From 5645f54b6fe88ce2581348fd981f6619a72650f3 Mon Sep 17 00:00:00 2001
From: Roland Gruber <post@rolandgruber.de>
Date: Thu, 17 Apr 2003 19:29:21 +0000
Subject: [PATCH] fixed bugs: IV and key were created twice; cookies could only
 be accessed from templates-folder

now user is logged in with his username and password
---
 lam/templates/login.inc  | 9 +++++++--
 lam/templates/login.php  | 8 --------
 lam/templates/logout.php | 4 ++--
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/lam/templates/login.inc b/lam/templates/login.inc
index 4e8541f2..0f924b7a 100755
--- a/lam/templates/login.inc
+++ b/lam/templates/login.inc
@@ -22,9 +22,14 @@ $Id$
 
   LDAP Account Manager main login page.
 */
-?>
 
-<?
+// generate 256 bit key and initialization vector for user/passwd-encryption
+$key = mcrypt_create_iv(32, MCRYPT_DEV_RANDOM);
+$iv = mcrypt_create_iv(32, MCRYPT_DEV_RANDOM);
+
+// save both in cookie
+setcookie("Key", base64_encode($key), 0, "/");
+setcookie("IV", base64_encode($iv), 0, "/");
 
 // loading available languages from language.conf file
 
diff --git a/lam/templates/login.php b/lam/templates/login.php
index e9acfeef..d836c863 100644
--- a/lam/templates/login.php
+++ b/lam/templates/login.php
@@ -36,14 +36,6 @@ $session_save_path .= "/sess";
 
 session_save_path($session_save_path); // Set session save path
 @session_start(); // Start LDAP Account Manager session
-// generate 256 bit key and initialization vector for user/passwd-encryption
-$key = mcrypt_create_iv(32, MCRYPT_DEV_RANDOM);
-$iv = mcrypt_create_iv(32, MCRYPT_DEV_RANDOM);
-
-// save both in cookie
-setcookie("Key", base64_encode($key));
-setcookie("IV", base64_encode($iv));
-
 // checking if the submitted username/password is correct.
 if($action == "checklogin")
 {
diff --git a/lam/templates/logout.php b/lam/templates/logout.php
index 4895bc58..d883efa5 100644
--- a/lam/templates/logout.php
+++ b/lam/templates/logout.php
@@ -24,8 +24,8 @@ $Id$
 */
 
 // delete key and iv in cookie
-setcookie("Key", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
-setcookie("IV", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+setcookie("Key", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 0, "/");
+setcookie("IV", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 0, "/");
 
 include_once("../lib/ldap.php");