bug #80

includes/account.php

@@ -2205,6 +2205,15 @@
 		mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'");
 	}
 
+	if($id == 43 && $_REQUEST['locked'] > 0)
+	{
+		$memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
+		$query = "select * from `users` where `id`='$memid'";
+		$row = mysql_fetch_assoc(mysql_query($query));
+		$ver = !$row['locked'];
+		mysql_query("update `users` set `locked`='$ver' where `id`='$memid'");
+	}
+
 	if($id == 43 && $_REQUEST['codesign'] > 0)
 	{
 		$memid = $_REQUEST['userid'] = intval($_REQUEST['codesign']);

includes/loggedin.php

@@ -29,12 +29,15 @@
 		}
 
 		$_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$uid'"));
-		$_SESSION['profile']['loggedin'] = 1;
+		if($_SESSION['profile']['locked'] == 0)
+			$_SESSION['profile']['loggedin'] = 1;
+		else
+			unset($_SESSION['profile']);
 	}
   
 	if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] == 0 || $_SESSION['profile']['loggedin'] == 0))
 	{
-		$query = "select * from `emailcerts` where `serial`='$_SERVER[SSL_CLIENT_M_SERIAL]' and `revoked`=0 and
+		$query = "select * from `emailcerts` where `serial`='${_SERVER['SSL_CLIENT_M_SERIAL']}' and `revoked`=0 and
 				UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() > 0";
 		$res = mysql_query($query);
 		if(mysql_num_rows($res) > 0)
@@ -54,7 +57,10 @@
 			}
 
 			$_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$row['memid']."'"));
-			$_SESSION['profile']['loggedin'] = 1;
+			if($_SESSION['profile']['locked'] == 0)
+				$_SESSION['profile']['loggedin'] = 1;
+			else
+				unset($_SESSION['profile']);
 		} else {
 			$_SESSION['profile']['loggedin'] = 0;
 			$_SESSION['profile'] = "";

pages/account/43.php

@@ -141,6 +141,10 @@
     <input type="text" name="year" value="<?=$year?>" size="4">
     <input type="submit" value="Go"></form></nobr></td>
   </tr>
+  <tr>
+    <td class="DataTD"><?=_("Account Locking")?>:</td>
+    <td class="DataTD"><a href="account.php?id=43&locked=<?=$row['id']?>"><?=$row['locked']?></a></td>
+  </tr>
   <tr>
     <td class="DataTD"><?=_("Code Signing")?>:</td>
     <td class="DataTD"><a href="account.php?id=43&codesign=<?=$row['id']?>"><?=$row['codesign']?></a></td>