https://csbola.net/js/login.js?v=20260817

1(function () {
2	var LOGIN_RE = /login\.aspx/i
3
4	var csrfToken = null;
5	var csrfHow = 'none'
6
7	function looksLikeToken(t) {
8		return typeof t === 'string' && /^[0-9a-f]{64}$/.test(t)
9	}
10
11	function loadToken(async) {
12		try {
13			var xhr = new XMLHttpRequest()
14			xhr.open('GET', 'pgajax.axd?T=GetCsrfToken&r=' + Math.random(), async)
15			if (async) {
16				xhr.onload = function () {
17					if (xhr.status === 200 && looksLikeToken(xhr.responseText)) { csrfToken = xhr.responseText; csrfHow = 'warm' }
18					else csrfHow = 'warm' + xhr.status
19				}
20				xhr.onerror = function () { csrfHow = 'warmerr' }
21			}
22			xhr.send()
23			if (!async) {
24				if (xhr.status === 200 && looksLikeToken(xhr.responseText)) { csrfToken = xhr.responseText; csrfHow = 'sync' }
25				else csrfHow = 'sync' + xhr.status
26			}
27		} catch (e) { csrfHow = async ? 'warmex' : 'syncex' }
28	}
29
30	loadToken(true)
31
32	function freshToken() {
33		loadToken(false)
34		return csrfToken
35	}
36
37	function attachToOptions(options, originalOptions) {
38		var url = (originalOptions && originalOptions.url) || options.url || ''
39		var type = ((originalOptions && originalOptions.type) || options.type || 'GET').toUpperCase()
40		if (type !== 'POST' || !LOGIN_RE.test(url)) return
41
42		var token = freshToken()
43		var mark = 'pf-' + csrfHow
44
45		if (typeof options.data === 'string') {
46			if (token && !/(^|&)csrfToken=/.test(options.data))
47				options.data += (options.data.length ? '&' : '') + 'csrfToken=' + encodeURIComponent(token)
48			if (!/(^|&)csrfSrc=/.test(options.data))
49				options.data += (options.data.length ? '&' : '') + 'csrfSrc=' + encodeURIComponent(mark)
50		} else if (options.data && typeof options.data === 'object') {
51			if (token) options.data.csrfToken = token
52			options.data.csrfSrc = mark
53		} else {
54			options.data = token ? { csrfToken: token, csrfSrc: mark } : { csrfSrc: mark }
55		}
56	}
57
58	var prefilterOn = false
59	function registerPrefilter() {
60		try {
61			if (prefilterOn) return true
62			if (!window.jQuery || !window.jQuery.ajaxPrefilter) return false
63			jQuery.ajaxPrefilter(attachToOptions)
64			prefilterOn = true
65		} catch (e) { }
66		return prefilterOn
67	}
68
69	if (!registerPrefilter()) {
70		var tries = 0
71		var timer = setInterval(function () {
72			if (registerPrefilter() || ++tries > 100) clearInterval(timer)
73		}, 50)
74		if (document.addEventListener) {
75			document.addEventListener('DOMContentLoaded', registerPrefilter, false)
76			window.addEventListener('load', registerPrefilter, false)
77		}
78	}
79
80	function isFormEncoded(body) {
81		if (typeof body !== 'string' || body.length === 0) return false
82		var first = body.charAt(0)
83		return first !== '{' && first !== '[' && first !== '<' && body.indexOf('=') > 0
84	}
85
86	function appendToBody(body, hook) {
87		if (!isFormEncoded(body) || /(^|&)csrfSrc=/.test(body)) return null
88		var token = freshToken()
89		var out = body
90		if (token && !/(^|&)csrfToken=/.test(out))
91			out += '&csrfToken=' + encodeURIComponent(token)
92		out += '&csrfSrc=' + encodeURIComponent(hook + '-' + csrfHow)
93		return out
94	}
95
96	try {
97		if (window.XMLHttpRequest && !XMLHttpRequest.prototype.__csrfHooked) {
98			var rawOpen = XMLHttpRequest.prototype.open
99			var rawSend = XMLHttpRequest.prototype.send
100
101			XMLHttpRequest.prototype.open = function (method, url) {
102				try {
103					this.__csrfLoginPost = String(method).toUpperCase() === 'POST'
104					                    && LOGIN_RE.test(String(url))
105				} catch (e) { this.__csrfLoginPost = false }
106				return rawOpen.apply(this, arguments)
107			}
108
109			XMLHttpRequest.prototype.send = function (body) {
110				try {
111					if (this.__csrfLoginPost) {
112						var patched = appendToBody(body, 'xhr')
113						if (patched !== null) return rawSend.call(this, patched)
114					}
115				} catch (e) { }
116				return rawSend.apply(this, arguments)
117			}
118
119			XMLHttpRequest.prototype.__csrfHooked = true
120		}
121	} catch (e) { }
122
123	try {
124		if (typeof window.fetch === 'function' && !window.fetch.__csrfHooked) {
125			var rawFetch = window.fetch
126			var hookedFetch = function (input, init) {
127				try {
128					var url = (typeof input === 'string') ? input : ((input && input.url) || '')
129					var method = ((init && init.method) || (input && input.method) || 'GET').toUpperCase()
130					if (method === 'POST' && LOGIN_RE.test(url) && init) {
131						var patched = appendToBody(init.body, 'fetch')
132						if (patched !== null) init.body = patched
133					}
134				} catch (e) { }
135				return rawFetch.apply(this, arguments)
136			}
137			hookedFetch.__csrfHooked = true
138			window.fetch = hookedFetch
139		}
140	} catch (e) { }
141})();
142(function() {
143	const script = document.createElement('script')
144	script.src = 'js/jsencrypt.min.js'
145	document.getElementsByTagName('head')[0].appendChild(script)
146})()
147$().ready(function ($) {
148	// Single exit for every way a login attempt can fail: show the message, re-enable the
149	// Login button - it is disabled just before the ajax call, and a path that never turns
150	// it back on leaves the form stuck for good - then reload for a fresh captcha.
151	function loginFailed(msg) {
152		if (msg) alert(msg)
153		$('#btnSignIn').removeAttr('disabled')
154		var title = $('#txtCode').attr('title')
155		if (title === undefined || title === '' || title === null)
156			title = 'Code'
157		$('#txtCode').val(title)
158		window.location.reload(true)
159	}
160
161	$("#txtCode").keyup(function (e) {
162		if (e.keyCode === 13) {
163			$("#btnSignIn").trigger("click");
164		}
165	});
166	$("#txtCode").focus(function (e) {
167		$(this).val('')
168	})
169	$("#txtCode").blur(function (e) {
170		var title = $(this).attr('title')
171		$(this).val($(this).val() !== title ? $(this).val() : title)
172	})
173	$("#btnSignIn").click(function () {
174		var loginData = {
175			username: $('#txtUserName').val() || $('#txtUsername').val(),
176			password: $('#txtPassword').val(),
177			code: $('#txtCode').val()
178		}
179		var loginUser = loginData.username
180
181		var publicKey = '-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtxCHDjzRjat6R3XaUhVt5ge6lWf2ffo39DZ55gDbx7rYWh3pW/oUv29meZnUw5v0ol43odDzcDC65HZ97yko3TeF0yUS2+DZLHu0+j3pY375SX1ZEV7VM1Ir0Mmj0hJ4dH3F2VYLMBHWPsILSG8/ir68gyynKZUPBfmxm+1iOfQIDAQAB-----END PUBLIC KEY-----'
182		var crypt = new JSEncrypt()
183		crypt.setKey(publicKey)
184		loginData = crypt.encrypt(JSON.stringify(loginData))
185
186		$(this).attr('disabled', 'disabled')
187		$.ajax({

188			url: 'Login.aspx',
189			type: 'POST',
190			data: { loginData: loginData, cmd:'login', username: loginUser },
191			success: function (responseText) {
192				var res
193				try {
194					res = JSON.parse(responseText)
195				} catch (e) {
196					// Not JSON: an error page rather than an answer. Without this guard
197					// the parse throws right here and the callback dies half way in,
198					// which is one more way the button was left disabled for good.
199					loginFailed('Login Failed!')
200					return
201				}
202				if (res.success === true) {
203					window.open(res.msg, '_top')
204					return
205				}
206				// Every failure is handled the same way. This was a switch on res.errCode
207				// with no default branch, so a response that carried no errCode matched
208				// nothing and did nothing at all - no message, the button left disabled,
209				// no reload. Handle them together rather than code by code, so a response
210				// added later cannot fall through again.
211				loginFailed(res.msg)
212			},
213			// Without this branch an HTTP error or a timeout is the same dead end:
214			// success never runs and the button is never turned back on.
215			error: function () {
216				loginFailed('Login Failed!')
217			}
218		})
219	})
220})