Fehler bei Loginscript

[roteisen]

Hallo,

bei meinem Loginscript kommt es nach dem einloggen zu einem Fehler.

Entweder wird in der Browser-Adressleiste (Firefox)

.../logged.php%20acm_r=42993 

Oder ein 404 Fehler, nach Refresch eine leere Seite (IE):

.../scripts/login.php 

angezeigt.

Wo wird das sinnlose Leerzeichen eingefügt? Macht es das Script?


Danke,
Tommy

[Schnoop]

Naja. Also ohne Code geht da wohl nix. Aus den beiden URLs können wir wohl nicht auf den Fehler schließen

[roteisen]

Ich poste hier mal die login.php die ist sehr lang:

<?
    
    if (is_array($_GET)) extract($_GET);
    if (is_array($_POST)) extract($_POST);
    if (is_array($_COOKIE)) extract($_COOKIE);
    $PHP_SELF = $_SERVER["PHP_SELF"];
    
    $script_path = "/home/mcpoxxxx/public_html/access/accessm_lite_1_0_1";
    include_once($script_path . "/config.php");
    include_once($script_path . "/connect.php");
    
    $s_total_array = array("s_total_user", "s_total_user_id", "s_total_password");
    $total_array = array("total_user", "total_user_id", "total_password");

    $preferences_array = array(
        'scripts_url', 'login_back_url', 'fp_page_url', 'admin_email',
        'hack_email_time', 'hack_interval',    'hack_number'
    );
    
    $query = "SELECT field, value FROM " . $prefix . "_preferences WHERE field IN ('" . join("','", $preferences_array) . "')";
    $result = mysql_query($query);
    while( list($field, $value) = mysql_fetch_row($result) )
        $$field = $value;
    
    if (!$login_back_url && !$b_url)
        $b_url = $_SERVER["HTTP_REFERER"];
    elseif( !$b_url)
        $b_url = $login_back_url;
    if( $b_url ){
        if( preg_match("/acm_r=\d+/", $b_url, $regs) )
            $b_url = preg_replace("/(acm_r=)\d+/", "acm_r=" . rand(10000,999999), $b_url );
        elseif( !strchr($b_url, "?") )
            $b_url .= "?acm_r=" . rand(10000,999999);
        else
            $b_url .= "&acm_r=" . rand(10000,999999);
    }
    
    if( !headers_sent() ){
        my_session_start();
        extract($_SESSION);
    }
    elseif( $_COOKIE['s_total_user'] && $_COOKIE['s_total_password'] && $_COOKIE['s_total_user'] != "-1" && $_COOKIE['s_total_password'] != "-1"){
        $total_user = $s_total_user;
        $total_password = $s_total_password;
        $total_user_id = $s_total_user_id;
    }
    
    if( $saction == "logout" ){
        my_session_unset();
        my_cookie_register(1);
        header( "Last-Modified: " . date("D, d M Y H:i:s") . " GMT" );
        header( "Location: " . $b_url );
        die();
    }
    
    if( $saction == "login" ){
        my_session_unset();
        my_cookie_register(1);
        if( $login && $password ){
            $total_user = $login;
            $total_password = $password;
        }
    }
    
    if( $total_user && $total_password && $total_user != "-1" )
    {
        $query = "SELECT id, login, password, blocked FROM " . $prefix . "_users WHERE login = '" . $total_user . "'";
        $result = mysql_query($query);
        list($u_id, $u_login, $u_password, $blocked) = mysql_fetch_row($result);
        
        if( $total_user == $u_login && $total_password == $u_password && $blocked ){
            $error = 3;
            $total_user = "";
        }
        elseif( $total_user == $u_login && $total_password == $u_password )
        {
            $query = "SELECT * FROM " . $prefix . "_blocked_ips WHERE ip = '" . $_SERVER["REMOTE_ADDR"] . "'";
            $res = mysql_query($query);
            if (mysql_num_rows($res) == 0)
            {
                $total_user_id = $u_id;
                my_session_register();
                my_cookie_register();
                $query = "SELECT * FROM " . $prefix . "_statistics WHERE u_id = '" . $total_user_id . "' AND l_date = NOW()";
                $result = mysql_query($query);
                if (mysql_num_rows($result) == 0)
                    $query = "INSERT INTO " . $prefix . "_statistics (u_id, l_date, logins) VALUES ('" . $total_user_id . "', NOW(), 1)";
                elseif( $saction == "login" )
                    $query = "UPDATE " . $prefix . "_statistics SET logins = logins + 1 WHERE u_id = '" . $total_user_id . "' AND l_date = NOW()";
                else
                    $query = "UPDATE " . $prefix . "_statistics SET visits = visits + 1 WHERE u_id = '" . $total_user_id . "' AND l_date = NOW()";
                mysql_query($query);
                
                if ($saction == "login"){
                    Header("Location: " . $b_url);
                    die();
                }
            }
            else{
                $error = 2;
                my_session_unset();
                my_cookie_register(1);
            }
        }
        else
        {
            if ($saction == "login")
            {
                $query = "INSERT INTO " . $prefix . "_bad_logins (time, login, ip) VALUES (NOW(), '" . $total_user . "', '" . $_SERVER["REMOTE_ADDR"] . "')";
                $result = mysql_query($query);
                
                $b_time = time() - 3600 * $hack_interval;
                $begin_time = date("Y-m-d H:i:s", $b_time);
                
                $query = "SELECT count(*) FROM " . $prefix . "_bad_logins WHERE time >= '" . $begin_time . "'";
                $result = mysql_query($query);
                list($bad_logins) = mysql_fetch_row($result);
                if ($bad_logins >= $huck_number && $hack_email_time < $begin_time)
                {
                    ////////////HACK ALERT MAIL/////////
                    $query = "SELECT email_subject, email_body, from_email, from_name FROM " . $prefix . "_email_templates WHERE id = 3";
                    $result = mysql_query($query);
                    list($email_subject, $body, $from_email, $from_name) = mysql_fetch_row($result);
                    
                    $query = "SELECT * FROM " . $prefix . "_bad_logins WHERE time >= '" . $begin_time . "' ORDER BY time DESC";
                    $result = mysql_query($query);
                    while ($row = mysql_fetch_array($result))
                        $stat_arr[] = $row["time"] . "  " . $row["login"] . "  " . $row["ip"];
                    $stats = join("\n", $stat_arr);
                    
                    $body = preg_replace("/#%statistic%#/iU", $stats, $body);
                    $body = preg_replace("/#%time%#/iU", $begin_time, $body);
                    
                    $body = preg_replace("/#%[\w+]%#/iU", "", $body);
                    $crlf = strstr(PHP_OS, 'WIN') ? "\r\n" : "\n";
                    $headers = Array();
                    $headers[] = "Return-Path: " . $from_email . "";
                    $headers[] = "From: " . $from_name . "<" . $from_email . ">";
                    $headers[] = "Reply-To: " .  $from_name . "<" . $from_email . ">";
                    $headers[] = "X-Priority: 3";
                    $headers[] = "X-Mailer: s_mail [version 0.4.12a]";
                    $headers[] = "Content-Type: text/plain;";
                    $headers[] = "\tcharset=\"widows-1251\"";
                    $headers[] = "Content-Transfer-Encoding: 8bit";
                    $headers = join($crlf, $headers);
                    
                    $body = $crlf . $body;
                    $body .= "\nPowered by Access Magic, [url]http://reamdaysoft.com[/url]";
                    $sended = @mail($admin_email, $email_subject, $body, $headers);
                    /////////////////////////////
                    
                    $query = "UPDATE " . $prefix . "_preferences SET value = '" . date("Y-m-d H:i:s") . "' WHERE field = 'hack_email_time'";
                    $result = mysql_query($query);
                }
                my_session_unset();
                my_cookie_register(1);
                $error = 1;
            }
        }
    }
    else{
        my_session_unset();
        my_cookie_register(1);
    }

    if( !$total_user || $total_user == "-1" )
    {
        $query = "SELECT * FROM " . $prefix . "_templates WHERE type = 'login_form'";
        $result = mysql_query($query);
        $main_row = mysql_fetch_array($result);
        
        $tmpl = "<CENTER>\n" . $main_row["tmpl"] . "\n</CENTER>";
        $styles = Array();
        $styles = unserialize($main_row["styles"]);
        while (list($key, $rec) = each($styles))
        {
            $tmpl = preg_replace("/#%" . $key . "%#/i", $rec, $tmpl);
        }
        $tmpl = preg_replace("/#%[\w_]+%#/iU", "none", $tmpl);
        $tmpl = preg_replace("/-#([\w_]+)#-/iU", "#%\\1%#", $tmpl);

        $tmpl = preg_replace("/#%title%#/iU", $styles["title_text"], $tmpl);
        
        if     ($error == 1) $login_error = "Wrong login or password";
        elseif ($error == 2) $login_error = "Your IP address is blocked";
        elseif ($error == 3) $login_error = "Sorry, but you are blocked";
        elseif ($error == 4) $login_error = "Cannot modify header information. Please, insert integration code directly at the beginning of your page.";
        
        if ($login_error){
            $tmpl = preg_replace("/#%error_text%#/iU", $login_error, $tmpl);
            $tmpl = preg_replace("/<!-- error -->\s*([\s\S]+)\s*<!-- error -->/iU", "\\1", $tmpl);
        }
        
//        $tmpl = preg_replace("/#%b_url%#/iU", $b_url, $tmpl);
        
        $form_action = $scripts_url . "/login.php";
        $tmpl = preg_replace("/#%login_form_action%#/iU", $form_action, $tmpl);
        if ($fp_page_url) $fp_form_action = $fp_page_url;
        else $fp_form_action = $scripts_url . "/f_password.php";
        $tmpl = preg_replace("/#%fp_form_action%#/iU", $fp_form_action, $tmpl);
        $tmpl = preg_replace("/#%[\w]+%#/iU", "", $tmpl);
        $tmpl .= "\n<CENTER><font face=Tahoma size=1><b><a href=\"http://reamdaysoft.com/access_magic_lite.html\"  target=\"_blank\">Powered by Access Magic v" . $version . "</a>,<br><a href=\"http://reamdaysoft.com\"  target=\"_blank\">&copy; Reamday Enteprises, 2004</a></b></font></CENTER>";
        $login_tmpl = $tmpl;
        
        echo $login_tmpl . "<br>";
        exit;
    }

// *********************************** functions ***********************************************************
function my_session_start()
{
    session_name("ACCESS");
    session_start();
}

function my_session_unset()
{
    global $total_array, $_SESSION, $total_user, $total_password, $total_user_id;
    
    foreach( $total_array as $rec ){
        unset( $_SESSION[ $rec ] );
        $$rec = "";
    }
    $_SESSION = array();
}

function my_session_register()
{
    global $total_array, $_SESSION, $total_user, $total_password, $total_user_id;
    
    foreach( $total_array as $rec )
        $_SESSION[ $rec ] = $$rec;
}

function my_cookie_register($is_unset=0)
{
    global $total_user, $total_user_id, $total_password, $s_total_array, $total_array, $_COOKIE, $s_total_user, $s_total_user_id, $s_total_password;
    
    if( $is_unset ) $total_user = $total_user_id = $total_password = "-1";
    $duration = $is_unset ? -3600 : 1800;
    
    if( !headers_sent() ){
        setcookie("s_total_user", $total_user, time() + $duration, "/" );
        setcookie("s_total_user_id", $total_user_id, time() + $duration, "/");
        setcookie("s_total_password", $total_password, time() + $duration, "/");
    }
    else{
        $expires = date("D, d M Y H:i:s", time() + $duration );
        echo "<script language=JavaScript>
<!--
    document.cookie = 's_total_user=" . $total_user . ";expires=" . $expires . ";path=/;';
    document.cookie = 's_total_user_id=" . $total_user_id . ";expires=" . $expires . ";path=/;';
    document.cookie = 's_total_password=" . $total_password . ";expires=" . $expires . ";path=/;';
-->
</script>";
    }
    
    foreach( $total_array as $rec ){
        $name = "s_" . $rec;
        $_COOKIE[ $name ] = $$rec;
        $_SESSION[ $rec ] = $$rec;
        $$name = $$rec;
    }
}
?>