ck_hticket.i

<?php

    // Default values for the Cookie information
    // Set some default values
    //$TicketExpires=1800;                            //Lifespan of cookie
    //$TicketDomain = ".homecu.net";
    //$TicketDomain = $_SERVER['SERVER_NAME'];
    $staleafter=0;

    // include ('rebkck.php');

    function ReturnAddress () {
        //global $TicketDomain;
        global $SYSENV;
        global $https_or_http;
        
        // Called when the cookie is missing, expired, or damaged.  Sets return address
        // to the name of the current script so cu_login knows where to go afterwards.

        // print "https://" . $_SERVER['SERVER_NAME'] .  $_SERVER['PHP_SELF'] . "?" . urlencode($_SERVER['QUERY_STRING']);
        // setcookie("Tx_hURI", $https_or_http . "://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?" . urlencode($_SERVER['QUERY_STRING']), time() + 86400, "/", $TicketDomain, 1);
        HCU_setcookie_env($SYSENV, "Tx_hURI", $https_or_http . "://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?" . urlencode($_SERVER['QUERY_STRING']), time() + 86400);
    }
    // Validate Ticket
    $result = 1;
    if (empty($_COOKIE['HCUTicket'])) {
        $result = 0;   // No 

    } else {
        $ticket = $_COOKIE['HCUTicket'];

        // parse_str puts all the cookie values as variables in this script. So now I
        // have variabls $Cu, $Cn, $Cip, etc., corresponding to everything I put in
        // the Ticket cookie.
        parse_str($ticket);
        if ($Ce < time()) {
            $result = 0;  // Ticket has expired
        }

        if (is_null($Hu) || is_null($Ctime) || is_null($Ch) || is_null ($Clu) || is_null($Ce)) {
            $result = 0;   //Partial ticket, try again
        }

        $secret = 'xoiilh6RFoogeMb4';

        // Everytime we have a successful check on the cookie we should try and reset the cookie
        // with the new current time.  This way the user is timed out based on idle status rather than
        // Session  time length.

    /* -- VARIABLES in cookie
                Hu - HomeCu User
                Ce - Cookie Expires Time
                Ctime - Time cookie was made
                Ch - Cookie Hashed value
                Clu - Lastupdate time
    */
  /* print ("
                Ctime - $Ctime<br>
                Ce - $Ce<br>
                Hu - $Hu<br>
                <br>check ticket "); */
        if ($Ch != MD5($secret .  MD5(join (':', array($secret, $Ctime, $Ce, $Hu, $Clu))))) {
            $result = 0;   // hash doesn't match, someone is hacking
        }
/*
        if ($Cip !=  $_SERVER['REMOTE_ADDR']) {
            $result = 0;  // Different IP -- not good.
        }
*/

    }
    // apache_note sets variables for web server logging.  Used later to split
    // web logfiles by credit union

    // for debugging on concept-vm; put back later 2016.07.05
    // apache_note(user_name,"M${Cid}:${Cn}");

    if (! $result) {
        // if any of the cookie tests failed set the return address, redirect to login,
        // and then exit so the rest of the current script doesn't get executed.

        ReturnAddress();

        header("Location: $menu_link/hcu_login.prg?" . $_SERVER['QUERY_STRING']);
        exit;
//  } else {
        // Everything was okay we have a result other than 0, so I want to setup a variable to be the teps array
    }
?>