overhaul login flow and cookie handling. fix very bad permission error for editing and deleting posts.

1 files changed, 18 insertions, 9 deletions

diff --git a/index.php b/index.php
index 2ee1635..c0259c2 100644
--- a/index.php
+++ b/index.php
@@ -1,20 +1,29 @@
 <?php
 	require_once(__DIR__.DIRECTORY_SEPARATOR.'config.php');
 
+	// check user credentials
+	$config['logged_in'] = false;
+	$config['logged_in'] = check_login();
+
+	// subpages
 	if(is_numeric(path(0))) {
 		// show a single blog post
 		require_once(ROOT.DS.'single.inc.php');
+
 	} elseif(mb_strtolower(path(0)) === 'login') {
-			// show login form
-			require_once(ROOT.DS.'loginform.inc.php');
+		require_once(ROOT.DS.'loginform.inc.php');
+
+	} elseif(mb_strtolower(path(0)) === 'logout') {
+		$domain = ($_SERVER['HTTP_HOST'] != 'localhost') ? $_SERVER['HTTP_HOST'] : false;
+		setcookie('microblog_login', '', time()-3600, '/', $domain, false);
+		unset($_COOKIE['microblog_login']);
+
+		header('Location: '.$config['url']);
+		die();
+
 	} elseif(mb_strtolower(path(0)) === 'new') {
-		if(isset($_COOKIE['microblog_login']) && $_COOKIE['microblog_login'] === sha1($config['url'].$config['admin_pass'])) {
-			// show the post form
-			require_once(ROOT.DS.'postform.inc.php');
-		} else {
-			header('Location: '.$config['url'].'/login');
-			die();
-		}
+		require_once(ROOT.DS.'postform.inc.php');
+
 	} else {
 		// redirect everything else to the homepage
 		if(!empty(path(0)) && path(0) != 'page') {