From dafc3b76ea4e531adc62977184a6cb1708e46f1c Mon Sep 17 00:00:00 2001
From: Skylar Ittner <admin@netsyms.com>
Date: Thu, 24 May 2018 19:52:21 -0600
Subject: [PATCH 1/3] Add message if user is kicked out of application for lack
 of permissions

---
 index.php      | 7 +++++--
 lang/en_us.php | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/index.php b/index.php
index d7803d0..7240111 100644
--- a/index.php
+++ b/index.php
@@ -1,5 +1,4 @@
 <?php
-
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -9,10 +8,14 @@ require_once __DIR__ . "/required.php";
 require_once __DIR__ . "/lib/login.php";
 
 // if we're logged in, we don't need to be here.
-if ($_SESSION['loggedin']) {
+if ($_SESSION['loggedin'] && !isset($_GET['permissionerror'])) {
     header('Location: app.php');
 }
 
+if (isset($_GET['permissionerror'])) {
+    $alert = lang("no permission", false);
+}
+
 /* Authenticate user */
 $userpass_ok = false;
 $multiauth = false;
diff --git a/lang/en_us.php b/lang/en_us.php
index f4d5ddd..2bbe6a2 100644
--- a/lang/en_us.php
+++ b/lang/en_us.php
@@ -28,6 +28,7 @@ define("STRINGS", [
     "login server error" => "The login server returned an error: {arg}",
     "login server user data error" => "The login server refused to provide account information.  Try again or contact technical support.",
     "captcha error" => "There was a problem with the CAPTCHA (robot test).  Try again.",
+    "no permission" => "You don't have permission to do that.",
     "home" => "Home",
     "more" => "More",
     "test" => "Test"

From 66fa86e04e72ebeab3871ae0e453c32383988557 Mon Sep 17 00:00:00 2001
From: Skylar Ittner <admin@netsyms.com>
Date: Thu, 24 May 2018 19:53:26 -0600
Subject: [PATCH 2/3] Change string

---
 index.php      | 2 +-
 lang/en_us.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.php b/index.php
index 7240111..b61af9b 100644
--- a/index.php
+++ b/index.php
@@ -13,7 +13,7 @@ if ($_SESSION['loggedin'] && !isset($_GET['permissionerror'])) {
 }
 
 if (isset($_GET['permissionerror'])) {
-    $alert = lang("no permission", false);
+    $alert = lang("no access permission", false);
 }
 
 /* Authenticate user */
diff --git a/lang/en_us.php b/lang/en_us.php
index 2bbe6a2..f87c6a1 100644
--- a/lang/en_us.php
+++ b/lang/en_us.php
@@ -28,7 +28,7 @@ define("STRINGS", [
     "login server error" => "The login server returned an error: {arg}",
     "login server user data error" => "The login server refused to provide account information.  Try again or contact technical support.",
     "captcha error" => "There was a problem with the CAPTCHA (robot test).  Try again.",
-    "no permission" => "You don't have permission to do that.",
+    "no access permission" => "You do not have permission to access this system.",
     "home" => "Home",
     "more" => "More",
     "test" => "Test"

From ee0c0f65e3c143b7c038ef7b08552cbe9fc829b8 Mon Sep 17 00:00:00 2001
From: Skylar Ittner <admin@netsyms.com>
Date: Sat, 26 May 2018 20:51:13 -0600
Subject: [PATCH 3/3] Fix PHP variable warnings

---
 index.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/index.php b/index.php
index b61af9b..59a8242 100644
--- a/index.php
+++ b/index.php
@@ -8,7 +8,7 @@ require_once __DIR__ . "/required.php";
 require_once __DIR__ . "/lib/login.php";
 
 // if we're logged in, we don't need to be here.
-if ($_SESSION['loggedin'] && !isset($_GET['permissionerror'])) {
+if (!empty($_SESSION['loggedin']) && $_SESSION['loggedin'] === true && !isset($_GET['permissionerror'])) {
     header('Location: app.php');
 }
 
@@ -20,7 +20,7 @@ if (isset($_GET['permissionerror'])) {
 $userpass_ok = false;
 $multiauth = false;
 if (checkLoginServer()) {
-    if ($VARS['progress'] == "1") {
+    if (!empty($VARS['progress']) && $VARS['progress'] == "1") {
         if (!CAPTCHA_ENABLED || (CAPTCHA_ENABLED && verifyCaptcheck($VARS['captcheck_session_code'], $VARS['captcheck_selected_answer'], CAPTCHA_SERVER . "/api.php"))) {
             $errmsg = "";
             if (authenticate_user($VARS['username'], $VARS['password'], $errmsg)) {
@@ -61,7 +61,7 @@ if (checkLoginServer()) {
         } else {
             $alert = lang("captcha error", false);
         }
-    } else if ($VARS['progress'] == "2") {
+    } else if (!empty($VARS['progress']) && $VARS['progress'] == "2") {
         if ($_SESSION['passok'] !== true) {
             // stop logins using only username and authcode
             sendError("Password integrity check failed!");
@@ -117,7 +117,7 @@ header("Link: <static/js/bootstrap.min.js>; rel=preload; as=script", false);
                     <h5 class="card-title"><?php lang("sign in"); ?></h5>
                     <form action="" method="POST">
                         <?php
-                        if (!is_empty($alert)) {
+                        if (!empty($alert)) {
                             ?>
                             <div class="alert alert-danger">
                                 <i class="fa fa-fw fa-exclamation-triangle"></i> <?php echo $alert; ?>