Context Navigation

source: trunk/lib/Auth_SQL.inc.php @ 499

Last change on this file since 499 was 497, checked in by anonymous, 10 years ago
Beginning the process of adapting codebase to foundation styles.
File size: 50.1 KB

Rev	Line
[1]	1	<?php
	2	/**
[362]	3	* The Strangecode Codebase - a general application development framework for PHP
	4	* For details visit the project site: <http://trac.strangecode.com/codebase/>
[396]	5	* Copyright 2001-2012 Strangecode, LLC
[453]	6	*
[362]	7	* This file is part of The Strangecode Codebase.
[1]	8	*
[362]	9	* The Strangecode Codebase is free software: you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License as published by the
	11	* Free Software Foundation, either version 3 of the License, or (at your option)
	12	* any later version.
[453]	13	*
[362]	14	* The Strangecode Codebase is distributed in the hope that it will be useful, but
	15	* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	16	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
	17	* details.
[453]	18	*
[362]	19	* You should have received a copy of the GNU General Public License along with
	20	* The Strangecode Codebase. If not, see <http://www.gnu.org/licenses/>.
[1]	21	*/
	22
[362]	23	/*
	24	* The Auth_SQL class provides a SQL implementation for authentication.
	25	*
	26	* @author Quinn Comendant <quinn@strangecode.com>
	27	* @version 2.1
	28	*/
	29
[43]	30	require_once dirname(__FILE__) . '/Email.inc.php';
	31
[1]	32	class Auth_SQL {
[453]	33
[468]	34	// Available encryption types for class Auth_SQL.
	35	const ENCRYPT_PLAINTEXT = 1;
	36	const ENCRYPT_CRYPT = 2;
	37	const ENCRYPT_SHA1 = 3;
	38	const ENCRYPT_SHA1_HARDENED = 4;
	39	const ENCRYPT_MD5 = 5;
	40	const ENCRYPT_MD5_HARDENED = 6;
	41
[136]	42	// Namespace of this auth object.
[484]	43	protected $_ns;
[453]	44
[136]	45	// Static var for test.
[484]	46	protected $_authentication_tested;
[1]	47
[334]	48	// Parameters to be configured by setParam.
[484]	49	protected $_params = array();
	50	protected $_default_params = array(
[42]	51
[1]	52	// Automatically create table and verify columns. Better set to false after site launch.
[396]	53	// This value is overwritten by the $app->getParam('db_create_tables') setting if it is available.
[1]	54	'create_table' => true,
[42]	55
[1]	56	// The database table containing users to authenticate.
	57	'db_table' => 'user_tbl',
[42]	58
[1]	59	// The name of the primary key for the db_table.
	60	'db_primary_key' => 'user_id',
[42]	61
[1]	62	// The name of the username key for the db_table.
	63	'db_username_column' => 'username',
[42]	64
[1]	65	// If using the db_login_table feature, specify the db_login_table. The primary key must match the primary key for the db_table.
[14]	66	'db_login_table' => 'user_login_tbl',
[42]	67
[468]	68	// The type of encryption to use for passwords stored in the db_table. Use one of the Auth_SQL::ENCRYPT_* types specified above.
[136]	69	// Hardened password hashes rely on the same key/salt being used to compare encryptions.
	70	// Be aware that when using one of the hardened types the App signing_key or $more_salt below cannot change!
[468]	71	'encryption_type' => self::ENCRYPT_MD5,
[1]	72
[25]	73	// The URL to the login script.
[1]	74	'login_url' => '/',
	75
	76	// The maximum amount of time a user is allowed to be logged in. They will be forced to login again if they expire.
[124]	77	// In seconds. 21600 seconds = 6 hours.
[1]	78	'login_timeout' => 21600,
[42]	79
[1]	80	// The maximum amount of time a user is allowed to be idle before their session expires. They will be forced to login again if they expire.
[124]	81	// In seconds. 3600 seconds = 1 hour.
[1]	82	'idle_timeout' => 3600,
	83
	84	// The period of time to compare login abuse attempts. If a threshold of logins is reached in this amount of time the account is blocked.
	85	// Days and hours, like this: 'DD:HH'
	86	'login_abuse_timeframe' => '04:00',
	87
	88	// The number of warnings a user will receive (and their password reset each time) before their account is completely blocked.
	89	'login_abuse_warnings' => 3,
	90
	91	// The maximum number of IP addresses a user can login with over the timeout period before their account is blocked.
	92	'login_abuse_max_ips' => 5,
	93
[334]	94	// The IP address subnet size threshold. Uses a CIDR notation network mask (see CIDR cheat-sheet at bottom).
	95	// Any integer between 0 and 32 is permitted. Setting this to '24' permits any address in a
[1]	96	// class C network (255.255.255.0) to be considered the same. Setting to '32' compares each IP absolutely.
	97	// Setting to '0' ignores all IPs, thus disabling login_abuse checking.
	98	'login_abuse_ip_bitmask' => 32,
	99
[42]	100	// Specify usernames to exclude from the account abuse detection system. This is specified as a hardcoded array provided at
[1]	101	// class instantiation time, or can be saved in the db_table under the login_abuse_exempt field.
	102	'login_abuse_exempt_usernames' => array(),
[42]	103
[275]	104	// Specify usernames to exclude from remote_ip matching. Users behind proxy servers should be appended to this array so their shifting remote IP will not log them out.
	105	'match_remote_ip_exempt_usernames' => array(),
	106
	107	// Match the user's current remote IP against the one they logged in with.
	108	'match_remote_ip' => true,
	109
[103]	110	// An array of IP blocks that are bypass the remote_ip comparison check. Useful for dynamic IPs or those behind proxy servers.
[1]	111	'trusted_networks' => array(),
	112
	113	// Allow user accounts to be blocked? Requires the user table to have the columns 'blocked' and 'blocked_reason'
	114	'blocking' => false,
[42]	115
[1]	116	// Use a db_login_table to detect excessive logins. This requires blocking to be enabled.
	117	'abuse_detection' => false,
[421]	118
	119	// Allow users to save login form passwords in their browser? Setting to 'true' may pose a potential security risk.
	120	'login_form_allow_autocomplete' => false,
[1]	121	);
	122
	123	/**
	124	* Constructs a new authentication object.
	125	*
	126	* @access public
	127	* @param optional array $params A hash containing parameters.
	128	*/
[468]	129	public function __construct($namespace='')
[1]	130	{
[479]	131	$app =& App::getInstance();
[453]	132
[154]	133	$this->_ns = $namespace;
[453]	134
[1]	135	// Initialize default parameters.
	136	$this->setParam($this->_default_params);
	137
	138	// Get create tables config from global context.
[136]	139	if (!is_null($app->getParam('db_create_tables'))) {
	140	$this->setParam(array('create_table' => $app->getParam('db_create_tables')));
[1]	141	}
[198]	142
	143	if (!isset($_SESSION['_auth_sql'][$this->_ns])) {
	144	$this->clear();
	145	}
[1]	146	}
[42]	147
[1]	148	/**
	149	* Setup the database tables for this class.
	150	*
	151	* @access public
	152	* @author Quinn Comendant <quinn@strangecode.com>
	153	* @since 26 Aug 2005 17:09:36
	154	*/
[468]	155	public function initDB($recreate_db=false)
[1]	156	{
[479]	157	$app =& App::getInstance();
	158	$db =& DB::getInstance();
[453]	159
	160
[1]	161	static $_db_tested = false;
[42]	162
[1]	163	if ($recreate_db \|\| !$_db_tested && $this->getParam('create_table')) {
[42]	164
[1]	165	// User table.
	166	if ($recreate_db) {
[136]	167	$db->query("DROP TABLE IF EXISTS " . $this->getParam('db_table'));
[201]	168	$app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_table')), LOG_INFO, __FILE__, __LINE__);
[1]	169	}
	170
[15]	171	// The minimal columns for a table compatable with the Auth_SQL class.
[146]	172	$db->query("CREATE TABLE IF NOT EXISTS " . $db->escapeString($this->getParam('db_table')) . " (
[484]	173	" . $this->getParam('db_primary_key') . " MEDIUMINT UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
[1]	174	" . $this->getParam('db_username_column') . " varchar(255) NOT NULL default '',
[259]	175	userpass VARCHAR(255) NOT NULL DEFAULT '',
	176	first_name VARCHAR(255) NOT NULL DEFAULT '',
	177	last_name VARCHAR(255) NOT NULL DEFAULT '',
	178	email VARCHAR(255) NOT NULL DEFAULT '',
	179	login_abuse_exempt ENUM('TRUE') DEFAULT NULL,
	180	blocked ENUM('TRUE') DEFAULT NULL,
	181	blocked_reason VARCHAR(255) NOT NULL DEFAULT '',
	182	abuse_warning_level TINYINT(4) NOT NULL DEFAULT '0',
	183	seconds_online INT(11) NOT NULL DEFAULT '0',
	184	last_login_datetime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
	185	last_access_datetime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
	186	last_login_ip VARCHAR(255) NOT NULL DEFAULT '0.0.0.0',
	187	added_by_user_id SMALLINT(11) DEFAULT NULL,
	188	modified_by_user_id SMALLINT(11) DEFAULT NULL,
	189	added_datetime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
	190	modified_datetime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
[1]	191	KEY " . $this->getParam('db_username_column') . " (" . $this->getParam('db_username_column') . "),
	192	KEY userpass (userpass),
	193	KEY email (email)
	194	)");
	195
[136]	196	if (!$db->columnExists($this->getParam('db_table'), array(
[42]	197	$this->getParam('db_primary_key'),
	198	$this->getParam('db_username_column'),
	199	'userpass',
	200	'first_name',
	201	'last_name',
	202	'email',
	203	'login_abuse_exempt',
	204	'blocked',
	205	'blocked_reason',
	206	'abuse_warning_level',
	207	'seconds_online',
	208	'last_login_datetime',
	209	'last_access_datetime',
	210	'last_login_ip',
	211	'added_by_user_id',
	212	'modified_by_user_id',
	213	'added_datetime',
	214	'modified_datetime',
[1]	215	), false, false)) {
[136]	216	$app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), LOG_ALERT, __FILE__, __LINE__);
[1]	217	trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), E_USER_ERROR);
	218	}
[42]	219
[17]	220	// Login table is used for abuse_detection features.
	221	if ($this->getParam('abuse_detection')) {
	222	if ($recreate_db) {
[136]	223	$db->query("DROP TABLE IF EXISTS " . $this->getParam('db_login_table'));
[201]	224	$app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_login_table')), LOG_INFO, __FILE__, __LINE__);
[17]	225	}
[136]	226	$db->query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_login_table') . " (
[484]	227	" . $this->getParam('db_primary_key') . " MEDIUMINT UNSIGNED NOT NULL DEFAULT '0',
[259]	228	login_datetime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
	229	remote_ip_binary CHAR(32) NOT NULL DEFAULT '',
[17]	230	KEY " . $this->getParam('db_primary_key') . " (" . $this->getParam('db_primary_key') . "),
	231	KEY login_datetime (login_datetime),
	232	KEY remote_ip_binary (remote_ip_binary)
	233	)");
[42]	234
[136]	235	if (!$db->columnExists($this->getParam('db_login_table'), array(
[17]	236	$this->getParam('db_primary_key'),
	237	'login_datetime',
	238	'remote_ip_binary',
	239	), false, false)) {
[136]	240	$app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), LOG_ALERT, __FILE__, __LINE__);
[17]	241	trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), E_USER_ERROR);
	242	}
[1]	243	}
[42]	244	}
[1]	245	$_db_tested = true;
	246	}
	247
	248	/**
	249	* Set the params of an auth object.
	250	*
	251	* @param array $params Array of parameter keys and value to set.
	252	* @return bool true on success, false on failure
	253	*/
[468]	254	public function setParam($params)
[1]	255	{
[368]	256	if (isset($params['match_remote_ip_exempt_usernames'])) {
	257	$params['match_remote_ip_exempt_usernames'] = array_map('strtolower', $params['match_remote_ip_exempt_usernames']);
	258	}
	259	if (isset($params['login_abuse_exempt_usernames'])) {
	260	$params['login_abuse_exempt_usernames'] = array_map('strtolower', $params['login_abuse_exempt_usernames']);
	261	}
[1]	262	if (isset($params) && is_array($params)) {
	263	// Merge new parameters with old overriding only those passed.
	264	$this->_params = array_merge($this->_params, $params);
	265	}
	266	}
	267
	268	/**
	269	* Return the value of a parameter, if it exists.
	270	*
	271	* @access public
	272	* @param string $param Which parameter to return.
	273	* @return mixed Configured parameter value.
	274	*/
[468]	275	public function getParam($param)
[1]	276	{
[479]	277	$app =& App::getInstance();
[453]	278
[478]	279	if (array_key_exists($param, $this->_params)) {
[1]	280	return $this->_params[$param];
	281	} else {
[146]	282	$app->logMsg(sprintf('Parameter is not set: %s', $param), LOG_DEBUG, __FILE__, __LINE__);
[1]	283	return null;
	284	}
	285	}
	286
	287	/**
	288	* Clear any authentication tokens in the current session. A.K.A. logout.
	289	*
	290	* @access public
	291	*/
[468]	292	public function clear()
[1]	293	{
[479]	294	$db =& DB::getInstance();
[453]	295
[1]	296	$this->initDB();
[42]	297
[199]	298	if ($this->get('user_id', false)) {
	299	// FIX ME: Should we check if the session is active?
[195]	300	$db->query("
	301	UPDATE " . $this->_params['db_table'] . " SET
	302	seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)),
	303	last_login_datetime = '0000-00-00 00:00:00'
	304	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
	305	");
	306	}
[421]	307	$_SESSION['_auth_sql'][$this->_ns] = array(
	308	'authenticated' => false,
	309	'user_id' => null,
	310	'username' => null,
	311	'login_datetime' => null,
	312	'last_access_datetime' => null,
	313	'remote_ip' => getRemoteAddr(),
	314	'login_abuse_exempt' => null,
	315	'match_remote_ip_exempt'=> null,
	316	'user_data' => null,
	317	);
[1]	318	}
	319
	320	/**
[103]	321	* Sets a variable into a registered auth session.
	322	*
	323	* @access public
	324	* @param mixed $key Which value to set.
	325	* @param mixed $val Value to set variable to.
	326	*/
[468]	327	public function set($key, $val)
[103]	328	{
[154]	329	if (!isset($_SESSION['_auth_sql'][$this->_ns]['user_data'])) {
	330	$_SESSION['_auth_sql'][$this->_ns]['user_data'] = array();
[103]	331	}
[154]	332	$_SESSION['_auth_sql'][$this->_ns]['user_data'][$key] = $val;
[103]	333	}
	334
	335	/**
	336	* Returns a specified value from a registered auth session.
	337	*
	338	* @access public
	339	* @param mixed $key Which value to return.
	340	* @param mixed $default Value to return if key not found in user_data.
	341	* @return mixed Value stored in session.
	342	*/
[468]	343	public function get($key, $default='')
[103]	344	{
[154]	345	if (isset($_SESSION['_auth_sql'][$this->_ns][$key])) {
	346	return $_SESSION['_auth_sql'][$this->_ns][$key];
	347	} else if (isset($_SESSION['_auth_sql'][$this->_ns]['user_data'][$key])) {
	348	return $_SESSION['_auth_sql'][$this->_ns]['user_data'][$key];
[103]	349	} else {
	350	return $default;
	351	}
	352	}
	353
	354	/**
[1]	355	* Find out if a set of login credentials are valid.
	356	*
	357	* @access private
	358	* @param string $username The username to check.
	359	* @param string $password The password to compare to username.
	360	* @return mixed False if credentials not found in DB, or returns DB row matching credentials.
	361	*/
[468]	362	public function authenticate($username, $password)
[1]	363	{
[479]	364	$app =& App::getInstance();
	365	$db =& DB::getInstance();
[136]	366
[1]	367	$this->initDB();
[42]	368
[124]	369	switch ($this->_params['encryption_type']) {
[468]	370	case self::ENCRYPT_CRYPT :
[124]	371	// Query DB for user matching credentials. Compare cyphertext with salted-encrypted password.
[136]	372	$qid = $db->query("
[124]	373	SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
	374	FROM " . $this->_params['db_table'] . "
[136]	375	WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
	376	AND BINARY userpass = ENCRYPT('" . $db->escapeString($password) . "', LEFT(userpass, 2)))
[124]	377	");
	378	break;
[468]	379	case self::ENCRYPT_PLAINTEXT :
	380	case self::ENCRYPT_MD5 :
	381	case self::ENCRYPT_SHA1 :
[124]	382	default :
	383	// Query DB for user matching credentials. Directly compare cyphertext with result from encryptPassword().
[136]	384	$qid = $db->query("
[124]	385	SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
	386	FROM " . $this->_params['db_table'] . "
[136]	387	WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
	388	AND BINARY userpass = '" . $db->escapeString($this->encryptPassword($password)) . "'
[124]	389	");
	390	break;
	391	}
[42]	392
[1]	393	// Return user data if found.
	394	if ($user_data = mysql_fetch_assoc($qid)) {
[158]	395	// Don't return password value.
	396	unset($user_data['userpass']);
[372]	397	$app->logMsg(sprintf('Authentication successful for user_id %s (%s)', $user_data['user_id'], $username), LOG_INFO, __FILE__, __LINE__);
[1]	398	return $user_data;
	399	} else {
[372]	400	$app->logMsg(sprintf('Authentication failed for username %s (encrypted attempted password: %s)', $username, $this->encryptPassword($password)), LOG_NOTICE, __FILE__, __LINE__);
[1]	401	return false;
	402	}
	403	}
	404
	405	/**
	406	* If user authenticated, register login into session.
	407	*
	408	* @access private
	409	* @param string $username The username to check.
	410	* @param string $password The password to compare to username.
	411	* @return boolean Whether or not the credentials are valid.
	412	*/
[468]	413	public function login($username, $password)
[1]	414	{
[479]	415	$app =& App::getInstance();
	416	$db =& DB::getInstance();
[453]	417
[1]	418	$this->initDB();
[42]	419
[149]	420	$this->clear();
[1]	421
[468]	422	if (!($user_data = $this->authenticate($username, $password))) {
[1]	423	// No login: failed authentication!
	424	return false;
	425	}
[453]	426
	427	// Convert 'priv' to 'user_type' nomenclature to support older implementations.
	428	if (isset($user_data['priv'])) {
	429	$user_data['user_type'] = $user_data['priv'];
	430	}
	431
[1]	432	// Register authenticated session.
[154]	433	$_SESSION['_auth_sql'][$this->_ns] = array(
[1]	434	'authenticated' => true,
	435	'user_id' => $user_data['user_id'],
	436	'username' => $username,
	437	'login_datetime' => date('Y-m-d H:i:s'),
	438	'last_access_datetime' => date('Y-m-d H:i:s'),
	439	'remote_ip' => getRemoteAddr(),
[275]	440	'login_abuse_exempt' => isset($user_data['login_abuse_exempt']) ? !empty($user_data['login_abuse_exempt']) : in_array(strtolower($username), $this->_params['login_abuse_exempt_usernames']),
	441	'match_remote_ip_exempt'=> isset($user_data['match_remote_ip_exempt']) ? !empty($user_data['match_remote_ip_exempt']) : in_array(strtolower($username), $this->_params['match_remote_ip_exempt_usernames']),
[1]	442	'user_data' => $user_data
	443	);
[42]	444
[1]	445	/**
	446	* Check if the account is blocked, respond in context to reason. Cancel the login if blocked.
	447	*/
	448	if ($this->getParam('blocking')) {
	449	if (!empty($user_data['blocked'])) {
[42]	450
[372]	451	$app->logMsg(sprintf('User_id %s (%s) login failed due to blocked account: %s', $this->get('user_id'), $this->get('username'), $this->get('blocked_reason')), LOG_NOTICE, __FILE__, __LINE__);
[42]	452
[1]	453	switch ($user_data['blocked_reason']) {
	454	case 'account abuse' :
[136]	455	$app->raiseMsg(sprintf(_("This account has been blocked due to possible account abuse. Please contact us to reactivate."), null), MSG_WARNING, __FILE__, __LINE__);
[1]	456	break;
	457	default :
[136]	458	$app->raiseMsg(sprintf(_("This account is currently not active. %s"), $user_data['blocked_reason']), MSG_WARNING, __FILE__, __LINE__);
[1]	459	break;
	460	}
[42]	461
[1]	462	// No login: user is blocked!
[149]	463	$this->clear();
[1]	464	return false;
	465	}
	466	}
[42]	467
[1]	468	/**
	469	* Check the db_login_table for too many logins under this account.
	470	* (1) Count the number of unique IP addresses that logged in under this user within the login_abuse_timeframe
	471	* (2) If this number exceeds the login_abuse_max_ips, assume multiple people are logging in under the same account.
	472	**/
[497]	473	// TODO: make this ipv6 compatible. At the moment, ipv6 addresses are converted into zero for remote_ip_binary.
	474	// http://www.highonphp.com/5-tips-for-working-with-ipv6-in-php
	475	// https://stackoverflow.com/questions/444966/working-with-ipv6-addresses-in-php
[148]	476	if ($this->getParam('abuse_detection') && !$this->get('login_abuse_exempt')) {
[136]	477	$qid = $db->query("
[1]	478	SELECT COUNT(DISTINCT LEFT(remote_ip_binary, " . $this->_params['login_abuse_ip_bitmask'] . "))
	479	FROM " . $this->_params['db_login_table'] . "
[148]	480	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
[1]	481	AND DATE_ADD(login_datetime, INTERVAL '" . $this->_params['login_abuse_timeframe'] . "' DAY_HOUR) > NOW()
	482	");
	483	list($distinct_ips) = mysql_fetch_row($qid);
	484	if ($distinct_ips > $this->_params['login_abuse_max_ips']) {
[148]	485	if ($this->get('abuse_warning_level') < $this->_params['login_abuse_warnings']) {
[1]	486	// Warn the user with a password reset.
[15]	487	$this->resetPassword(null, _("This is a security precaution. We have detected this account has been accessed from multiple computers simultaneously. It is against policy to share login information with others. If further account abuse is detected this account will be blocked."));
[136]	488	$app->raiseMsg(_("Your password has been reset as a security precaution. Please check your email for more information."), MSG_NOTICE, __FILE__, __LINE__);
[372]	489	$app->logMsg(sprintf('Account abuse detected for user_id %s (%s) from IP %s', $this->get('user_id'), $this->get('username'), $this->get('remote_ip')), LOG_WARNING, __FILE__, __LINE__);
[1]	490	} else {
	491	// Block the account with the reason of account abuse.
	492	$this->blockAccount(null, 'account abuse');
[136]	493	$app->raiseMsg(_("Your account has been blocked as a security precaution. Please contact us for more information."), MSG_NOTICE, __FILE__, __LINE__);
[372]	494	$app->logMsg(sprintf('Account blocked for user_id %s (%s) from IP %s', $this->get('user_id'), $this->get('username'), $this->get('remote_ip')), LOG_ALERT, __FILE__, __LINE__);
[1]	495	}
	496	// Increment user's warning level.
[148]	497	$db->query("UPDATE " . $this->_params['db_table'] . " SET abuse_warning_level = abuse_warning_level + 1 WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'");
[1]	498	// Reset the login counter for this user.
[148]	499	$db->query("DELETE FROM " . $this->_params['db_login_table'] . " WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'");
[1]	500	// No login: reset password because of account abuse!
[149]	501	$this->clear();
[1]	502	return false;
	503	}
	504
	505	// Update the login counter table with this login access. Convert IP to binary.
[159]	506	// TODO: after MySQL 5.0.23 is released this query could benefit from INSERT DELAYED.
[136]	507	$db->query("
[1]	508	INSERT INTO " . $this->_params['db_login_table'] . " (
[42]	509	" . $this->_params['db_primary_key'] . ",
	510	login_datetime,
[1]	511	remote_ip_binary
	512	) VALUES (
[148]	513	'" . $this->get('user_id') . "',
	514	'" . $this->get('login_datetime') . "',
	515	'" . sprintf('%032b', ip2long($this->get('remote_ip'))) . "'
[1]	516	)
	517	");
	518	}
[42]	519
[1]	520	// Update user table with this login.
[136]	521	$db->query("
[1]	522	UPDATE " . $this->_params['db_table'] . " SET
[148]	523	last_login_datetime = '" . $this->get('login_datetime') . "',
	524	last_access_datetime = '" . $this->get('login_datetime') . "',
	525	last_login_ip = '" . $this->get('remote_ip') . "'
	526	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
[1]	527	");
[42]	528
[1]	529	// We're logged-in!
	530	return true;
	531	}
	532
	533	/**
	534	* Test if user has a currently logged-in session.
	535	* - authentication flag set to true
	536	* - username not empty
	537	* - total logged-in time is not greater than login_timeout
	538	* - idle time is not greater than idle_timeout
	539	* - remote address is the same as the login remote address (aol users excluded).
	540	*
	541	* @access public
	542	*/
[468]	543	public function isLoggedIn($user_id=null)
[1]	544	{
[479]	545	$app =& App::getInstance();
	546	$db =& DB::getInstance();
[372]	547
[1]	548	$this->initDB();
[42]	549
[1]	550	if (isset($user_id)) {
	551	// Check the login status of a specific user.
[136]	552	$qid = $db->query("
[1]	553	SELECT 1 FROM " . $this->_params['db_table'] . "
[136]	554	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[1]	555	AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
	556	AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
	557	");
[372]	558	$login_status = (mysql_num_rows($qid) > 0);
	559	$app->logMsg(sprintf('Returning %s login status for user_id %s', ($login_status ? 'true' : 'false'), $user_id), LOG_DEBUG, __FILE__, __LINE__);
	560	return $login_status;
[1]	561	}
	562
	563	// User login test need only be run once per script execution. We cache the result in the session.
[154]	564	if ($this->_authentication_tested && isset($_SESSION['_auth_sql'][$this->_ns]['authenticated'])) {
[372]	565	$app->logMsg(sprintf('Returning cached authentication status: %s', ($_SESSION['_auth_sql'][$this->_ns]['authenticated'] ? 'true' : 'false')), LOG_DEBUG, __FILE__, __LINE__);
[154]	566	return $_SESSION['_auth_sql'][$this->_ns]['authenticated'];
[1]	567	}
[42]	568
[1]	569	// Tesing login should occur once. This is the first time. Set flag.
	570	$this->_authentication_tested = true;
[35]	571
[453]	572	// Some users will access from networks with a changing IP number (i.e. behind a proxy server).
[370]	573	// These users must be allowed entry by adding their IP to the list of trusted_networks, or their usernames to the list of match_remote_ip_exempt_usernames.
[1]	574	if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
	575	$user_in_trusted_network = true;
[372]	576	$app->logMsg(sprintf('User_id %s accessing from trusted network %s',
	577	($this->get('user_id') ? $this->get('user_id') . ' (' . $this->get('username') . ')' : 'unknown'),
[1]	578	$trusted_net
[71]	579	), LOG_DEBUG, __FILE__, __LINE__);
[1]	580	} else if (preg_match('/proxy.aol.com$/i', getRemoteAddr(true))) {
	581	$user_in_trusted_network = true;
[372]	582	$app->logMsg(sprintf('User_id %s accessing from trusted network proxy.aol.com',
	583	($this->get('user_id') ? $this->get('user_id') . ' (' . $this->get('username') . ')' : 'unknown')
[71]	584	), LOG_DEBUG, __FILE__, __LINE__);
[1]	585	} else {
	586	$user_in_trusted_network = false;
	587	}
[453]	588
[275]	589	// Do we match the user's remote IP at all? Yes, if set in config and not disabled for specific user.
	590	if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt')) {
[276]	591	$remote_ip_is_matched = (isset($_SESSION['_auth_sql'][$this->_ns]['remote_ip']) && $_SESSION['_auth_sql'][$this->_ns]['remote_ip'] == getRemoteAddr()) \|\| $user_in_trusted_network;
[275]	592	} else {
[453]	593	$app->logMsg(sprintf('User_id %s exempt from remote_ip match (comparing %s == %s)',
[372]	594	($this->get('user_id') ? $this->get('user_id') . ' (' . $this->get('username') . ')' : 'unknown'),
[277]	595	$_SESSION['_auth_sql'][$this->_ns]['remote_ip'],
	596	getRemoteAddr()
[275]	597	), LOG_DEBUG, __FILE__, __LINE__);
	598	$remote_ip_is_matched = true;
	599	}
[42]	600
[1]	601	// Test login with information stored in session. Skip IP matching for users from trusted networks.
[453]	602	if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated'])
[154]	603	&& true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']
[372]	604	&& isset($_SESSION['_auth_sql'][$this->_ns]['username'])
[154]	605	&& !empty($_SESSION['_auth_sql'][$this->_ns]['username'])
[372]	606	&& isset($_SESSION['_auth_sql'][$this->_ns]['login_datetime'])
[154]	607	&& strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) > time() - $this->_params['login_timeout']
[372]	608	&& isset($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'])
[154]	609	&& strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > time() - $this->_params['idle_timeout']
[275]	610	&& $remote_ip_is_matched
[1]	611	) {
	612	// User is authenticated!
[154]	613	$_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'] = date('Y-m-d H:i:s');
[1]	614
	615	// Update the DB with the last_access_datetime and increment the seconds_online.
[136]	616	$db->query("
[42]	617	UPDATE " . $this->_params['db_table'] . " SET
[1]	618	seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)) + 1,
[148]	619	last_access_datetime = '" . $this->get('last_access_datetime') . "'
	620	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
[1]	621	");
[136]	622	if (mysql_affected_rows($db->getDBH()) > 0) {
[1]	623	// User record still exists in DB. Do this to ensure user was not delete from DB between accesses. Notice "+ 1" in SQL above to ensure record is modified.
	624	return true;
	625	} else {
[372]	626	$app->logMsg(sprintf('Session update failed; record not found for user_id %s (%s).', $this->get('user_id'), $this->get('username')), LOG_NOTICE, __FILE__, __LINE__);
[1]	627	}
[224]	628	} else if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated']) && true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']) {
[1]	629	// User is authenticated, but login has expired.
[154]	630	if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > time() - 43200) {
[35]	631	// Only raise message if last session is less than 12 hours old.
[136]	632	$app->raiseMsg(_("Your session has expired. You need to log-in again."), MSG_NOTICE, __FILE__, __LINE__);
[35]	633	}
[42]	634
[1]	635	// Log the reason for login expiration.
	636	$expire_reasons = array();
[154]	637	if (empty($_SESSION['_auth_sql'][$this->_ns]['username'])) {
[1]	638	$expire_reasons[] = 'username not found';
	639	}
[154]	640	if (strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) <= time() - $this->_params['login_timeout']) {
[372]	641	$expire_reasons[] = sprintf('login_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['login_datetime'], $this->_params['login_timeout']);
[1]	642	}
[154]	643	if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) <= time() - $this->_params['idle_timeout']) {
[372]	644	$expire_reasons[] = sprintf('idle_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'], $this->_params['idle_timeout']);
[1]	645	}
[370]	646	if ($_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr()) {
	647	if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt') && !$user_in_trusted_network) {
	648	// There are three cases when a remote IP match will be the cause of a session termination:
	649	// 1. match_remote_ip config is enabled
	650	// 2. user is not match_remote_ip_exempt (set in the user_data, or in the match_remote_ip_exempt_usernames list)
	651	// 3. the user is connecting from a trusted network (their IP is listed in the trusted_networks or from *.proxy.aol.com)
[275]	652	$expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION['_auth_sql'][$this->_ns]['remote_ip'], getRemoteAddr());
	653	} else {
	654	$expire_reasons[] = sprintf('remote_ip not matched but user was exempt from this check (%s != %s)', $_SESSION['_auth_sql'][$this->_ns]['remote_ip'], getRemoteAddr());
	655	}
[1]	656	}
[372]	657	$app->logMsg(sprintf('User_id %s (%s) session expired: %s', $this->get('user_id'), $this->get('username'), join(', ', $expire_reasons)), LOG_INFO, __FILE__, __LINE__);
[1]	658	}
	659
	660	// User is not authenticated.
[149]	661	$this->clear();
[1]	662	return false;
	663	}
	664
	665	/**
	666	* Redirect user to login page if they are not logged in.
	667	*
[32]	668	* @param string $message The text description of a message to raise.
[1]	669	* @param int $type The type of message: MSG_NOTICE,
	670	* MSG_SUCCESS, MSG_WARNING, or MSG_ERR.
	671	* @param string $file __FILE__.
	672	* @param string $line __LINE__.
	673	* @access public
	674	*/
[468]	675	public function requireLogin($message='', $type=MSG_NOTICE, $file=null, $line=null)
[1]	676	{
[479]	677	$app =& App::getInstance();
[453]	678
[1]	679	if (!$this->isLoggedIn()) {
[103]	680	// Display message for requiring login. (RaiseMsg will ignore empty strings.)
[203]	681	if ('' != $message) {
	682	$app->raiseMsg($message, $type, $file, $line);
	683	}
[32]	684
[28]	685	// Login scripts must have the same 'login' tag for boomerangURL verification/manipulation.
[136]	686	$app->setBoomerangURL(absoluteMe(), 'login');
	687	$app->dieURL($this->_params['login_url']);
[1]	688	}
	689	}
	690
	691	/**
	692	* This sets the 'blocked' field for a user in the db_table, and also
	693	* adds an optional reason
[42]	694	*
[1]	695	* @param string $reason The reason for blocking the account.
	696	*/
[468]	697	public function blockAccount($user_id=null, $reason='')
[1]	698	{
[479]	699	$app =& App::getInstance();
	700	$db =& DB::getInstance();
[453]	701
[1]	702	$this->initDB();
[42]	703
[1]	704	if ($this->getParam('blocking')) {
[247]	705	if (mb_strlen($db->escapeString($reason)) > 255) {
[1]	706	// blocked_reason field is varchar(255).
[136]	707	$app->logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
[1]	708	}
[42]	709
[1]	710	// Get user_id if specified.
[148]	711	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
[136]	712	$db->query("
[1]	713	UPDATE " . $this->_params['db_table'] . " SET
	714	blocked = 'true',
[136]	715	blocked_reason = '" . $db->escapeString($reason) . "'
	716	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[1]	717	");
	718	}
	719	}
	720
	721	/**
[266]	722	* Tests if the "blocked" flag is set for a user.
	723	*
	724	* @param int $user_id User id to look for.
	725	* @return boolean True if the user is blocked, false otherwise.
	726	*/
[468]	727	public function isBlocked($user_id=null)
[266]	728	{
[479]	729	$db =& DB::getInstance();
[266]	730
	731	$this->initDB();
	732
	733	if ($this->getParam('blocking')) {
	734	// Get user_id if specified.
	735	$user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
	736	$qid = $db->query("
[453]	737	SELECT 1
[266]	738	FROM " . $this->_params['db_table'] . "
	739	WHERE blocked = 'true'
	740	AND " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
	741	");
	742	return mysql_num_rows($qid) === 1;
	743	}
	744	}
	745
	746	/**
[42]	747	* Unblocks a user in the db_table, and clears any blocked_reason.
[1]	748	*/
[468]	749	public function unblockAccount($user_id=null)
[1]	750	{
[479]	751	$db =& DB::getInstance();
[453]	752
[1]	753	$this->initDB();
[453]	754
[1]	755	if ($this->getParam('blocking')) {
	756	// Get user_id if specified.
[148]	757	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
[136]	758	$db->query("
[1]	759	UPDATE " . $this->_params['db_table'] . " SET
	760	blocked = '',
	761	blocked_reason = ''
[136]	762	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[1]	763	");
	764	}
	765	}
	766
	767	/**
	768	* Returns true if username already exists in database.
	769	*
	770	* @param string $username Username to look for.
	771	* @return bool True if username exists.
	772	*/
[468]	773	public function usernameExists($username)
[42]	774	{
[479]	775	$db =& DB::getInstance();
[453]	776
[1]	777	$this->initDB();
[42]	778
[136]	779	$qid = $db->query("
[42]	780	SELECT 1
[15]	781	FROM " . $this->_params['db_table'] . "
[136]	782	WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
[15]	783	");
[1]	784	return (mysql_num_rows($qid) > 0);
	785	}
	786
	787	/**
	788	* Returns a username for a specified user id.
	789	*
	790	* @param string $user_id User id to look for.
	791	* @return string Username, or false if none found.
	792	*/
[468]	793	public function getUsername($user_id)
[42]	794	{
[479]	795	$db =& DB::getInstance();
[453]	796
[1]	797	$this->initDB();
[42]	798
[136]	799	$qid = $db->query("
[15]	800	SELECT " . $this->_params['db_username_column'] . "
	801	FROM " . $this->_params['db_table'] . "
[136]	802	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[15]	803	");
[1]	804	if (list($username) = mysql_fetch_row($qid)) {
	805	return $username;
	806	} else {
	807	return false;
	808	}
	809	}
	810
	811	/**
	812	* Returns a randomly generated password based on $pattern. The pattern is any
	813	* sequence of 'x', 'V', 'C', 'v', 'c', or 'd' and if it is something like 'cvccv' this
[334]	814	* function will generate a pronounceable password. Recommend using more complex
[1]	815	* patterns, at minimum the US State Department standard: cvcddcvc.
	816	*
[468]	817	* - x A random upper or lower character, digit, or punctuation.
	818	* - C A random upper or lower consonant.
	819	* - V A random upper or lower vowel.
	820	* - c A random lowercase consonant.
	821	* - v A random lowercase vowel.
	822	* - d A random digit.
[1]	823	*
	824	* @param string $pattern a sequence of character types, above.
	825	* @return string a password
	826	*/
[468]	827	public function generatePassword($pattern='CvcdCvc')
[1]	828	{
[174]	829	$app =& App::getInstance();
	830	if (preg_match('/[^xCVcvd]/', $pattern)) {
	831	$app->logMsg(sprintf('Invalid pattern: %s', $pattern), LOG_WARNING, __FILE__, __LINE__);
	832	$pattern='CvcdCvc';
	833	}
[1]	834	$str = '';
[247]	835	for ($i=0; $i<mb_strlen($pattern); $i++) {
[259]	836	$x = mb_substr('bcdfghjklmnprstvwxzBCDFGHJKLMNPRSTVWXZaeiouyAEIOUY0123456789!@#%&*-=+.?', (mt_rand() % 71), 1);
[247]	837	$c = mb_substr('bcdfghjklmnprstvwxz', (mt_rand() % 19), 1);
	838	$C = mb_substr('bcdfghjklmnprstvwxzBCDFGHJKLMNPRSTVWXZ', (mt_rand() % 38), 1);
	839	$v = mb_substr('aeiouy', (mt_rand() % 6), 1);
	840	$V = mb_substr('aeiouyAEIOUY', (mt_rand() % 12), 1);
	841	$d = mb_substr('0123456789', (mt_rand() % 10), 1);
[259]	842	$str .= $$pattern[$i];
[1]	843	}
	844	return $str;
	845	}
[42]	846
[1]	847	/**
	848	*
	849	*/
[468]	850	public function encryptPassword($password, $salt=null)
[1]	851	{
[136]	852	$app =& App::getInstance();
[453]	853
[136]	854	// Existing password hashes rely on the same key/salt being used to compare encryptions.
[334]	855	// Don't change this (or the value applied to signing_key) unless you know existing hashes or signatures will not be affected!
[136]	856	$more_salt = 'B36D18E5-3FE4-4D58-8150-F26642852B81';
[453]	857
[1]	858	switch ($this->_params['encryption_type']) {
[468]	859	case self::ENCRYPT_PLAINTEXT :
[1]	860	return $password;
	861	break;
[42]	862
[468]	863	case self::ENCRYPT_CRYPT :
[124]	864	// If comparing plaintext password with a hash, provide first two chars of the hash as the salt.
[247]	865	return isset($salt) ? crypt($password, mb_substr($salt, 0, 2)) : crypt($password);
[1]	866	break;
[42]	867
[468]	868	case self::ENCRYPT_SHA1 :
[136]	869	return sha1($password);
[15]	870	break;
[42]	871
[468]	872	case self::ENCRYPT_SHA1_HARDENED :
[136]	873	$hash = sha1($app->getParam('signing_key') . $password . $more_salt);
	874	// Increase key strength by 12 bits.
[453]	875	for ($i=0; $i < 4096; $i++) {
	876	$hash = sha1($hash);
	877	}
[136]	878	return $hash;
	879	break;
	880
[468]	881	case self::ENCRYPT_MD5 :
[136]	882	return md5($password);
	883	break;
	884
[468]	885	case self::ENCRYPT_MD5_HARDENED :
[136]	886	// Include salt to improve hash
	887	$hash = md5($app->getParam('signing_key') . $password . $more_salt);
	888	// Increase key strength by 12 bits.
[453]	889	for ($i=0; $i < 4096; $i++) {
	890	$hash = md5($hash);
	891	}
[136]	892	return $hash;
	893	break;
[371]	894
[1]	895	default :
[136]	896	$app->logMsg(sprintf('Authentication encrypt type specified is unrecognized: %s', $this->_params['encryption_type']), LOG_NOTICE, __FILE__, __LINE__);
	897	return false;
[1]	898	break;
	899	}
	900	}
	901
	902	/**
[42]	903	*
[1]	904	*/
[468]	905	public function setPassword($user_id=null, $password)
[42]	906	{
[479]	907	$app =& App::getInstance();
	908	$db =& DB::getInstance();
[453]	909
[1]	910	$this->initDB();
[42]	911
[1]	912	// Get user_id if specified.
[148]	913	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
[42]	914
[229]	915	// Get old password.
[453]	916	$qid = $db->query("
[229]	917	SELECT userpass
	918	FROM " . $this->_params['db_table'] . "
	919	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
	920	");
	921	if (!list($old_encrypted_password) = mysql_fetch_row($qid)) {
[334]	922	$app->logMsg(sprintf('Cannot set password for nonexistent user_id %s', $user_id), LOG_NOTICE, __FILE__, __LINE__);
[229]	923	return false;
	924	}
[453]	925
[229]	926	// Compare old with new to ensure we're actually changing the password.
	927	$encrypted_password = $this->encryptPassword($password);
	928	if ($old_encrypted_password == $encrypted_password) {
	929	$app->logMsg(sprintf('Not setting password: new is the same as old.', null), LOG_INFO, __FILE__, __LINE__);
	930	return false;
	931	}
	932
[1]	933	// Issue the password change query.
[136]	934	$db->query("
[42]	935	UPDATE " . $this->_params['db_table'] . "
[229]	936	SET userpass = '" . $db->escapeString($encrypted_password) . "'
[136]	937	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[1]	938	");
[453]	939
[136]	940	if (mysql_affected_rows($db->getDBH()) != 1) {
[372]	941	$app->logMsg(sprintf('Failed to update password for user_id %s', $user_id), LOG_WARNING, __FILE__, __LINE__);
[229]	942	return false;
[119]	943	}
[453]	944
[229]	945	return true;
[1]	946	}
	947
	948	/**
	949	* Resets the password for the user with the specified id.
	950	*
	951	* @param string $user_id The id of the user to reset.
	952	* @param string $reason Additional message to add to the reset email.
	953	* @return string The user's new password.
	954	*/
[468]	955	public function resetPassword($user_id=null, $reason='')
[1]	956	{
[479]	957	$app =& App::getInstance();
	958	$db =& DB::getInstance();
[453]	959
[1]	960	$this->initDB();
[42]	961
[1]	962	// Get user_id if specified.
[148]	963	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
[42]	964
[1]	965	// Reset password of a specific user.
[136]	966	$qid = $db->query("
[1]	967	SELECT * FROM " . $this->_params['db_table'] . "
[136]	968	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
[1]	969	");
[15]	970	if (!$user_data = mysql_fetch_assoc($qid)) {
[372]	971	$app->logMsg(sprintf('Reset password failed. User_id %s not found.', $user_id), LOG_NOTICE, __FILE__, __LINE__);
[15]	972	return false;
	973	}
[42]	974
[1]	975	// Get new password.
	976	$password = $this->generatePassword();
[42]	977
[1]	978	// Update password query.
	979	$this->setPassword($user_id, $password);
[41]	980
[43]	981	// Make sure user has an email on record before continuing.
	982	if (!isset($user_data['email']) \|\| '' == trim($user_data['email'])) {
[372]	983	$app->logMsg(sprintf('Password reset but notification failed, no email address for user_id %s (%s).', $user_data[$this->_params['db_primary_key']], $user_data[$this->_params['db_username_column']]), LOG_NOTICE, __FILE__, __LINE__);
[43]	984	} else {
[189]	985	// Send the new password in an email.
[43]	986	$email = new Email(array(
	987	'to' => $user_data['email'],
[136]	988	'from' => sprintf('%s <%s>', $app->getParam('site_name'), $app->getParam('site_email')),
	989	'subject' => sprintf('%s password change', $app->getParam('site_name'))
[43]	990	));
[189]	991	$email->setTemplate('codebase/services/templates/email_reset_password.txt');
[43]	992	$email->replace(array(
[189]	993	'SITE_NAME' => $app->getParam('site_name'),
	994	'SITE_URL' => $app->getParam('site_url'),
	995	'SITE_EMAIL' => $app->getParam('site_email'),
	996	'NAME' => ('' != $user_data['first_name'] . $user_data['last_name'] ? $user_data['first_name'] . ' ' . $user_data['last_name'] : $user_data[$this->_params['db_username_column']]),
	997	'USERNAME' => $user_data[$this->_params['db_username_column']],
	998	'PASSWORD' => $password,
[334]	999	'REASON' => ('' == trim($reason) ? '' : trim($reason) . ' '), // Add a space after the reason if it exists for better formatting.
[43]	1000	));
	1001	$email->send();
	1002	}
[41]	1003
[15]	1004	return array(
[42]	1005	'username' => $user_data[$this->_params['db_username_column']],
[15]	1006	'userpass' => $password
	1007	);
[1]	1008	}
[42]	1009
[1]	1010	/**
	1011	* If the current user has access to the specified $security_zone, return true.
[266]	1012	* If the optional $user_type is supplied, test that against the zone.
[1]	1013	*
[266]	1014	* NOTE: "user_type" used to be called "priv" in some older implementations.
	1015	*
[334]	1016	* @param constant $security_zone string of comma delimited privileges for the zone
[266]	1017	* @param string $user_type a privilege that might be found in a zone
[1]	1018	* @return bool true if user is a member of security zone, false otherwise
	1019	*/
[468]	1020	public function inClearanceZone($security_zone, $user_type='')
[1]	1021	{
	1022	$zone_members = preg_split('/,\s*/', $security_zone);
[266]	1023	$user_type = empty($user_type) ? $this->get('user_type') : $user_type;
[42]	1024
	1025	// If the current user's privilege level is NOT in that array or if the
[1]	1026	// user has no privilege, return false. Otherwise the user is clear.
[266]	1027	if (!in_array($user_type, $zone_members) \|\| empty($user_type)) {
[1]	1028	return false;
	1029	} else {
	1030	return true;
	1031	}
	1032	}
[42]	1033
[1]	1034	/**
	1035	* This function tests a list of arguments $security_zone against the priv that the current user has.
[42]	1036	* If the user doesn't have one of the supplied privs, die.
[1]	1037	*
[266]	1038	* NOTE: "user_type" used to be called "priv" in some older implementations.
	1039	*
[334]	1040	* @param constant $security_zone string of comma delimited privileges for the zone
[1]	1041	*/
[468]	1042	public function requireAccessClearance($security_zone, $message='')
[1]	1043	{
[479]	1044	$app =& App::getInstance();
[453]	1045
[1]	1046	$zone_members = preg_split('/,\s*/', $security_zone);
[42]	1047
	1048	/* If the current user's privilege level is NOT in that array or if the
[1]	1049	* user has no privilege, DIE with a message. */
[266]	1050	if (!in_array($this->get('user_type'), $zone_members) \|\| !$this->get('user_type')) {
[32]	1051	$message = empty($message) ? _("You have insufficient privileges to view that page.") : $message;
[136]	1052	$app->raiseMsg($message, MSG_NOTICE, __FILE__, __LINE__);
	1053	$app->dieBoomerangURL();
[1]	1054	}
	1055	}
	1056
	1057	} // end class
	1058
[51]	1059	// CIDR cheat-sheet
[1]	1060	//
[42]	1061	// Netmask Netmask (binary) CIDR Notes
[1]	1062	// _____________________________________________________________________________
	1063	// 255.255.255.255 11111111.11111111.11111111.11111111 /32 Host (single addr)
[51]	1064	// 255.255.255.254 11111111.11111111.11111111.11111110 /31 Unusable
[1]	1065	// 255.255.255.252 11111111.11111111.11111111.11111100 /30 2 useable
	1066	// 255.255.255.248 11111111.11111111.11111111.11111000 /29 6 useable
	1067	// 255.255.255.240 11111111.11111111.11111111.11110000 /28 14 useable
	1068	// 255.255.255.224 11111111.11111111.11111111.11100000 /27 30 useable
	1069	// 255.255.255.192 11111111.11111111.11111111.11000000 /26 62 useable
	1070	// 255.255.255.128 11111111.11111111.11111111.10000000 /25 126 useable
	1071	// 255.255.255.0 11111111.11111111.11111111.00000000 /24 "Class C" 254 useable
[42]	1072	//
[1]	1073	// 255.255.254.0 11111111.11111111.11111110.00000000 /23 2 Class C's
	1074	// 255.255.252.0 11111111.11111111.11111100.00000000 /22 4 Class C's
	1075	// 255.255.248.0 11111111.11111111.11111000.00000000 /21 8 Class C's
	1076	// 255.255.240.0 11111111.11111111.11110000.00000000 /20 16 Class C's
	1077	// 255.255.224.0 11111111.11111111.11100000.00000000 /19 32 Class C's
	1078	// 255.255.192.0 11111111.11111111.11000000.00000000 /18 64 Class C's
	1079	// 255.255.128.0 11111111.11111111.10000000.00000000 /17 128 Class C's
	1080	// 255.255.0.0 11111111.11111111.00000000.00000000 /16 "Class B"
[42]	1081	//
[1]	1082	// 255.254.0.0 11111111.11111110.00000000.00000000 /15 2 Class B's
	1083	// 255.252.0.0 11111111.11111100.00000000.00000000 /14 4 Class B's
	1084	// 255.248.0.0 11111111.11111000.00000000.00000000 /13 8 Class B's
	1085	// 255.240.0.0 11111111.11110000.00000000.00000000 /12 16 Class B's
	1086	// 255.224.0.0 11111111.11100000.00000000.00000000 /11 32 Class B's
	1087	// 255.192.0.0 11111111.11000000.00000000.00000000 /10 64 Class B's
	1088	// 255.128.0.0 11111111.10000000.00000000.00000000 /9 128 Class B's
	1089	// 255.0.0.0 11111111.00000000.00000000.00000000 /8 "Class A"
[42]	1090	//
[1]	1091	// 254.0.0.0 11111110.00000000.00000000.00000000 /7
	1092	// 252.0.0.0 11111100.00000000.00000000.00000000 /6
	1093	// 248.0.0.0 11111000.00000000.00000000.00000000 /5
	1094	// 240.0.0.0 11110000.00000000.00000000.00000000 /4
	1095	// 224.0.0.0 11100000.00000000.00000000.00000000 /3
	1096	// 192.0.0.0 11000000.00000000.00000000.00000000 /2
	1097	// 128.0.0.0 10000000.00000000.00000000.00000000 /1
	1098	// 0.0.0.0 00000000.00000000.00000000.00000000 /0 IP space

Note: See TracBrowser for help on using the repository browser.

Download in other formats: