WooYun.org

case 'getpwd':
                        if($do_submit)
                        {       
                                if(!preg_match('/^\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*$/i',$email))
                                {
                                        showjsmsg($sitelang['err-email']);
                                }
                                $userid=$memberobj->getuseridbyemail($email);
                                if($userid)
                                {
                                        $password=mt_rand(100000,999999);
                                        $memberobj->set($userid,array('password'=>$password));
                                        if(UC_OPEN)
                                        {
                                                $info=$memberobj->getbase($userid);
                                                $action='editpwd';
                                                $username=$info['username'];
                                                $old_password=''; 
                                                $new_password=$password;
                                                $email=$info['email'];
                                                require_once SYSTEM_ROOT.'api/passport_server_ucenter.php';             
                                        }
                                        $site_name=$LA['sitename'];
                                        $site_url=$LA['siteurl'];
                                        $desc='您的登录密码已经重置为：'.$password.'，请尽快登录修改您的密码：<br />';
                                        $emailbody=stripslashes(file_get_contents(SYSTEM_ROOT.'template/email/email.html'));
                                        $emailbody=str_replace('{$site_name}',$site_name,$emailbody);
                                        $emailbody=str_replace('{$site_url}',$site_url,$emailbody);
                                        $emailbody=str_replace('{$username}',$site_name.'用户',$emailbody);
                                        $emailbody=str_replace('{$email}',$email,$emailbody);
                                        $emailbody=str_replace('{$desc}',$desc,$emailbody);
                                        $emailbody=str_replace('{$url}',$LA['siteurl'].'member/index.php?file=login&action=login',$emailbody);
                                        require_once SYSTEM_ROOT.'include/email.class.php';
                                        $emailobj=new email();
                                        $emailobj->set($LA['mail_server'], $LA['mail_port'], $LA['mail_user'], $LA['mail_pwd'], $LA['mail_type']);
                                        $emailobj->send($email, $LA['sitename'].'- 找回密码', $emailbody, $LA['mail_user']);
                                        showjsmsg('新密码已经发送到您的邮箱，请查收后登录！');
                                }
                                else
                                {
                                        showjsmsg('该邮箱尚未注册或不存在！');
                                }
                        }

case 'login':
			if($_userid)
			{
				header("location:".LA_PATH.'member/index.php');exit();
			}
			$captcha_open=explode(",",$LA['captcha_open']);
			$captquetion_open=explode(",",$LA['captquetion_open']);
			if(isset($do_submit))
			{
				if(in_array(2,$captcha_open) && $_POST['inputcheckcode']!=$_SESSION['captcha'])
				{
					showjsmsg('ÑéÖ¤ÂëÊäÈë²»ÕýÈ·£¡');
				}
				if(!preg_match('/^[\x80-\xff_a-zA-Z0-9]{1,64}$/i',$account) && !preg_match('/^\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*$/i',$account))
				{
					showjsmsg('µÇ½Õ˺Ų»´æÔÚ£¡');
				}
				if(preg_match('/[\x80-\xff]/i',$password))
				{
					showjsmsg('µÇ½ÃÜÂë²»ÕýÈ·£¡');
				}
				
				$info['username']=strpos($account,'@')?'':$account;
				$info['email']=strpos($account,'@')?$account:'';
				$uccode='';
				if(UC_OPEN)
				{
					require_once SYSTEM_ROOT.'api/passport_server_ucenter.php';
					$db=new mysql();
					$db->connect(LA_HOST,LA_USER,LA_PSW,LA_NAME,LA_PCONNECT,LA_CHARSET);
				}
				$userid=$memberobj->getuserid($account);
				if(!$userid)
				{
					$userid=$memberobj->getuseridbyemail($account);
				}
				if(!$userid)
				{
					showjsmsg('µÇ½Õ˺Ų»´æÔÚ£¡');
				}
				$info=$memberobj->get($userid);
				if($info['password']!=md5($password) || !$info)
				{
					showjsmsg('µÇ½ÃÜÂë²»ÕýÈ·£¡');
				}
				
				$u=array();
				$u['logintime']=TIME;
				$u['loginip']=IP;
				if($info['expire']<TIME)
				{
					$u['gradeid']=3;
				}
				
				$memberobj->set($userid,$u);
				$la_auth_key=md5(AUTH_KEY.$_SERVER['HTTP_USER_AGENT']);
				$la_auth=la_auth($userid."\t".md5($password),'ENCODE',$la_auth_key);
				set_cookie('auth',$la_auth,0);
				
				if($refer)
				{
					exit($uccode.'<script language="javascript">top.location.href="'.$refer.'";</script>');
				}
				else
				{
					exit($uccode.'<script language="javascript">top.location.href="'.LA_PATH.'member/index.php?file=user&action=complete";</script>');
				}
			}
			else
			{
				include member_tlp('login');
				break;
			}