| [ Index ] |
|
Code source de Dotclear 2.0-beta6 |
1 <?php 2 # ***** BEGIN LICENSE BLOCK ***** 3 # This file is part of DotClear. 4 # Copyright (c) 2005 Olivier Meunier and contributors. All rights 5 # reserved. 6 # 7 # DotClear is free software; you can redistribute it and/or modify 8 # it under the terms of the GNU General Public License as published by 9 # the Free Software Foundation; either version 2 of the License, or 10 # (at your option) any later version. 11 # 12 # DotClear is distributed in the hope that it will be useful, 13 # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 # GNU General Public License for more details. 16 # 17 # You should have received a copy of the GNU General Public License 18 # along with DotClear; if not, write to the Free Software 19 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 # 21 # ***** END LICENSE BLOCK ***** 22 23 /** 24 @ingroup DC_CORE 25 @nosubgrouping 26 @brief Authentication and user credentials management 27 28 dcAuth is a class used to handle everything related to user authentication 29 and credentials. Object is provided by dcCore $auth property. 30 */ 31 class dcAuth 32 { 33 protected $con; ///< <b>connection</b> Database connection object 34 35 protected $user_table; ///< <b>string</b> User table name 36 protected $perm_table; ///< <b>string</b> Perm table name 37 38 protected $user_id; ///< <b>string</b> Current user ID 39 protected $user_info = array(); ///< <b>array</b> Array with user information 40 protected $user_options = array(); ///< <b>a<rray</b> Array with user options 41 protected $user_admin; ///< <b>boolean</b> User is super admin 42 protected $permissions = array(); ///< <b>array</b> Permissions for each blog 43 protected $allow_pass_change = true; ///< <b>boolean</b> User can change its password 44 45 protected $perm_types; ///< <b>array</b> Permission types 46 47 /** 48 Class constructor. Takes dcCore object as single argument. 49 50 @param core <b>dcCore</b> dcCore object 51 */ 52 public function __construct(&$core) 53 { 54 $this->core =& $core; 55 $this->con =& $core->con; 56 $this->blog_table = $core->prefix.'blog'; 57 $this->user_table = $core->prefix.'user'; 58 $this->perm_table = $core->prefix.'permissions'; 59 60 $this->perm_types = array( 61 'admin' => __('administrator'), 62 'usage' => __('manage their own entries and comments'), 63 'publish' => __('publish entries and comments'), 64 'delete' => __('delete entries and comments'), 65 'contentadmin' => __('manage all entries and comments'), 66 'categories' => __('manage categories'), 67 'media' => __('manage their own media items'), 68 'media_admin' => __('manage all media items') 69 ); 70 } 71 72 /// @name Credentials and user permissions 73 //@{ 74 /** 75 Checks if user exists and can log in. <var>$pwd</var> argument is optionnal 76 while you may need to check user without password. This method will create 77 credentials and populate all needed object properties. 78 79 @param user_id <b>string</b> User ID 80 @param pwd <b>string</b> User password 81 @param user_key <b>string</b> User key check 82 @return <b>boolean</b> 83 */ 84 public function checkUser($user_id, $pwd=null, $user_key=null) 85 { 86 # Check user and password 87 $strReq = 'SELECT user_id, user_super, user_pwd, user_name, '. 88 'user_firstname, user_displayname, user_email, user_url, '. 89 'user_default_blog, user_options, '. 90 'user_lang, user_tz, user_post_status, user_creadt, user_upddt '. 91 'FROM '.$this->con->escapeSystem($this->user_table).' '. 92 "WHERE user_id = '".$this->con->escape($user_id)."' "; 93 94 $rs = $this->con->select($strReq); 95 96 if ($rs->isEmpty()) { 97 return false; 98 } 99 100 $rs->extend('rsExtUser'); 101 102 if ($pwd != '') 103 { 104 if (crypt::hmac(DC_MASTER_KEY,$pwd) != $rs->user_pwd) { 105 sleep(rand(2,5)); 106 return false; 107 } 108 } 109 elseif ($user_key != '') 110 { 111 if (crypt::hmac(DC_MASTER_KEY, 112 $rs->user_id. 113 $rs->user_pwd. 114 http::realIP(). 115 $_SERVER['HTTP_USER_AGENT'] 116 ) != $user_key) { 117 return false; 118 } 119 } 120 121 $this->user_id = $rs->user_id; 122 $this->user_admin = (boolean) $rs->user_super; 123 124 $this->user_info['user_pwd'] = $rs->user_pwd; 125 $this->user_info['user_name'] = $rs->user_name; 126 $this->user_info['user_firstname'] = $rs->user_firstname; 127 $this->user_info['user_displayname'] = $rs->user_displayname; 128 $this->user_info['user_email'] = $rs->user_email; 129 $this->user_info['user_url'] = $rs->user_url; 130 $this->user_info['user_default_blog'] = $rs->user_default_blog; 131 $this->user_info['user_lang'] = $rs->user_lang; 132 $this->user_info['user_tz'] = $rs->user_tz; 133 $this->user_info['user_post_status'] = $rs->user_post_status; 134 $this->user_info['user_creadt'] = $rs->user_creadt; 135 $this->user_info['user_upddt'] = $rs->user_upddt; 136 137 $this->user_info['user_cn'] = dcUtils::getUserCN($rs->user_id, $rs->user_name, 138 $rs->user_firstname, $rs->user_displayname); 139 140 $this->user_options = array_merge($this->core->userDefaults(),$rs->options()); 141 142 # Get permissions on blogs 143 if ($this->user_admin) 144 { 145 $strReq = 'SELECT blog_id, blog_name, blog_url '. 146 'FROM '.$this->blog_table.' '; 147 148 $rs = $this->con->select($strReq); 149 150 if ($rs->isEmpty()) { 151 return false; 152 } 153 154 while ($rs->fetch()) { 155 $this->blogs[$rs->blog_id]['permissions'] = array('admin' => true); 156 $this->blogs[$rs->blog_id]['name'] = $rs->blog_name; 157 $this->blogs[$rs->blog_id]['url'] = $rs->blog_url; 158 } 159 } 160 else 161 { 162 $strReq = 'SELECT B.blog_id, blog_name, blog_url, permissions '. 163 'FROM '.$this->con->escapeSystem($this->perm_table).' P, '. 164 $this->blog_table.' B '. 165 'WHERE B.blog_id = P.blog_id '. 166 'AND B.blog_status IN (1,0) '. 167 "AND user_id = '".$this->con->escape($this->user_id)."' "; 168 169 $rs = $this->con->select($strReq); 170 171 if ($rs->isEmpty()) { 172 return false; 173 } 174 175 while ($rs->fetch()) { 176 $this->blogs[$rs->blog_id]['permissions'] = $this->parsePermissions($rs->permissions); 177 $this->blogs[$rs->blog_id]['name'] = $rs->blog_name; 178 $this->blogs[$rs->blog_id]['url'] = $rs->blog_url; 179 } 180 } 181 182 return true; 183 } 184 185 /** 186 This method only check current user password. 187 188 @param pwd <b>string</b> User password 189 @return <b>boolean</b> 190 */ 191 public function checkPassword($pwd) 192 { 193 if (!empty($this->user_info['user_pwd'])) { 194 return $pwd == $this->user_info['user_pwd']; 195 } 196 197 return false; 198 } 199 200 /** 201 Checks if user is super admin 202 203 @return <b>boolean</b> 204 */ 205 public function isSuperAdmin() 206 { 207 return $this->user_admin; 208 } 209 210 /** 211 Checks if user has permissions given in <var>$permissions</var> for blog 212 <var>$blog_id</var>. <var>$permissions</var> is a coma separated list of 213 permissions. 214 215 @param permissions <b>string</b> Permissions list 216 @param blog_id <b>string</b> Blog ID 217 @return <b>boolean</b> 218 */ 219 public function check($permissions,$blog_id) 220 { 221 if ($this->user_admin) { 222 return true; 223 } 224 225 $p = explode(',',$permissions); 226 227 if (isset($this->blogs[$blog_id])) 228 { 229 if (isset($this->blogs[$blog_id]['permissions']['admin'])) { 230 return true; 231 } 232 233 foreach ($p as $v) 234 { 235 if (isset($this->blogs[$blog_id]['permissions'][$v])) { 236 return true; 237 } 238 } 239 } 240 241 return false; 242 } 243 244 /** 245 Returns true if user is allowed to change its password. 246 247 @return <b>boolean</b> 248 */ 249 public function allowPassChange() 250 { 251 return $this->allow_pass_change; 252 } 253 //@} 254 255 /// @name Sudo 256 //@{ 257 /** 258 Calls <var>$f</var> function with super admin rights. 259 260 @param f <b>callback</b> Callback function 261 @return <b>mixed</b> Function result 262 */ 263 public function sudo($f) 264 { 265 if (!is_callable($f)) { 266 throw new Exception($f.' function doest not exist'); 267 } 268 269 $args = func_get_args(); 270 array_shift($args); 271 272 if ($this->user_admin) { 273 $res = call_user_func_array($f,$args); 274 } else { 275 $this->user_admin = true; 276 $res = call_user_func_array($f,$args); 277 $this->user_admin = false; 278 } 279 280 return $res; 281 } 282 //@} 283 284 /// @name User information and options 285 //@{ 286 /** 287 Returns all user permissions (blogs) as an array which looks like: 288 289 - [blog_id] 290 - [name] => Blog name 291 - [url] => Blog URL 292 - [permissions] 293 - [permission] => true 294 - ... 295 296 @return <b>array</b> 297 */ 298 public function getPermissions() 299 { 300 return $this->blogs; 301 } 302 303 /** 304 Returns current user ID 305 306 @return <b>string</b> 307 */ 308 public function userID() 309 { 310 return $this->user_id; 311 } 312 313 /** 314 Returns information about a user . 315 316 @param n <b>string</b> Information name 317 @return <b>string</b> Information value 318 */ 319 public function getInfo($n) 320 { 321 if (isset($this->user_info[$n])) { 322 return $this->user_info[$n]; 323 } 324 325 return null; 326 } 327 328 /** 329 Returns a specific user option 330 331 @param n <b>string</b> Option name 332 @return <b>string</b> Option value 333 */ 334 public function getOption($n) 335 { 336 if (isset($this->user_options[$n])) { 337 return $this->user_options[$n]; 338 } 339 return null; 340 } 341 342 /** 343 Returns all user options in an associative array. 344 345 @return <b>array</b> 346 */ 347 public function getOptions() 348 { 349 return $this->user_options; 350 } 351 //@} 352 353 /// @name Permissions 354 //@{ 355 /** 356 Returns an array with permissions parsed from the string <var>$level</var> 357 358 @param level <b>string</b> Permissions string 359 @return <b>array</b> 360 */ 361 public function parsePermissions($level) 362 { 363 $level = preg_replace('/^\|/','',$level); 364 $level = preg_replace('/\|$/','',$level); 365 366 $res = array(); 367 foreach (explode('|',$level) as $v) { 368 $res[$v] = true; 369 } 370 return $res; 371 } 372 373 /** 374 Returns <var>perm_types</var> property content. 375 376 @return <b>array</b> 377 */ 378 public function getPermissionsTypes() 379 { 380 return $this->perm_types; 381 } 382 383 /** 384 Adds a new permission type. 385 386 @param name <b>string</b> Permission name 387 @param title <b>string</b> Permission title 388 */ 389 public function setPermissionType($name,$title) 390 { 391 $this->perm_types[$name] = $title; 392 } 393 //@} 394 395 /// @name Password recovery 396 //@{ 397 /** 398 Add a recover key to a specific user identified by its email and 399 password. 400 401 @param user_id <b>string</b> User ID 402 @param user_email <b>string</b> User Email 403 @return <b>string</b> Recover key 404 */ 405 public function setRecoverKey($user_id,$user_email) 406 { 407 $strReq = 'SELECT user_id '. 408 'FROM '.$this->user_table.' '. 409 "WHERE user_id = '".$this->con->escape($user_id)."' ". 410 "AND user_email = '".$this->con->escape($user_email)."' "; 411 412 $rs = $this->con->select($strReq); 413 414 if ($rs->isEmpty()) { 415 throw new Exception(__('That user does not exists in the database.')); 416 } 417 418 $key = md5(uniqid()); 419 420 $cur = $this->con->openCursor($this->user_table); 421 $cur->user_recover_key = $key; 422 423 $cur->update("WHERE user_id = '".$this->con->escape($user_id)."'"); 424 425 return $key; 426 } 427 428 /** 429 Creates a new user password using recovery key. Returns an array: 430 431 - user_email 432 - user_id 433 - new_pass 434 435 @param recover_key <b>string</b> Recovery key 436 @return <b>array</b> 437 */ 438 public function recoverUserPassword($recover_key) 439 { 440 $strReq = 'SELECT user_id, user_email '. 441 'FROM '.$this->user_table.' '. 442 "WHERE user_recover_key = '".$this->con->escape($recover_key)."' "; 443 444 $rs = $this->con->select($strReq); 445 446 if ($rs->isEmpty()) { 447 throw new Exception(__('That key does not exists in the database.')); 448 } 449 450 $new_pass = crypt::createPassword(); 451 452 $cur = $this->con->openCursor($this->user_table); 453 $cur->user_pwd = crypt::hmac(DC_MASTER_KEY,$new_pass); 454 $cur->user_recover_key = null; 455 456 $cur->update("WHERE user_recover_key = '".$this->con->escape($recover_key)."'"); 457 458 return array('user_email' => $rs->user_email, 'user_id' => $rs->user_id, 'new_pass' => $new_pass); 459 } 460 //@} 461 462 /** @name User management callbacks 463 This 3 functions only matter if you extend this class and use 464 DC_AUTH_CLASS constant. 465 These are called after core user management functions. 466 Could be useful if you need to add/update/remove stuff in your 467 LDAP directory or other third party authentication database. 468 */ 469 //@{ 470 471 /** 472 Called after core->addUser 473 @see dcCore::addUser 474 @param cur <b>cursor</b> User cursor 475 */ 476 public function afterAddUser(&$cur) {} 477 478 /** 479 Called after core->updUser 480 @see dcCore::updUser 481 @param id <b>string</b> User ID 482 @param cur <b>cursor</b> User cursor 483 */ 484 public function afterUpdUser($id,&$cur) {} 485 486 /** 487 Called after core->delUser 488 @see dcCore::delUser 489 @param id <b>string</b> User ID 490 */ 491 public function afterDelUser($id) {} 492 //@} 493 } 494 ?>
titre
Description
Corps
titre
Description
Corps
titre
Description
Corps
titre
Corps
| Généré le : Fri Feb 23 22:16:06 2007 | par Balluche grâce à PHPXref 0.7 |