script php

<?php
# File: hotspotlogin.php
# last change 2004-08-20/19:22
# this is forked from original chillispot.org's hotspotlogin.cgi by Kanne

# Shared secret used to encrypt challenge with. Prevents dictionary attacks.
# You should change this to your own shared secret.
$uamsecret = "ht2eb8eghjjg4etnf34fhg1ulp";

# Uncomment the following line if you want to use ordinary user-password
# for radius authentication. Must be used together with $uamsecret.
$userpassword=1;

$loginpath = "hotspotlogin.php";

# possible Cases:   
# attempt to login             login=login
# 1: Login successful               res=success
# 2: Login failed               res=failed
# 3: Logged out                  res=logoff
# 4: Tried to login while already logged in  res=already
# 5: Popup                  res=popup
# 6: Not logged in yet                res=logon
# 0: It was not a form request            res=""

# input you might want to use
# $_GET["challenge"];
# $_GET[timeleft];
# $_GET[prelogin];
# $_GET["userurl"];
# $_GET["chal"];
# $_GET["reply"];
# $_GET["login"];
# $_GET["logout"];
# $_GET["prelogin"];

$titel = "Le Mans Sans Fil";
$headline = "";
$bodytext = "";
$body_onload = "";
$footer_text ="<center>
                <a href="http://www.hotspot-ruhr.de/hotspot/register.php">[register]</a>" . " " . "
                <a href="http://www.hotspot-ruhr.de/hotspot/rules.php">[terms and conditions]</a>" . " " . "
                <a href="http://www.hotspot-ruhr.de/hotspot/for_free.php">[do not register]</a>
               </center>";

# attempt to login
if ($_GET[login] == login) {
    $hexchal  = pack ("H32", $_GET[chal]);

    if (isset ($uamsecret)) {
   $newchal  = pack ("H*", md5($hexchal . $uamsecret));
    } else {
    $newchal  = $hexchal;
    }

    $response = md5("\0" . $_GET[pwd] . $newchal);
    $newpwd = pack("a32", $_GET[pwd]);
    $password = implode ("", unpack("H32", ($newpwd ^ $newchal)));

   $titel = "Logging in to HotSpot"; 
   $headline = "Logging in to HotSpot";
   $bodytext = ""; 

   print_header();

      if ((isset ($uamsecret)) & isset($userpassword)) {
   print "<meta http-equiv="refresh" content=0;url=http://$_GET[uamip]:$_GET[uamport]/logon?username=$_GET[uid]&password=$password>";
      } else {
    print "<meta http-equiv="refresh" content="0;url=http://$_GET[uamip]:$_GET[uamport]/logon?username=$_GET[uid]&response=$response">";
      }

   print_body();

   print_footer();
}

# 1: Login successful
if ($_GET["res"] == success) {

   $titel = "Logged in to HotSpot";
   $headline = "Logged in to HotSpot";
   $bodytext = "Welcome";
   $body_onload = "onLoad="javascript:popUp('$loginpath?res=popup&uamip=$_GET[uamip]&uamport=$_GET[uamport]&timeleft=$_GET[timeleft]')"";

   print_header();
#   print "<META HTTP-EQUIV="refresh" CONTENT="10;";printf(" URL=%s",$_GET[userurl]);print"">"; 
    print "
     <SCRIPT LANGUAGE="JavaScript">
       function popUp(URL) {
       date = new Date();
       time = date.getTime();
       eval("page" + time + " = window.open(URL, 'hotspotpopup', 'toolbar=0,scrollbars=0,location=0,statusbar=0,menubar=0,resizable=1,width=400,height=200');");
       }
     </script>";

   print_body();
   
      if ($reply) { 
      print "<center> $reply </BR></BR></center>";
      }

   print "<center><a href="http://$_GET[uamip]:$_GET[uamport]/logoff">Logout</a></center>";

   print_footer();
}

# 2: Login failed
if ($_GET["res"] == failed) {

   $titel = "HotSpot Login Failed";
   $headline = "HotSpot Login Failed";
   $bodytext = "Sorry, try again<br>";
   
   print_header();

   print_body();

    if ($_GET[reply]) {
   print "<center>$_GET[reply]</center>";
    }
   
   print_login_form();

   print_footer();
}

# 3: Logged out
if ($_GET["res"] == logoff) {

   $titel = "Logged out from HotSpot";
   $headline = "Logged out from HotSpot";
   $bodytext = "<a href="http://$_GET[uamip]:$_GET[uamport]/prelogin">Login</a>";
   
   print_header();

   print_body();

   print_footer();
}

# 4: Tried to login while already logged in
if ($_GET["res"] == already) {

   $titel = "Already logged in to HotSpot";
   $headline = "Already logged in to HotSpot";
   $bodytext = "<a href="http://$_GET[uamip]:$_GET[uamport]/logoff">Logout</a>";
   
   print_header();

   print_body();

   print_footer();
}


# 5: Popup
if ($_GET["res"] == popup) {

   $titel = "Logged in to HotSpot";
   $headline = "Logged in to HotSpot";
   $bodytext = "<a href="http://$_GET[uamip]:$_GET[uamport]/logoff">Logout</a>";
   
   print_header();

   print_body();
   
   print "<center>You have $_GET[timeleft] seconds for surfing the net...<center><br>";

   print_footer();
}

# 6: Not logged in yet
if ($_GET["res"] == logon) {

   $titel = "Logged out from HotSpot";
   $headline = "Logged out from HotSpot";
   $bodytext = "please log in<br>";
   
   print_header();

   print_body();

   print_login_form();

   print_footer();
}

# 0: It was not a form request
# Send out an error message
if ($_GET["res"] == "") {

   $titel = "What do you want here?";
   $headline = "HotSpot Login Failed";
   $bodytext = "Login must be performed through ChilliSpot daemon!";

   print_header();
   print_body();
   print_footer();
}

# functions

function print_header(){
 global $titel;
 print "
 <html>
  <head>
   <title>$titel</title>
    <meta http-equiv="Cache-control" content="no-cache">
    <meta http-equiv="Pragma" content="no-cache">
    <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">";
}

function print_body(){
 global $headline, $bodytext, $body_onload;
 
 print "
  </head>
  <body $body_onload>
   <h1 style="text-align: center;">$headline</h1>
   <center>$bodytext</center><br>";

# begin debugging
 print "
   <center>THE INPUT (for debugging):<br>";

     foreach ($_GET as $key => $value) {
      print "$key = $value <br>";
     }

 print "
   <br></center>";
# end debugging

}

function print_login_form(){
 global $loginpath;
 print "
  <FORM METHOD='get' action=" . $loginpath . "?" . ">
   <INPUT TYPE=HIDDEN NAME=chal VALUE=" . $_GET[challenge] . ">
   <INPUT TYPE=HIDDEN NAME=uamip VALUE=" . $_GET[uamip] . ">
   <INPUT TYPE=HIDDEN NAME=uamport VALUE=" . $_GET[uamport] . ">
   <center>
   <table border="0" cellpadding="5" cellspacing="0" style="width: 217px;">
    <tbody>
      <tr>
        <td align="right">Login:</td>
        <td><input type="text" name="uid" size="20" maxlength="255"></td>
      </tr>
      <tr>
        <td align="right">Password:</td>
        <td><input type="password" name="pwd" size="20" maxlength="255"></td>
      </tr>
      <tr>
        <td align="center" colspan="2" height="23"><input type=submit name=login value=" . "login" . "></td>
      </tr>
    </tbody>
   </table>
   </center>
  </form>";
}

function print_footer(){
 global $footer_text;
 print "$footer_text </body></html>";
 exit(0);
}

exit(0);
?>