Advanced Login System - v0.03 Beta

Official Documentation

Contents

 

About

Script Version

Script Name: Advanced Login System (ALS)
Version: v0.03B Final
Build: 20091220

Development Team

Main Developer: Wu Xiao Tian
Website: http://www.wuxiaotian.com
Contact Email: me@wuxiaotian.com

Back To Top

 

Introduction

Thank you for downloading Advanced Login System

For those who are first time users of this script, ALS (Advanced Login System) basically locks up private web pages which you do not want the general public to access. However, what sets it apart from other similar login scripts is that not only does it has advanced features, such as CAPTCHA images and brute force protection which are more commonly seen in commerical scripts, but also the flexibility of smaller scripts. This combination is what makes Advanced Login System special.

For returning users, who have been with me since the second beta release or even the very first beta release, welcome to the third Beta release, which has completely revolutionised the ALS script. New protection methods, more efficient code and greater flexibility awaits you, on top of an even more stable platform. Special emphasis has been placed on greatly improving the security of the system, and many new security measures are mentioned in the changelog below.

It is also with great pleasure that I announce that this will be the final Beta release. I believe that over the course of 3 years, Advanced Login System has matured enough to be released as a final product. Compared to the very first Beta, or even the second Beta, the third Beta is a remarkable leap in terms of stability, security and pretty much every other aspect. Hence, be prepared to be awed by the new features of the third Beta, the most stable and reliable release yet.

For a full list of new features, please refer to the changelog below.

Back To Top

 

Changelog

v0.03B Preview 2

v0.03B Preview

v0.02B

Back To Top

 

Installation Instructions

Minimum Requirements

Installation Instructions

Upgrade

Right now, the installer function does not provide any upgrade function, but you should be able to use the installer to upgrade your Second Beta and your third Beta Preview without any major issues. This is because the database design has not been changed since v0.03 Beta Preview, where I added a new database table, which can be installed on top of the second beta by using the provided installer. However, the upgrade function is not officially supported.

Back To Top

 

Installation Notes and FAQ
MySQL Configuration Settings Other Configuration Settings

Back To Top

 

Post Installation Instructions

How to protect your pages

Place the following chunk of code at the beginning of the page you want to protect:

<?php
session_start();
ob_start();
include ("als.php");
ob_end_flush(); ?>

Note that the page you want to protect must have a .php file extension or any other extension that your server will parse as PHP code.

Logout/Change Password

Disabled Public Registration

To disable registration by the public, you need to turn the $allow_guest_to_register setting in config.php to FALSE.

Even with disabled public registration, you can add users by accessing register.php and logging in with your MySQL username and password. Once logged in, you can add users by filling out the registration form.

Updating the script

To automatically check for updates, you need to set the $updatechecking variable to TRUE and ensure that the allow_url_fopen setting in php.ini is turned on. (Ask your server administrator about this). During installation, if the script detects that the setting is turned off, it would display a warning message. You are then recommended to check my website for updates regularly.

There are 2 types of updates - Critical and Non-Critical. Critical updates are usually security patches or version upgrades and you are recommended to update your system immediately. In the case of a critical update, the script will be terminated from running to protect any sensitive data. Non-critical updates are usually reserved for bug fixes that are not related to the integrity of the system. While the script will still run as per normal, you are advised to patch your system immediately.

Back To Top

 

Copyright and Terms of Use
Copyright

All parts of this script are copyrighted to Wu Xiao Tian and iQuest Studios. No redistribution, copying or another form of tranmission, via electronic or non-electronic means, of any part of the code in this script is allowed, unless with written permission from the script author (Wu Xiao Tian).

Terms of Use

By downloading the script from the iQuest Studios server, you agree to the following terms of usage.

YOU ARE NOT ALLOWED TO REDISTRIBUTE ANY PART OF THE SOURCE CODE NOR ARE YOU ALLOWED TO REMOVE THE COPYRIGHT FROM ANY OF THE FILES IN ADVANCED LOGIN SYSTEM OR EDIT IT IN ANY WAY THAT CHANGES ITS ORIGINAL MEANING. THE COPYRIGHT MUST BE DISPLAYED CLEARLY ON ALL THE PAGES AT ALL TIMES.

Disclaimer

Although this script has been tested extensively, there may be security bugs and system instability in the script. Hence, by downloading this script, you agree to use the script at your own risk. iQuest Studios and the script author will NOT be held responsible for any loss in any form arising from the use of this script.

Back To Top

 

Source Code Purchase/Donations
Source Code Purchase

Due to past violation of copyright incidents, I have decided to encode the script so as to make it more difficult to remove the copyright. However, if your server does not have Zend Optimizer installed, or you cannot run the script for some reason, or you simply want to take a look into the source code, you can purchase the unencoded version for USD$20 (payment via Paypal only). For this amount, you will also recieve unencoded updates to the script version you purchased. Upon receipt of your payment, I will email you the unencoded version as soon as possible. However, please note that:

Click the button below to make the purchase:
Donations

If you like my work and would like to show support for my effort, you are more than welcome to donate to me. These donations will help with my economic burden and let me spend more time developing free scripts for everyone. Click the button below to donate:

Back To Top

 

Themes Introduction

To allow for much easier design customization and integration, I have added a themes feature to ALS in this version. ALS themes allows you to integrate the login system into any existing site design with just some simple tweaking of CSS stylesheets. ALS themes are also designed to work with the new Integrated Contact Form (v0.06B and above), which I am still working on now, so it will be really easy to integrate both scripts into your current site design.

Creating your theme isn't hard at all, as long as you have some basic CSS knowledge. You can take a look at the included themes to understand which class is which, and then you should be pretty much ready to create your own theme for ALS. You can also read this guide to get some basic idea of themes, and get started from there.

A theme consists of a folder, which is placed in alssystem/themes. The folder name should be the theme name, which will be the value you set for the $theme variable in config.php. The theme name should not have any spaces, and special characters should be avoided, due to the way different browsers interpret the CSS stylesheet linking code. Inside the theme folder, you should have a CSS file named alsstyle-theme.css where theme is the theme name. So for example, we got a theme named "redblack", then there should be a folder called redblack in the alssystem/themes folder. Inside the redblack folder, there should be a file named alsstyle-redblack.css. Simple right?

Well, another cool thing about themes is that you can add custom images to various pages, (eg. the login page and the registration page.) To add images to your theme, place a images folder inside your theme folder, and place the images inside that folder. However, a few rules is that the image name must be equal to the file name. (eg. the image to be displayed on the login page [login.php] has to be named login.png). Also, the image MUST be a png file. Also note that the image will always be aligned to the right of the table.

Back To Top

 

Customizing/Creating themes

Theme customization/creation is mainly about the tweaking of the CSS values of the various classes defined in the login system by me. Hence, a simple change in say the value of the background color can produce a very different feel. This section aims to get you familiarized with the various CSS classes in the script.

Back To Top

 

Footnotes

To quickly switch themes without editing config.php in development mode, just add a ?settheme=theme to the end of the URL, where theme is the theme name.

Note that this is the first version of ALS featuring themes support, so it may not be flexible enough to fully customize the layout of the page. However, this is something I am working on and I would value all feedback from developers.

If you have any queries, feel free to contact me.

Back To Top

 

Language Files Introduction

This is the first version of Advanced Login System that has support for different languages. Due to rising popularity of this script, I have decided to include language files in this version, so as to cater to those who are non-English speakers or non-native English speakers in the international community. Hence, these users can now use ALS in their own native languages without having to open up the login files and trying to figure which parts of the code to edit. Even for native English speakers, you can use the language files to customize text on the script without having to edit the files manually.

Language file names should come in the format of alslang-language.php where language is the name of the language. All languages files should also be placed in the alssystem/languages subfolder.

Back To Top

 

Creating Language Files

Creating a language file is easy. You can easily start off by looking into the english language file. All of the text are defined as constants, in the form of define ("CONSTANTNAME","Text to be displayed");. This guide will serve to familiarize you with the various constants I have used.

For the login page [login.php], we have:

For the various messages that will be displayed after the form is processed [login.php], we have:

When the user logouts

For the registration page [register.php], we have:

For the account activation page [register.php?activate=1]:

For the various messages that will be displayed after the registration form has been processed [register.php]:

For the messages that will be displayed upon activation:

For closed registration forms:

For the password reset page [reset.php], we have:

For the PIN entry form [reset.php?enterpin=1]:

For the various messages generated by the reset password script:

For the change password page [changepass.php], we have:

And for the various messages displayed after processing:

Back To Top

 

Other Important Notes

Note that those constants documented here are subject to change across different versions. As such, you are required to define the minimum compatible version in the language file as well. This is done by writing $requiredver = "build number"; at the beginning of the file. For files following this document, the build number should be 20081126.

If you have any queries or feedback, feel free to contact me.

Back To Top

 

Development Mode Introduction

The development mode was first introduced in v0.03B Preview 1 to facilitate testing during the coding process. From there, I have expanded the development mode so that all developers can make use of the features while developing for ALS, be it themes, language files or modules (which will be introduced in the next version). To enable development mode, you need to set the $development setting under config.php to TRUE. However, note that in development mode, many security features are turned off, and hence, you are strongly discouraged from running development mode on a public server.

Besides the development mode, this section will also cover some of the other functions that I have created that you can use in your own ALS-protected website.

Back To Top

 

The Development Mode

In development mode, you can enable certain features by passing certain parameters through the URL like this: http://www.mysite.com/als/login.php?parameter. Below details some of the parameters that are made available in the development mode. Many of the script's processes are also displayed as HTML comments viewable in the source code.

Debugging

In development mode, you can easily identify the sources of error and submit a support request through my site. When development mode is enabled, all MySQL queries executed will be displayed as HTML comments, which is viewable in the source code. This is very helpful for identifying the query that is causing any problems. However, this may pose a security risk as malicious users can easily view the queries that are being ran through the system and discover potential loopholes in the system.

However, if you want to disable this feature during your session, pass disablecomments=1 through the URL.

Themes

In development mode, you can switch themes on the fly simply by passing settheme=theme name through the URL. You can also test how your theme looks like in the installer by passing forceinstall=1 into the URL.

Other URL Parameters

There are a number of other parameters that you can pass through which may not be very useful, but are mentioned here just in case there is a need for them.

Security Notes

In development mode, the brute force protection period is cut down to only 20 seconds. While this might be useful to test certain features, it will pose a security risk on a public server.

Also, in development mode, the script will ignore the existence of the alssystem/install subfolder. This is another security loophole as malicious users may run the installation script without your knowledge.

Once again, YOU ARE STRONGLY DISCOURAGED FROM TURNING ON DEVELOPMENT MODE ON PUBLIC SERVERS

Back To Top

 

Built In Functions

There are also a few functions that you can use for your ALS-protected pages. Remember to use the require(recommended) or the include function to include the file functions.php in the alssystem directory.

check_login()

This is the function that will check if the user is logged in for all the protected pages. This function is already included in als.php, so there is no need to add it to pages that include that file. There are no parameters to pass through.

print_user()

This will print the username of the user that is currently logged in. There are no parameters to pass through.

logout()

Declare this function to log the user out. Nothing will happen if the user is not logged in. There are no parameters to pass through.

lastip()

This will return the value of the last IP address where the user logged out. Note, to display the value, you would need to use the print or echo function. (eg. echo lastip();) There are no parameters to pass through.

session_auto_expire()

This function will cause the user session to automatically expire after a set amount of time defined in config.php. (Ignored if the setting is turned off). Note that this function is already declared in als.php, so any pages that include that file will automatically have session expiry. There are no parameters to pass through.

captcha_expire()

This function will cause the CAPTCHA image code to automatically expire after a set amount of time defined in config.php. (Ignored if the setting is turned off). There are no parameters to pass through.

print_error($errorheader,$errorsteps,$killscript)

This is the function that prints out script execution errors. It includes the following parameters:

Usage example: print_error("MySQL Error! ".mysql_error(),"turn on development mode and check the last MySQL query","1");

alert($content)

Use this to display a Javascript alert. It includes the following parameters:

Usage example: alert ("Hi, this is an alert!");

check_email_address($email)

This is the function used to validate email addresses. With a valid email address, it will return TRUE. It includes the following parameters:

Usage example: check_email_address ("you@gmail.com");

aes_encrypt($input)

This is the function used to encrypt input with AES protection. The key for encryption is defined in $session_key under config.php. It includes the following parameters:

Usage example: aes_encrypt ("Hello World");

aes_decrypt($input)

This is the function used to decrypt input that was encrypted with the aes_encrypt function. It includes the following parameters:

Usage example: aes_decrypt ("sdfasdfkspodt0934upsiodjgfse8dterptp0u4590euf");

Back To Top

 

© iQuest Studios