Context Navigation

source: trunk/lib/Auth_SQL.inc.php @ 601

Last change on this file since 601 was 601, checked in by anonymous, 7 years ago
Updated every instance of 'zero' date 0000-00-00 to use 1000-01-01 if mysql version >= 5.7.4
File size: 50.8 KB

Line
1	<?php
2	/**
3	* The Strangecode Codebase - a general application development framework for PHP
4	* For details visit the project site: <http://trac.strangecode.com/codebase/>
5	* Copyright 2001-2012 Strangecode, LLC
6	*
7	* This file is part of The Strangecode Codebase.
8	*
9	* The Strangecode Codebase is free software: you can redistribute it and/or
10	* modify it under the terms of the GNU General Public License as published by the
11	* Free Software Foundation, either version 3 of the License, or (at your option)
12	* any later version.
13	*
14	* The Strangecode Codebase is distributed in the hope that it will be useful, but
15	* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
16	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
17	* details.
18	*
19	* You should have received a copy of the GNU General Public License along with
20	* The Strangecode Codebase. If not, see <http://www.gnu.org/licenses/>.
21	*/
22
23	/*
24	* The Auth_SQL class provides a SQL implementation for authentication.
25	*
26	* @author Quinn Comendant <quinn@strangecode.com>
27	* @version 2.1
28	*/
29
30	require_once dirname(__FILE__) . '/Email.inc.php';
31
32	class Auth_SQL
33	{
34	// Available hash types for class Auth_SQL.
35	const ENCRYPT_PLAINTEXT = 1;
36	const ENCRYPT_CRYPT = 2;
37	const ENCRYPT_SHA1 = 3;
38	const ENCRYPT_SHA1_HARDENED = 4;
39	const ENCRYPT_MD5 = 5;
40	const ENCRYPT_MD5_HARDENED = 6;
41	const ENCRYPT_PASSWORD_BCRYPT = 7;
42	const ENCRYPT_PASSWORD_DEFAULT = 8;
43
44	// Namespace of this auth object.
45	protected $_ns;
46
47	// Static var for test.
48	protected $_authentication_tested;
49
50	// Parameters to be configured by setParam.
51	protected $_params = array();
52	protected $_default_params = array(
53
54	// Automatically create table and verify columns. Better set to false after site launch.
55	// This value is overwritten by the $app->getParam('db_create_tables') setting if it is available.
56	'create_table' => true,
57
58	// The database table containing users to authenticate.
59	'db_table' => 'user_tbl',
60
61	// The name of the primary key for the db_table.
62	'db_primary_key' => 'user_id',
63
64	// The name of the username key for the db_table.
65	'db_username_column' => 'username',
66
67	// If using the db_login_table feature, specify the db_login_table. The primary key must match the primary key for the db_table.
68	'db_login_table' => 'user_login_tbl',
69
70	// The type of hash to use for passwords stored in the db_table. Use one of the Auth_SQL::ENCRYPT_* types specified above.
71	// Hardened password hashes rely on the same key/salt being used to compare hashes.
72	// Be aware that when using one of the hardened types the App signing_key or $more_salt below cannot change!
73	'hash_type' => self::ENCRYPT_MD5,
74	'encryption_type' => null, // Backwards misnomer compatibility.
75
76	// Automatically update stored user hashes when the user next authenticates if the hash type changes (requires user_tbl with populated userpass_hashtype column).
77	'hash_type_autoupdate' => true,
78
79	// The URL to the login script.
80	'login_url' => '/',
81
82	// The maximum amount of time a user is allowed to be logged in. They will be forced to login again if they expire.
83	// In seconds. 21600 seconds = 6 hours.
84	'login_timeout' => 21600,
85
86	// The maximum amount of time a user is allowed to be idle before their session expires. They will be forced to login again if they expire.
87	// In seconds. 3600 seconds = 1 hour.
88	'idle_timeout' => 3600,
89
90	// The period of time to compare login abuse attempts. If a threshold of logins is reached in this amount of time the account is blocked.
91	// Days and hours, like this: 'DD:HH'
92	'login_abuse_timeframe' => '04:00',
93
94	// The number of warnings a user will receive (and their password reset each time) before their account is completely blocked.
95	'login_abuse_warnings' => 3,
96
97	// The maximum number of IP addresses a user can login with over the timeout period before their account is blocked.
98	'login_abuse_max_ips' => 5,
99
100	// The IP address subnet size threshold. Uses a CIDR notation network mask (see CIDR cheat-sheet at bottom).
101	// Any integer between 0 and 32 is permitted. Setting this to '24' permits any address in a
102	// class C network (255.255.255.0) to be considered the same. Setting to '32' compares each IP absolutely.
103	// Setting to '0' ignores all IPs, thus disabling login_abuse checking.
104	'login_abuse_ip_bitmask' => 32,
105
106	// Specify usernames to exclude from the account abuse detection system. This is specified as a hardcoded array provided at
107	// class instantiation time, or can be saved in the db_table under the login_abuse_exempt field.
108	'login_abuse_exempt_usernames' => array(),
109
110	// Specify usernames to exclude from remote_ip matching. Users behind proxy servers should be appended to this array so their shifting remote IP will not log them out.
111	'match_remote_ip_exempt_usernames' => array(),
112
113	// Match the user's current remote IP against the one they logged in with.
114	'match_remote_ip' => true,
115
116	// An array of IP blocks that are bypass the remote_ip comparison check. Useful for dynamic IPs or those behind proxy servers.
117	'trusted_networks' => array(),
118
119	// Allow user accounts to be blocked? Requires the user table to have the columns 'blocked' and 'blocked_reason'
120	'blocking' => false,
121
122	// Use a db_login_table to detect excessive logins. This requires blocking to be enabled.
123	'abuse_detection' => false,
124
125	// Allow users to save login form passwords in their browser? Setting to 'true' may pose a potential security risk.
126	'login_form_allow_autocomplete' => false,
127	);
128
129	/**
130	* Constructs a new authentication object.
131	*
132	* @access public
133	* @param optional array $params A hash containing parameters.
134	*/
135	public function __construct($namespace='')
136	{
137	$app =& App::getInstance();
138
139	$this->_ns = $namespace;
140
141	// Initialize default parameters.
142	$this->setParam($this->_default_params);
143
144	// Get create tables config from global context.
145	if (!is_null($app->getParam('db_create_tables'))) {
146	$this->setParam(array('create_table' => $app->getParam('db_create_tables')));
147	}
148
149	if (!isset($_SESSION['_auth_sql'][$this->_ns])) {
150	$this->clear();
151	}
152	}
153
154	/**
155	* Setup the database tables for this class.
156	*
157	* @access public
158	* @author Quinn Comendant <quinn@strangecode.com>
159	* @since 26 Aug 2005 17:09:36
160	*/
161	public function initDB($recreate_db=false)
162	{
163	$app =& App::getInstance();
164	$db =& DB::getInstance();
165
166	static $_db_tested = false;
167
168	if ($recreate_db \|\| !$_db_tested && $this->getParam('create_table')) {
169
170	// User table.
171	if ($recreate_db) {
172	$db->query("DROP TABLE IF EXISTS " . $this->getParam('db_table'));
173	$app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_table')), LOG_INFO, __FILE__, __LINE__);
174	}
175
176	// The minimal columns for a table compatible with the Auth_SQL class.
177	$db->query(sprintf(
178	"CREATE TABLE IF NOT EXISTS %1\$s (
179	%2\$s MEDIUMINT UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
180	%3\$s varchar(255) NOT NULL default '',
181	userpass VARCHAR(255) NOT NULL DEFAULT '',
182	userpass_hashtype TINYINT UNSIGNED NOT NULL DEFAULT '0',
183	first_name VARCHAR(50) NOT NULL DEFAULT '',
184	last_name VARCHAR(50) NOT NULL DEFAULT '',
185	email VARCHAR(255) NOT NULL DEFAULT '',
186	login_abuse_exempt ENUM('true') DEFAULT NULL,
187	blocked ENUM('true') DEFAULT NULL,
188	blocked_reason VARCHAR(255) NOT NULL DEFAULT '',
189	abuse_warning_level TINYINT NOT NULL DEFAULT '0',
190	seconds_online INT NOT NULL DEFAULT '0',
191	last_login_datetime DATETIME NOT NULL DEFAULT '%4\$s 00:00:00',
192	last_access_datetime DATETIME NOT NULL DEFAULT '%4\$s 00:00:00',
193	last_login_ip VARCHAR(45) NOT NULL DEFAULT '0.0.0.0',
194	added_by_user_id SMALLINT DEFAULT NULL,
195	modified_by_user_id SMALLINT DEFAULT NULL,
196	added_datetime DATETIME NOT NULL DEFAULT '%4\$s 00:00:00',
197	modified_datetime DATETIME NOT NULL DEFAULT '%4\$s 00:00:00',
198	KEY %5\$s (%5\$s),
199	KEY userpass (userpass),
200	KEY email (email),
201	KEY last_login_datetime (last_login_datetime),
202	KEY last_access_datetime (last_access_datetime)
203	)",
204	$db->escapeString($this->getParam('db_table')),
205	$this->getParam('db_primary_key'),
206	$this->getParam('db_username_column'),
207	$db->getParam('zero_date'),
208	$this->getParam('db_username_column')
209	));
210
211	if (!$db->columnExists($this->getParam('db_table'), array(
212	$this->getParam('db_primary_key'),
213	$this->getParam('db_username_column'),
214	'userpass',
215	'first_name',
216	'last_name',
217	'email',
218	'login_abuse_exempt',
219	'blocked',
220	'blocked_reason',
221	'abuse_warning_level',
222	'seconds_online',
223	'last_login_datetime',
224	'last_access_datetime',
225	'last_login_ip',
226	'added_by_user_id',
227	'modified_by_user_id',
228	'added_datetime',
229	'modified_datetime',
230	), false, false)) {
231	$app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), LOG_ALERT, __FILE__, __LINE__);
232	trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), E_USER_ERROR);
233	}
234
235	// Login table is used for abuse_detection features.
236	if ($this->getParam('abuse_detection')) {
237	if ($recreate_db) {
238	$db->query("DROP TABLE IF EXISTS " . $this->getParam('db_login_table'));
239	$app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_login_table')), LOG_INFO, __FILE__, __LINE__);
240	}
241	$db->query(sprintf(
242	"CREATE TABLE IF NOT EXISTS %1\$s (
243	%2\$s MEDIUMINT UNSIGNED NOT NULL DEFAULT '0',
244	login_datetime DATETIME NOT NULL DEFAULT '%3\$s 00:00:00',
245	remote_ip_binary CHAR(32) NOT NULL DEFAULT '',
246	KEY %4\$s (%4\$s),
247	KEY login_datetime (login_datetime),
248	KEY remote_ip_binary (remote_ip_binary)
249	)",
250	$this->getParam('db_login_table'),
251	$this->getParam('db_primary_key'),
252	$db->getParam('zero_date'),
253	$this->getParam('db_primary_key')
254	));
255
256	if (!$db->columnExists($this->getParam('db_login_table'), array(
257	$this->getParam('db_primary_key'),
258	'login_datetime',
259	'remote_ip_binary',
260	), false, false)) {
261	$app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), LOG_ALERT, __FILE__, __LINE__);
262	trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), E_USER_ERROR);
263	}
264	}
265	}
266	$_db_tested = true;
267	}
268
269	/**
270	* Set the params of an auth object.
271	*
272	* @param array $params Array of parameter keys and value to set.
273	* @return bool true on success, false on failure
274	*/
275	public function setParam($params)
276	{
277	$app =& App::getInstance();
278
279	if (isset($params['match_remote_ip_exempt_usernames'])) {
280	$params['match_remote_ip_exempt_usernames'] = array_map('strtolower', $params['match_remote_ip_exempt_usernames']);
281	}
282	if (isset($params['login_abuse_exempt_usernames'])) {
283	$params['login_abuse_exempt_usernames'] = array_map('strtolower', $params['login_abuse_exempt_usernames']);
284	}
285	if (isset($params['encryption_type'])) {
286	// Backwards misnomer compatibility.
287	$params['hash_type'] = $params['encryption_type'];
288	}
289	if (isset($params['hash_type']) && version_compare(PHP_VERSION, '5.5.0', '<') && in_array($params['hash_type'], array(self::ENCRYPT_PASSWORD_BCRYPT, self::ENCRYPT_PASSWORD_DEFAULT))) {
290	// These hash types require the password_* userland lib in PHP < 5.5.0
291	$pw_compat_lib = 'vendor/ircmaxell/password-compat/lib/password.php';
292	if (false !== stream_resolve_include_path($pw_compat_lib)) {
293	include_once $pw_compat_lib;
294	} else {
295	$app->logMsg(sprintf('Hash type %s requires password-compat lib in PHP < 5.5.0; falling back to ENCRYPT_SHA1_HARDENED', $params['hash_type']), LOG_ERR, __FILE__, __LINE__);
296	$params['hash_type'] = self::ENCRYPT_SHA1_HARDENED;
297	}
298	}
299	if (isset($params['hash_type']) && !in_array($params['hash_type'], array(self::ENCRYPT_PLAINTEXT, self::ENCRYPT_CRYPT, self::ENCRYPT_SHA1, self::ENCRYPT_SHA1_HARDENED, self::ENCRYPT_MD5, self::ENCRYPT_MD5_HARDENED, self::ENCRYPT_PASSWORD_BCRYPT, self::ENCRYPT_PASSWORD_DEFAULT))) {
300	$app->logMsg(sprintf('Invalid hash type %s; falling back to ENCRYPT_SHA1_HARDENED', $params['hash_type']), LOG_ERR, __FILE__, __LINE__);
301	$params['hash_type'] = self::ENCRYPT_SHA1_HARDENED;
302	}
303	if (isset($params) && is_array($params)) {
304	// Merge new parameters with old overriding only those passed.
305	$this->_params = array_merge($this->_params, $params);
306	}
307	}
308
309	/**
310	* Return the value of a parameter, if it exists.
311	*
312	* @access public
313	* @param string $param Which parameter to return.
314	* @return mixed Configured parameter value.
315	*/
316	public function getParam($param)
317	{
318	$app =& App::getInstance();
319
320	if (array_key_exists($param, $this->_params)) {
321	return $this->_params[$param];
322	} else {
323	$app->logMsg(sprintf('Parameter is not set: %s', $param), LOG_DEBUG, __FILE__, __LINE__);
324	return null;
325	}
326	}
327
328	/**
329	* Clear any authentication tokens in the current session. A.K.A. logout.
330	*
331	* @access public
332	*/
333	public function clear()
334	{
335	$db =& DB::getInstance();
336
337	if ($this->get('user_id', false)) {
338
339	$this->initDB();
340
341	// FIX ME: Should we check if the session is active?
342	$db->query(sprintf(
343	"UPDATE %s SET
344	seconds_online = seconds_online + ABS(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)),
345	last_login_datetime = '%s 00:00:00'
346	WHERE %s = '%s'
347	",
348	$this->_params['db_table'],
349	$db->getParam('zero_date'),
350	$this->_params['db_primary_key'],
351	$this->get('user_id')
352	));
353	}
354	$_SESSION['_auth_sql'][$this->_ns] = array(
355	'authenticated' => false,
356	'user_id' => null,
357	'username' => null,
358	'login_datetime' => null,
359	'last_access_datetime' => null,
360	'remote_ip' => getRemoteAddr(),
361	'login_abuse_exempt' => null,
362	'match_remote_ip_exempt'=> null,
363	'user_data' => null,
364	);
365	}
366
367	/**
368	* Sets a variable into a registered auth session.
369	*
370	* @access public
371	* @param mixed $key Which value to set.
372	* @param mixed $val Value to set variable to.
373	*/
374	public function set($key, $val)
375	{
376	if (!isset($_SESSION['_auth_sql'][$this->_ns]['user_data'])) {
377	$_SESSION['_auth_sql'][$this->_ns]['user_data'] = array();
378	}
379	$_SESSION['_auth_sql'][$this->_ns]['user_data'][$key] = $val;
380	}
381
382	/**
383	* Returns a specified value from a registered auth session.
384	*
385	* @access public
386	* @param mixed $key Which value to return.
387	* @param mixed $default Value to return if key not found in user_data.
388	* @return mixed Value stored in session.
389	*/
390	public function get($key, $default='')
391	{
392	if (isset($_SESSION['_auth_sql'][$this->_ns][$key])) {
393	return $_SESSION['_auth_sql'][$this->_ns][$key];
394	} else if (isset($_SESSION['_auth_sql'][$this->_ns]['user_data'][$key])) {
395	return $_SESSION['_auth_sql'][$this->_ns]['user_data'][$key];
396	} else {
397	return $default;
398	}
399	}
400
401	/**
402	* Retrieve and verify the given username and password against a matching user record in the database.
403	*
404	* @access private
405	* @param string $username The username to check.
406	* @param string $password The password to compare to username.
407	* @return mixed False if credentials not found in DB, or returns DB row matching credentials.
408	*/
409	public function authenticate($username, $password)
410	{
411	$app =& App::getInstance();
412	$db =& DB::getInstance();
413
414	$this->initDB();
415
416	// Get user data for specified username.
417	$qid = $db->query("
418	SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
419	FROM " . $this->_params['db_table'] . "
420	WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
421	");
422	if (!$user_data = mysql_fetch_assoc($qid)) {
423	$app->logMsg(sprintf('Username %s not found for authentication', $username), LOG_NOTICE, __FILE__, __LINE__);
424	return false;
425	}
426
427	// Check given password against hashed DB password.
428	$old_hash_type = isset($user_data['userpass_hashtype']) && !empty($user_data['userpass_hashtype']) ? $user_data['userpass_hashtype'] : $this->getParam('hash_type');
429	if ($this->verifyPassword($password, $user_data['userpass'], $old_hash_type)) {
430	$app->logMsg(sprintf('Authentication successful for %s (user_id=%s)', $username, $user_data['user_id']), LOG_INFO, __FILE__, __LINE__);
431	unset($user_data['userpass']); // Avoid revealing the encrypted password in the $user_data.
432	if ($this->getParam('hash_type_autoupdate') && $old_hash_type != $this->getParam('hash_type')) {
433	// Let's update user's password hash to new type (just run setPassword with this authenticated passwordâŠ).
434	$this->setPassword($user_data['user_id'], $password);
435	$app->logMsg(sprintf('User %s password hash type updated from %s to %s', $username, $old_hash_type, $this->getParam('hash_type')), LOG_INFO, __FILE__, __LINE__);
436	}
437	return $user_data;
438	}
439
440	$app->logMsg(sprintf('Authentication failed for %s (user_id=%s)', $username, $user_data['user_id']), LOG_NOTICE, __FILE__, __LINE__);
441	return false;
442	}
443
444	/**
445	* Check username and password, and create new session if authenticated.
446	*
447	* @access private
448	* @param string $username The username to check.
449	* @param string $password The password to compare for username.
450	* @return boolean Whether or not the credentials are valid.
451	*/
452	public function login($username, $password)
453	{
454	$app =& App::getInstance();
455	$db =& DB::getInstance();
456
457	if ($user_data = $this->authenticate($username, $password)) {
458	// The credentials match. Now setup the session.
459	return $this->createSession($user_data);
460	}
461	// No login: failed authentication!
462	return false;
463	}
464
465	/**
466	* Create new login session for given user.
467	*
468	* @access private
469	* @param string $user_data User data that is normally returned from this->authenticate(). If provided manually:
470	* Required array values:
471	* 'user_id' => '1'
472	* 'username' => 'name'
473	* Optional array values:
474	* 'match_remote_ip_exempt' => true
475	* 'login_abuse_exempt' => true
476	* 'abuse_warning_level' => true
477	* 'blocked' => true
478	* 'blocked_reason' => ''
479	* 'âŠ' => 'âŠ' (any other values that should be retrievable via this->get())
480	* @return boolean Whether or not the session was created. It will return true unless abuse detection is enabled and triggered.
481	*/
482	public function createSession($user_data)
483	{
484	$app =& App::getInstance();
485	$db =& DB::getInstance();
486
487	$this->initDB();
488
489	$this->clear();
490
491	// Convert 'priv' to 'user_type' nomenclature to support older implementations.
492	if (isset($user_data['priv'])) {
493	$user_data['user_type'] = $user_data['priv'];
494	}
495
496	// Register authenticated session.
497	$_SESSION['_auth_sql'][$this->_ns] = array(
498	'authenticated' => true,
499	'user_id' => $user_data['user_id'],
500	'username' => $user_data['username'],
501	'login_datetime' => date('Y-m-d H:i:s'),
502	'last_access_datetime' => date('Y-m-d H:i:s'),
503	'remote_ip' => getRemoteAddr(),
504	'login_abuse_exempt' => isset($user_data['login_abuse_exempt']) ? !empty($user_data['login_abuse_exempt']) : in_array(strtolower($user_data['username']), $this->_params['login_abuse_exempt_usernames']),
505	'match_remote_ip_exempt'=> isset($user_data['match_remote_ip_exempt']) ? !empty($user_data['match_remote_ip_exempt']) : in_array(strtolower($user_data['username']), $this->_params['match_remote_ip_exempt_usernames']),
506	'user_data' => $user_data
507	);
508
509	/**
510	* Check if the account is blocked, respond in context to reason. Cancel the login if blocked.
511	*/
512	if ($this->getParam('blocking')) {
513	if (isset($user_data['blocked']) && !empty($user_data['blocked'])) {
514	switch ($this->get('blocked_reason')) {
515	case 'account abuse' :
516	$app->raiseMsg(sprintf(_("This account has been blocked due to possible account abuse. Please contact an administrator to reactivate."), null), MSG_WARNING, __FILE__, __LINE__);
517	break;
518	default :
519	$app->raiseMsg(sprintf(_("This account is currently not active. %s"), $this->get('blocked_reason')), MSG_WARNING, __FILE__, __LINE__);
520	break;
521	}
522
523	// No login: user is blocked!
524	$app->logMsg(sprintf('User_id %s (%s) login failed due to blocked account: %s', $this->get('user_id'), $this->get('username'), $this->get('blocked_reason')), LOG_NOTICE, __FILE__, __LINE__);
525	$this->clear();
526	return false;
527	}
528	}
529
530	/**
531	* Check the db_login_table for too many logins under this account.
532	* (1) Count the number of unique IP addresses that logged in under this user within the login_abuse_timeframe
533	* (2) If this number exceeds the login_abuse_max_ips, assume multiple people are logging in under the same account.
534	**/
535	// TODO: make this ipv6 compatible. At the moment, ipv6 addresses are converted into zero for remote_ip_binary.
536	// http://www.highonphp.com/5-tips-for-working-with-ipv6-in-php
537	// https://stackoverflow.com/questions/444966/working-with-ipv6-addresses-in-php
538	if ($this->getParam('abuse_detection') && !$this->get('login_abuse_exempt')) {
539	$qid = $db->query("
540	SELECT COUNT(DISTINCT LEFT(remote_ip_binary, " . $this->_params['login_abuse_ip_bitmask'] . "))
541	FROM " . $this->_params['db_login_table'] . "
542	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
543	AND DATE_ADD(login_datetime, INTERVAL '" . $this->_params['login_abuse_timeframe'] . "' DAY_HOUR) > NOW()
544	");
545	list($distinct_ips) = mysql_fetch_row($qid);
546	if ($distinct_ips > $this->_params['login_abuse_max_ips']) {
547	if ($this->get('abuse_warning_level') < $this->_params['login_abuse_warnings']) {
548	// Warn the user with a password reset.
549	$this->resetPassword(null, _("This is a security precaution. We have detected this account has been accessed from multiple computers simultaneously. It is against policy to share credentials with others. If further account abuse is detected this account will be blocked."));
550	$app->raiseMsg(_("Your password has been reset as a security precaution. Please check your email for more information."), MSG_NOTICE, __FILE__, __LINE__);
551	$app->logMsg(sprintf('Account abuse detected for user_id %s (%s) from IP %s', $this->get('user_id'), $this->get('username'), $this->get('remote_ip')), LOG_WARNING, __FILE__, __LINE__);
552	} else {
553	// Block the account with the reason of account abuse.
554	$this->blockAccount(null, 'account abuse');
555	$app->raiseMsg(_("Your account has been blocked as a security precaution. Please contact us for more information."), MSG_NOTICE, __FILE__, __LINE__);
556	$app->logMsg(sprintf('Account blocked for user_id %s (%s) from IP %s', $this->get('user_id'), $this->get('username'), $this->get('remote_ip')), LOG_ALERT, __FILE__, __LINE__);
557	}
558	// Increment user's warning level.
559	$db->query("UPDATE " . $this->_params['db_table'] . " SET abuse_warning_level = abuse_warning_level + 1 WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'");
560	// Reset the login counter for this user.
561	$db->query("DELETE FROM " . $this->_params['db_login_table'] . " WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'");
562	// No login: reset password because of account abuse!
563	$this->clear();
564	return false;
565	}
566
567	// Update the login counter table with this login access. Convert IP to binary.
568	// TODO: this query could benefit from INSERT DELAYED.
569	$db->query("
570	INSERT INTO " . $this->_params['db_login_table'] . " (
571	" . $this->_params['db_primary_key'] . ",
572	login_datetime,
573	remote_ip_binary
574	) VALUES (
575	'" . $this->get('user_id') . "',
576	'" . $this->get('login_datetime') . "',
577	'" . sprintf('%032b', ip2long($this->get('remote_ip'))) . "'
578	)
579	");
580	}
581
582	// Update user table with this login.
583	$db->query("
584	UPDATE " . $this->_params['db_table'] . " SET
585	last_login_datetime = '" . $this->get('login_datetime') . "',
586	last_access_datetime = '" . $this->get('login_datetime') . "',
587	last_login_ip = '" . $this->get('remote_ip') . "'
588	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
589	");
590
591	// Session created! We're logged-in!
592	return true;
593	}
594
595	/**
596	* Test if user has a currently logged-in session.
597	* - authentication flag set to true
598	* - username not empty
599	* - total logged-in time is not greater than login_timeout
600	* - idle time is not greater than idle_timeout
601	* - remote address is the same as the login remote address
602	*
603	* @access public
604	*/
605	public function isLoggedIn($user_id=null)
606	{
607	$app =& App::getInstance();
608	$db =& DB::getInstance();
609
610	$this->initDB();
611
612	if (isset($user_id)) {
613	// Check the login status of a specific user.
614	$qid = $db->query("
615	SELECT 1 FROM " . $this->_params['db_table'] . "
616	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
617	AND last_login_datetime > DATE_SUB(NOW(), INTERVAL '" . $this->_params['login_timeout'] . "' SECOND)
618	AND last_access_datetime > DATE_SUB(NOW(), INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND)
619	");
620	$login_status = (mysql_num_rows($qid) > 0);
621	$app->logMsg(sprintf('Returning %s login status for user_id %s', ($login_status ? 'true' : 'false'), $user_id), LOG_DEBUG, __FILE__, __LINE__);
622	return $login_status;
623	}
624
625	// User login test need only be run once per script execution. We cache the result in the session.
626	if ($this->_authentication_tested && isset($_SESSION['_auth_sql'][$this->_ns]['authenticated'])) {
627	$app->logMsg(sprintf('Returning cached authentication status: %s', ($_SESSION['_auth_sql'][$this->_ns]['authenticated'] ? 'true' : 'false')), LOG_DEBUG, __FILE__, __LINE__);
628	return $_SESSION['_auth_sql'][$this->_ns]['authenticated'];
629	}
630
631	// Testing login should occur once. This is the first time. Set flag.
632	$this->_authentication_tested = true;
633
634	// Some users will access from networks with a changing IP number (i.e. behind a proxy server).
635	// These users must be allowed entry by adding their IP to the list of trusted_networks, or their usernames to the list of match_remote_ip_exempt_usernames.
636	if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
637	$user_in_trusted_network = true;
638	$app->logMsg(sprintf('User_id %s accessing from trusted network %s',
639	($this->get('user_id') ? $this->get('user_id') . ' (' . $this->get('username') . ')' : 'unknown'),
640	$trusted_net
641	), LOG_DEBUG, __FILE__, __LINE__);
642	} else {
643	$user_in_trusted_network = false;
644	}
645
646	// Do we match the user's remote IP at all? Yes, if set in config and not disabled for specific user.
647	if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt')) {
648	$remote_ip_is_matched = (isset($_SESSION['_auth_sql'][$this->_ns]['remote_ip']) && $_SESSION['_auth_sql'][$this->_ns]['remote_ip'] == getRemoteAddr()) \|\| $user_in_trusted_network;
649	} else {
650	$app->logMsg(sprintf('User_id %s exempt from remote_ip match (comparing %s == %s)',
651	($this->get('user_id') ? $this->get('user_id') . ' (' . $this->get('username') . ')' : 'unknown'),
652	$_SESSION['_auth_sql'][$this->_ns]['remote_ip'],
653	getRemoteAddr()
654	), LOG_DEBUG, __FILE__, __LINE__);
655	$remote_ip_is_matched = true;
656	}
657
658	// Test login with information stored in session. Skip IP matching for users from trusted networks.
659	if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated'])
660	&& true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']
661	&& isset($_SESSION['_auth_sql'][$this->_ns]['username'])
662	&& !empty($_SESSION['_auth_sql'][$this->_ns]['username'])
663	&& isset($_SESSION['_auth_sql'][$this->_ns]['login_datetime'])
664	&& strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) > (time() - $this->_params['login_timeout'])
665	&& isset($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'])
666	&& strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > (time() - $this->_params['idle_timeout'])
667	&& $remote_ip_is_matched
668	) {
669	// User is authenticated!
670	$_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'] = date('Y-m-d H:i:s');
671
672	// Update the DB with the last_access_datetime and increment the seconds_online.
673	$db->query("
674	UPDATE " . $this->_params['db_table'] . " SET
675	seconds_online = seconds_online + ABS(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)) + 1,
676	last_access_datetime = '" . $this->get('last_access_datetime') . "'
677	WHERE " . $this->_params['db_primary_key'] . " = '" . $this->get('user_id') . "'
678	");
679	if (mysql_affected_rows($db->getDBH()) > 0) {
680	// User record still exists in DB. Do this to ensure user was not delete from DB between accesses. Notice "+ 1" in SQL above to ensure record is modified.
681	return true;
682	} else {
683	$app->logMsg(sprintf('Session update failed; record not found for user_id %s (%s).', $this->get('user_id'), $this->get('username')), LOG_NOTICE, __FILE__, __LINE__);
684	}
685	} else if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated']) && true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']) {
686	// User is authenticated, but login has expired.
687
688	// Log the reason for login expiration.
689	$expire_reasons = array();
690	$user_notified = false;
691	if (!isset($_SESSION['_auth_sql'][$this->_ns]['username']) \|\| empty($_SESSION['_auth_sql'][$this->_ns]['username'])) {
692	$expire_reasons[] = 'username not found';
693	}
694	if (!isset($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) \|\| strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) <= (time() - $this->_params['login_timeout'])) {
695	$expire_reasons[] = sprintf('login_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['login_datetime'], $this->_params['login_timeout']);
696	}
697	if (!isset($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) \|\| strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) <= (time() - $this->_params['idle_timeout'])) {
698	$expire_reasons[] = sprintf('idle_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'], $this->_params['idle_timeout']);
699	if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > (time() - 43200)) {
700	// Only raise message if last session is less than 12 hours old.
701	// Notify user why they were logged out if they haven't yet been given a reason.
702	$user_notified \|\| $app->raiseMsg(sprintf(_("For your safety we logged you out after being idle for %s. Please log in again."), humanTime($this->_params['idle_timeout'], 'hour', '%01.0f')), MSG_NOTICE, __FILE__, __LINE__);
703	$user_notified = true;
704	}
705	}
706	if (!isset($_SESSION['_auth_sql'][$this->_ns]['remote_ip']) \|\| $_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr()) {
707	if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt') && !$user_in_trusted_network) {
708	// There are three cases when a remote IP match will be the cause of a session termination:
709	// 1. match_remote_ip config is enabled
710	// 2. user is not match_remote_ip_exempt (set in the user_data, or in the match_remote_ip_exempt_usernames list)
711	// 3. the user is connecting from a trusted network (their IP is listed in the trusted_networks)
712	$expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION['_auth_sql'][$this->_ns]['remote_ip'], getRemoteAddr());
713	// Notify user why they were logged out if they haven't yet been given a reason.
714	$user_notified \|\| $app->raiseMsg(sprintf(_("For your safety we logged you out because your IP address has changed. Please log in again."), null), MSG_NOTICE, __FILE__, __LINE__);
715	$user_notified = true;
716	} else {
717	$expire_reasons[] = sprintf('remote_ip not matched but user was exempt from this check (%s != %s)', $_SESSION['_auth_sql'][$this->_ns]['remote_ip'], getRemoteAddr());
718	}
719	}
720	$app->logMsg(sprintf('User_id %s (%s) session expired: %s', $this->get('user_id'), $this->get('username'), join(', ', $expire_reasons)), LOG_INFO, __FILE__, __LINE__);
721	} else {
722	$app->logMsg('Session is not authenticated', LOG_DEBUG, __FILE__, __LINE__);
723	}
724
725	// User is not authenticated.
726	$this->clear();
727	return false;
728	}
729
730	/**
731	* Redirect user to login page if they are not logged in.
732	*
733	* @param string $message The text description of a message to raise.
734	* @param int $type The type of message: MSG_NOTICE,
735	* MSG_SUCCESS, MSG_WARNING, or MSG_ERR.
736	* @param string $file __FILE__.
737	* @param string $line __LINE__.
738	* @access public
739	*/
740	public function requireLogin($message='', $type=MSG_NOTICE, $file=null, $line=null)
741	{
742	$app =& App::getInstance();
743
744	if (!$this->isLoggedIn()) {
745	// Display message for requiring login. (RaiseMsg will ignore empty strings.)
746	if ('' != $message) {
747	$app->raiseMsg($message, $type, $file, $line);
748	}
749
750	// Login scripts must have the same 'login' tag for boomerangURL verification/manipulation.
751	$app->setBoomerangURL(absoluteMe(), 'login');
752	$app->dieURL($this->_params['login_url']);
753	}
754	}
755
756	/**
757	* This sets the 'blocked' field for a user in the db_table, and also
758	* adds an optional reason
759	*
760	* @param string $reason The reason for blocking the account.
761	*/
762	public function blockAccount($user_id=null, $reason='')
763	{
764	$app =& App::getInstance();
765	$db =& DB::getInstance();
766
767	$this->initDB();
768
769	if ($this->getParam('blocking')) {
770	if (mb_strlen($db->escapeString($reason)) > 255) {
771	// blocked_reason field is varchar(255).
772	$app->logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
773	}
774
775	// Get user_id if specified.
776	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
777	$db->query("
778	UPDATE " . $this->_params['db_table'] . " SET
779	blocked = 'true',
780	blocked_reason = '" . $db->escapeString($reason) . "'
781	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
782	");
783	}
784	}
785
786	/**
787	* Tests if the "blocked" flag is set for a user.
788	*
789	* @param int $user_id User id to look for.
790	* @return boolean True if the user is blocked, false otherwise.
791	*/
792	public function isBlocked($user_id=null)
793	{
794	$db =& DB::getInstance();
795
796	$this->initDB();
797
798	if ($this->getParam('blocking')) {
799	// Get user_id if specified.
800	$user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
801	$qid = $db->query("
802	SELECT 1
803	FROM " . $this->_params['db_table'] . "
804	WHERE blocked = 'true'
805	AND " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
806	");
807	return mysql_num_rows($qid) === 1;
808	}
809	}
810
811	/**
812	* Unblocks a user in the db_table, and clears any blocked_reason.
813	*/
814	public function unblockAccount($user_id=null)
815	{
816	$db =& DB::getInstance();
817
818	$this->initDB();
819
820	if ($this->getParam('blocking')) {
821	// Get user_id if specified.
822	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
823	$db->query("
824	UPDATE " . $this->_params['db_table'] . " SET
825	blocked = '',
826	blocked_reason = ''
827	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
828	");
829	}
830	}
831
832	/**
833	* Returns true if username already exists in database.
834	*
835	* @param string $username Username to look for.
836	* @return bool True if username exists.
837	*/
838	public function usernameExists($username)
839	{
840	$db =& DB::getInstance();
841
842	$this->initDB();
843
844	$qid = $db->query("
845	SELECT 1
846	FROM " . $this->_params['db_table'] . "
847	WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
848	");
849	return (mysql_num_rows($qid) > 0);
850	}
851
852	/**
853	* Returns a username for a specified user id.
854	*
855	* @param string $user_id User id to look for.
856	* @return string Username, or false if none found.
857	*/
858	public function getUsername($user_id)
859	{
860	$db =& DB::getInstance();
861
862	$this->initDB();
863
864	$qid = $db->query("
865	SELECT " . $this->_params['db_username_column'] . "
866	FROM " . $this->_params['db_table'] . "
867	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
868	");
869	if (list($username) = mysql_fetch_row($qid)) {
870	return $username;
871	} else {
872	return false;
873	}
874	}
875
876	/*
877	* Generate a cryptographically secure, random password.
878	*
879	* @access public
880	* @param int $bytes Length of password (in bytes)
881	* @return string Random string of characters.
882	* @author Quinn Comendant <quinn@strangecode.com>
883	* @version 1.0
884	* @since 15 Nov 2014 20:30:27
885	*/
886	public function generatePassword($bytes=10)
887	{
888	$app =& App::getInstance();
889
890	$bytes = is_numeric($bytes) ? $bytes : 10;
891	$string = strtok(base64_encode(openssl_random_pseudo_bytes($bytes, $strong)), '=');
892	if (!$strong) {
893	$app->logMsg(sprintf('Password generated was not "cryptographically strong"; check your openssl.', null), LOG_NOTICE, __FILE__, __LINE__);
894	}
895
896	return $string;
897	}
898
899	/**
900	*
901	*/
902	public function encryptPassword($password, $salt=null, $hash_type=null)
903	{
904	$app =& App::getInstance();
905
906	$password = (string)$password;
907
908	// Existing password hashes rely on the same key/salt being used to compare hashs.
909	// Don't change this (or the value applied to signing_key) unless you know existing hashes or signatures will not be affected!
910	$more_salt = 'B36D18E5-3FE4-4D58-8150-F26642852B81';
911
912	$hash_type = isset($hash_type) && !empty($hash_type) ? $hash_type : $this->getParam('hash_type');
913
914	switch ($hash_type) {
915	case self::ENCRYPT_PLAINTEXT :
916	$encrypted_password = $password;
917	break;
918
919	case self::ENCRYPT_CRYPT :
920	// If comparing password with an existing hashed password, provide the hashed password as the salt.
921	$encrypted_password = isset($salt) ? crypt($password, $salt) : crypt($password);
922	break;
923
924	case self::ENCRYPT_SHA1 :
925	$encrypted_password = sha1($password);
926	break;
927
928	case self::ENCRYPT_SHA1_HARDENED :
929	$encrypted_password = sha1($app->getParam('signing_key') . $password . $more_salt);
930	for ($i=0; $i < pow(2, 20); $i++) {
931	$encrypted_password = sha1($password . $encrypted_password);
932	}
933	break;
934
935	case self::ENCRYPT_MD5 :
936	$encrypted_password = md5($password);
937	break;
938
939	case self::ENCRYPT_MD5_HARDENED :
940	$encrypted_password = md5($app->getParam('signing_key') . $password . $more_salt);
941	for ($i=0; $i < pow(2, 20); $i++) {
942	$encrypted_password = md5($password . $encrypted_password);
943	}
944	break;
945
946	case self::ENCRYPT_PASSWORD_BCRYPT :
947	$encrypted_password = password_hash($password, PASSWORD_BCRYPT, array('cost' => 12));
948	break;
949
950	case self::ENCRYPT_PASSWORD_DEFAULT :
951	$encrypted_password = password_hash($password, PASSWORD_DEFAULT, array('cost' => 12));
952	break;
953
954	default :
955	$app->logMsg(sprintf('Unknown hash type: %s', $hash_type), LOG_WARNING, __FILE__, __LINE__);
956	return false;
957	}
958
959	// In case our hashing function returns 'false' or another empty value, bail out.
960	if ('' == trim((string)$encrypted_password)) {
961	$app->logMsg(sprintf('Invalid password hash returned ("%s") for hash type %s; check yo crypto!', $encrypted_password, $hash_type), LOG_ALERT, __FILE__, __LINE__);
962	return false;
963	}
964
965	return $encrypted_password;
966	}
967
968	/*
969	*
970	*
971	* @access public
972	* @param
973	* @return
974	* @author Quinn Comendant <quinn@strangecode.com>
975	* @version 1.0
976	* @since 15 Nov 2014 21:37:28
977	*/
978	public function verifyPassword($password, $encrypted_password, $hash_type=null)
979	{
980	$app =& App::getInstance();
981
982	$hash_type = isset($hash_type) && !empty($hash_type) ? $hash_type : $this->getParam('hash_type');
983
984	switch ($hash_type) {
985	case self::ENCRYPT_CRYPT :
986	return $this->encryptPassword($password, $encrypted_password, $hash_type) == $encrypted_password;
987
988	case self::ENCRYPT_PLAINTEXT :
989	case self::ENCRYPT_MD5 :
990	case self::ENCRYPT_MD5_HARDENED :
991	case self::ENCRYPT_SHA1 :
992	case self::ENCRYPT_SHA1_HARDENED :
993	return $this->encryptPassword($password, $encrypted_password, $hash_type) == $encrypted_password;
994
995	case self::ENCRYPT_PASSWORD_BCRYPT :
996	case self::ENCRYPT_PASSWORD_DEFAULT :
997	return password_verify($password, $encrypted_password);
998
999	default :
1000	$app->logMsg(sprintf('Unknown hash type: %s', $hash_type), LOG_WARNING, __FILE__, __LINE__);
1001	return false;
1002	}
1003
1004	}
1005
1006	/**
1007	*
1008	*/
1009	public function setPassword($user_id=null, $password, $hash_type=null)
1010	{
1011	$app =& App::getInstance();
1012	$db =& DB::getInstance();
1013
1014	$this->initDB();
1015
1016	// Get user_id if specified.
1017	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
1018
1019	// New hash type.
1020	$hash_type = isset($hash_type) ? $hash_type : $this->getParam('hash_type');
1021
1022	// Save the hash method used if a table exists for it.
1023	$userpass_hashtype_clause = '';
1024	if ($db->columnExists($this->_params['db_table'], 'userpass_hashtype', false)) {
1025	$userpass_hashtype_clause = ", userpass_hashtype = '" . $db->escapeString($hash_type) . "'";
1026	}
1027
1028	// Issue the password change query.
1029	$db->query("
1030	UPDATE " . $this->_params['db_table'] . " SET
1031	userpass = '" . $db->escapeString($this->encryptPassword($password, null, $hash_type)) . "',
1032	modified_datetime = NOW(),
1033	modified_by_user_id = '" . $db->escapeString($user_id) . "'
1034	$userpass_hashtype_clause
1035	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
1036	");
1037
1038	if (mysql_affected_rows($db->getDBH()) != 1) {
1039	$app->logMsg(sprintf('Failed to update password for user_id %s (no affected rows)', $user_id), LOG_WARNING, __FILE__, __LINE__);
1040	return false;
1041	}
1042
1043	$app->logMsg(sprintf('Password change successful for user_id %s', $user_id), LOG_INFO, __FILE__, __LINE__);
1044	return true;
1045	}
1046
1047	/**
1048	* Resets the password for the user with the specified id.
1049	*
1050	* @param string $user_id The id of the user to reset.
1051	* @param string $reason Additional message to add to the reset email.
1052	* @return string The user's new password.
1053	*/
1054	public function resetPassword($user_id=null, $reason='')
1055	{
1056	$app =& App::getInstance();
1057	$db =& DB::getInstance();
1058
1059	$this->initDB();
1060
1061	// Get user_id if specified.
1062	$user_id = isset($user_id) ? $user_id : $this->get('user_id');
1063
1064	// Reset password of a specific user.
1065	$qid = $db->query("
1066	SELECT * FROM " . $this->_params['db_table'] . "
1067	WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
1068	");
1069	if (!$user_data = mysql_fetch_assoc($qid)) {
1070	$app->logMsg(sprintf('Reset password failed. User_id %s not found.', $user_id), LOG_NOTICE, __FILE__, __LINE__);
1071	return false;
1072	}
1073
1074	// Get new password.
1075	$password = $this->generatePassword();
1076
1077	// Update password query.
1078	$this->setPassword($user_id, $password);
1079
1080	// Make sure user has an email on record before continuing.
1081	if (!isset($user_data['email']) \|\| '' == trim($user_data['email'])) {
1082	$app->logMsg(sprintf('Password reset but notification failed, no email address for user_id %s (%s).', $user_data[$this->_params['db_primary_key']], $user_data[$this->_params['db_username_column']]), LOG_NOTICE, __FILE__, __LINE__);
1083	} else {
1084	// Send the new password in an email.
1085	$email = new Email(array(
1086	'to' => $user_data['email'],
1087	'from' => sprintf('"%s" <%s>', addcslashes($app->getParam('site_name'), '"'), $app->getParam('site_email')),
1088	'subject' => sprintf('%s password change', $app->getParam('site_name'))
1089	));
1090	$email->setTemplate('codebase/services/templates/email_reset_password.txt');
1091	$email->replace(array(
1092	'SITE_NAME' => $app->getParam('site_name'),
1093	'SITE_URL' => $app->getParam('site_url'),
1094	'SITE_EMAIL' => $app->getParam('site_email'),
1095	'NAME' => ('' != $user_data['first_name'] . $user_data['last_name'] ? $user_data['first_name'] . ' ' . $user_data['last_name'] : $user_data[$this->_params['db_username_column']]),
1096	'USERNAME' => $user_data[$this->_params['db_username_column']],
1097	'PASSWORD' => $password,
1098	'REASON' => ('' == trim($reason) ? '' : trim($reason) . ' '), // Add a space after the reason if it exists for better formatting.
1099	));
1100	$email->send();
1101	}
1102
1103	return array(
1104	'username' => $user_data[$this->_params['db_username_column']],
1105	'userpass' => $password
1106	);
1107	}
1108
1109	} // end class

Note: See TracBrowser for help on using the repository browser.

Download in other formats: