESSION[‘login’]);
$_SESSION[‘login’] = $ses_array;
}
?>
[/php]
javascript
[php]var startTime = new Date().valueOf();
function emptyElement(x){
_(x).innerHTML = “”;
}
function login(){
//MAKE SURE TIME HAS NOT EXPIRED
var postTime = new Date().valueOf();
var totalTime = Math.ceil((postTime - startTime)/1000);
//IF 5 MIN HAS PASSED MAKE THEM REFRESH
//SHAVE OFF A FEW SEC OFF FOR TIME LOST IN THE PAGE LOAD 300->295
if(totalTime > 295){
_(“loginbtn”).style.display = “none”;
_(“email”).style.display = “none”;
_(“password”).style.display = “none”;
_(“status”).innerHTML = ‘You have timed out, please refresh the page.’;
return false;
}
var e = _(“email”).value;
var p = _(“password”).value;
if(e == “” || p == “”){
_(“status”).innerHTML = “
Your Missing Something!
”;} else {
_(“loginbtn”).style.display = “none”;
_(“status”).innerHTML = ‘please wait …’;
var ajax = ajaxObj(“POST”, “…/php_parsers/login_parser.php”);
ajax.onreadystatechange = function() {
if(ajaxReturn(ajax) == true) {
if(ajax.responseText == “login_failed”){
_(“status”).innerHTML = “
Login Unsuccessful! Try Again.
”;_(“loginbtn”).style.display = “block”;
} else {
window.location = “user.php?u=”+ajax.responseText;
}
}
}
ajax.send(“e=”+e+"&p="+p+"&t=<?php echo $_SESSION['login']['tk']; ?>");
}
}
[/php]
last php file
[php]if(isset($POST[“e”])){
// Get user ip address
$ip = preg_replace(’#[^0-9.]#’, ‘’, getenv(‘REMOTE_ADDR’));
// Get referer from header
$refer = preg_replace(’#[^a-z0-9 -.]#i’, ‘.’, getenv(‘HTTP_REFERER’));
// Set variable for possible logging
$csrf = “”;
// Check for login session
if(isset($_SESSION[‘login’]) && isset($_SESSION[‘login’][‘tm’]) && isset($_SESSION[‘login’][‘tk’]) && isset($_POST[‘t’])){
// Sanitize everything now
$sTimestamp = preg_replace(’#[^0-9]#’, ‘’, $_SESSION[‘login’][‘tm’]);
$sToken = preg_replace(’#[^a-z0-9.-]#i’, ‘’, $_SESSION[‘login’][‘tk’]);
$fToken = preg_replace(’#[^a-z0-9.-]#i’, ‘’, $_POST[‘t’]);
// Make sure we have values after sanitizing
if($sTimestamp != “” && $sToken != “” && $fToken != “”){
// Check if session and post token match
if($fToken !== $sToken){
$csrf .= “Form token and session token do not match|”;
}
// Do 5 minute check
$elapsed = time() - $sTimestamp;
if($elapsed > 300){
$csrf .= “Expired session|”;
}
} else {
$csrf .= “A critical session or form token post was empty after sanitization|”;
}
} else {
$csrf .= “A critical session or form token post was not set|”;
}
// CONNECT TO THE DATABASE
include_once("…/php_includes/db_connect.php");
// Check our errors here
if($csrf !== ""){
// At least one of our tests above was failed
// Sanitize the e & p posts for logging
$e = mysqli_real_escape_string($dbConnect, $_POST['e']);
$p = mysqli_real_escape_string($dbConnect, $_POST['p']);
// Time to log this
$sql = "INSERT INTO hUserLogging (dt, ip, referer, issues, epost, ppost)
VALUES(now(),'$ip','$refer','$csrf','$e','$p')";
$query = mysqli_query($dbConnect, $sql);
mysqli_close($dbConnect);
// Unset
if(isset($_SESSION['login'])){
unset($_SESSION['login']);
}
// Throttle back the attack
sleep(3);
// Return generic login_failed and exit script
echo "login_failed";
exit();
}
}[/php]