Thanks FishMonger, I'll do that if I have to post another question.
Yes, when logging in, the iframe is populated with a perl file, which links to a series of perl files all of which load into the iframe. They are for different aspects of the CMS.
your (amended by me) login code. Still seems to work well
#!/usr/bin/perl
use CGI::Carp qw(fatalsToBrowser);
use strict;
use CGI qw(:all);
use CGI::Session;
use Crypt::PasswdMD5;
use DBI;
use lib '/var/www/vhosts/mydomain/cgi-bin/';
my $cgi = new CGI;
my $self = $cgi->url;
my %login = $cgi->Vars;
my $session = new CGI::Session($cgi) or die CGI::Session->errstr;
if ( $login{'logout'} || ! $session->param('logged_in') ) {
$session->clear;
$session->delete();
}
my ($authenticated, $StoredUserName, $Client_Full_Details) = authenticate_user() if $cgi->param('Login');
($authenticated || $session->param('logged_in') ) ? admin_page() : login();
#####################################################################
sub login {
require 'myheader.pm'; # appends my doctype and the first part of the 'head' section.
require 'myheadCloserForLogin.pm'; # closes the head section. (remember, other scripts have JS portions to include in the 'head' section, hence two header files here(three or four in the other files).
print $cgi->h3("Login & Administration").$/,
$cgi->start_form(-name=>'login'),
'<p>Username: ', $cgi->textfield('username'), "<br>\n",
'Password: ', $cgi->password_field('password', ''), "</p>\n",
'<p>', $cgi->submit('Login', 'Login'), "</p>\n";
#$cgi->end_form;
print qq(</form>);
print $login{'failed'} if defined $login{'failed'};
print $cgi->end_html;
}
sub authenticate_user {
if ( defined $login{'username'} && defined $login{'password'} ) {
my ($Customer_ID, $StoredUserName, $encrypted_pass, $Client_Full_Details) = queryDB($login{'username'});
if ($encrypted_pass) {
my $salt = substr($encrypted_pass, 3,8);
my $password = unix_md5_crypt( $login{'password'}, $salt );
if ( $password eq $encrypted_pass ) {
$session->param('logged_in', 1);
$session->param('admin', $StoredUserName);
return (1, $StoredUserName, $Client_Full_Details);
}
}
}
$login{'failed'} = 'Invalid username, or password...Please try again';
return 0;
} # end of sub
sub admin_page {
my ($baseBusinessName, $baseBusinessType, $baseBusinessSubType, $baseBusinessCat, $baseBusinessLocalRegion, $baseBusinessCounty, $baseBusinessGrid, $baseBusinessPostCode, $groupName, $TIC, $baseBusinessSubscriptionStatus, $parentBusinessType, $parentgroupBusinessName) = split /\_/, $Client_Full_Details, 14;
my $baseBusinessNameDeHyphenated = $baseBusinessName;
$baseBusinessNameDeHyphenated =~ s/-/ /g;
#my $search = 'search.pl';
#my $add = 'add.pl';
#my $delete = 'delete.pl';
#my $modify = "modify.pl?admin=$login{'username'}"; # change this to use a session param
#my $chgIMAPpass = 'chgIMAPpass.pl';
#################
##print $session->header(),
#$cgi->start_html( -title=>"Email Administration",
#-style=>{-src=>'/emadmin.css'}
#);
require 'myHeader.pm'; # puts my header logo at the top of the iframe
$session->param('user', 'username');
print qq(
<div id="loginWelcome">
<p>Welcome:<strong>$StoredUserName</strong></p>
</div>);
print qq(
<div id="webmail"><a href="http://webmail.thechrissystem.com" target="main">Webmail</a></div>);
print $cgi->start_form(-name=>'logout'),
$cgi->submit('Logout'),$cgi->p,
$cgi->a({-href=>"chgpass.pl?user=$login{'username'}", -target=>"main"},
"Change My Password");
print qq(</form>\n);
print qq(<table border=0><tr><td></td>);
print $cgi->a({-href=>"$search", -target=>"main"}, "Search").'</td>';
print '</tr></table>';
print qq(<iframe id="iframe" name='main' src='index/$Client_Full_Details' width='100%' height='700'></iframe>);
print $cgi->end_html;
}
sub queryDB {
my $isodb = 'MainUserLogin';
my $isosrv = 'localhost';
my $isoser= 'myUserName';
my $isopass= 'myPasswd';
my $port = 'port';
my $user = shift;
my $dbh = DBI->connect("DBI:mysql:$isodb:$isosrv", $isouser, $isopass,
{'RaiseError' => 1, 'PrintError' => 0 })
or die "Connection Failed: $isodb DB on $isosrv\n\t$DBI::errstr\n";
my $sth = $dbh->prepare("SELECT Customer_ID, StoredUserName, StoredPassword, Client_Full_Details
FROM securityTable
WHERE StoredUserName = '$user' AND Status = 'active' ")
or die "prepare statement failed: $DBI::errstr\n";
$sth->execute;
my ($Customer_ID, $StoredUserName, $StoredPassword, $Client_Full_Details ) = $sth->fetchrow_array;
$sth->finish;
$dbh->disconnect;
return ($Customer_ID, $StoredUserName, $StoredPassword, $Client_Full_Details);
}
and here is the top part of the code in my index file (which loads into the iframe).
#!/usr/bin/perl -w
use CGI;
use Cwd;
use IO::Dir;
use CGI::Session;
use strict;
use CGI::Carp qw(fatalsToBrowser);
use lib '/var/www/vhosts/mydomain/cgi-bin/';
my $query = new CGI;
my $self = $query->url;
my %login = $query->Vars;
use CGI::Session;
#tried this but it (obviously) creates new session
#my $session = new CGI::Session($query) or die CGI::Session->errstr;
#
#if ( $login{'logout'} || ! $session->param('logged_in') ) {
# $session->clear;
# $session->delete();
#}
# then tried this :confused: as to why :(
# if ($query->param('Login')) { # if logged in print no header div
# print qq();
# } else { # if not logged redirect to login script
# print "Location:http://mydomain/cgi-bin/EazyEdit/CustomerLogin.pl\n\n";
# }
#finally this.
#my $session = new CGI::Session($query) or die CGI::Session->errstr;
#if (!$session) {
# print "Location:http://mydomain/cgi-bin/EazyEdit/CustomerLogin.pl\n\n";
#}
my $files;
require 'MyConfig.pm';
my $filesLocation = cmsFilesLocation($files);
my $Root = $ENV{"DOCUMENT_ROOT"};
my $Path = $ENV{"PATH_INFO"};
my $Referer = $ENV{"HTTP_REFERER"};
require 'mrTourismHeader.pm';
require 'headCloserForLogin.pm';
I am trying to add some code which not only, prevents the individual files from loading directly in the browser, but by a method which is equaly secure as the login script. My plan is to put that code into its own file and require it at the top, by all individual CMS files.
bazz