Add support for view-only mode.

[patchfork.git] / player / login.php

diff --git a/player/login.php b/player/login.php
index 4ad58e281820eb90c6346d2abe112dfdd09bc126..84b1122229fac669cf9c3be12292c72589c4539e 100644 (file)
--- a/player/login.php
+++ b/player/login.php
@@ -19,24 +19,38 @@
        $error = false;
        $no_require_login = "true";
        require_once("../inc/base.php");
-       if(isset($_POST['password'])) {
+       if(isset($_POST['password']) && $_POST['password'] != "") {
                $pass = get_config("login_pass");
                if(substr($pass,0, 4)=="sha:") {
                        if(check_hash($pass, trim($_POST['password']))) {
-                               $_SESSION['logged_in'] = true;
+                               $_SESSION['logged_in'] = "rw";
                                header("Location: index.php");
                                exit(); 
                        }
                        $error = "Login failed";
                }
                else if($pass==trim($_POST['password'])) {
-                       $_SESSION['logged_in'] = true;
+                       $_SESSION['logged_in'] = "rw";
                        header("Location: index.php");
                        exit(); 
                }
-               else {
+               
+               $pass = get_config("ro_pass");
+               if(substr($pass,0, 4)=="sha:") {
+                       if(check_hash($pass, trim($_POST['password']))) {
+                               $_SESSION['logged_in'] = "ro";
+                               header("Location: index.php");
+                               exit(); 
+                       }
                        $error = "Login failed";
                }
+               else if($pass==trim($_POST['password'])) {
+                       $_SESSION['logged_in'] = "ro";
+                       header("Location: index.php");
+                       exit(); 
+               }
+
+               $error = "Login failed";
        }
        else if(isset($_GET['logout'])) {
                session_destroy();