Changeset 1558 in ExiteCMS for trunk/includes/user_functions.php


Ignore:
Timestamp:
07/30/08 16:04:17 (4 years ago)
Author:
hverton
Message:

added preliminary support for multiple authentication methods. Currently, local database and OpenID are supported

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/includes/user_functions.php

    r1552 r1558  
    1515if (eregi("user_functions.php", $_SERVER['PHP_SELF']) || !defined('INIT_CMS_OK')) die(); 
    1616 
    17 // need to GeoIP functions to determine the users country of origin 
     17// need the GeoIP functions to determine the users country of origin 
    1818require_once "geoip_include.php"; 
    1919 
    … …  
    4040// Set the users site_visited cookie if this is the first visit, and update the unique visit counter 
    4141// save the random site_visited value, we need that later in session management! 
    42 if (!CMS_IS_BOT && !isset($_COOKIE['site_visited'])) { 
    43     $result=dbquery("UPDATE ".$db_prefix."configuration SET cfg_value = cfg_value+1 WHERE cfg_name = 'counter'"); 
    44     $site_visited = md5(uniqid(rand(), true)); 
    45     setcookie("site_visited", $site_visited, time() + 31536000, "/", "", "0"); 
    46 } else { 
    47     // replace the pre v7.1 cookie if needed 
    48     if ($_COOKIE['site_visited'] == "yes") { 
     42if (!CMS_IS_BOT) { 
     43    if (!isset($_COOKIE['site_visited'])) { 
     44        $result=dbquery("UPDATE ".$db_prefix."configuration SET cfg_value = cfg_value+1 WHERE cfg_name = 'counter'"); 
    4945        $site_visited = md5(uniqid(rand(), true)); 
    5046        setcookie("site_visited", $site_visited, time() + 31536000, "/", "", "0"); 
    5147    } else { 
    52         $site_visited = $_COOKIE['site_visited']; 
    53     } 
    54 } 
    55  
    56 // Login code  
    57 if (isset($_POST['login']) && isset($_POST['user_name']) && isset($_POST['user_pass'])) { 
    58     $user_pass = md5(md5($_POST['user_pass'])); 
    59     $user_name = preg_replace(array("/\=/","/\#/","/\sOR\s/"), "", stripinput($_POST['user_name'])); 
    60     $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_name='$user_name' AND user_password='".$user_pass."'"); 
    61     if (dbrows($result) != 0) { 
    62         $data = dbarray($result); 
    63         // if the account is suspended, check for an expiry date 
    64         if ($data['user_status'] == 1 && $data['user_ban_expire'] > 0 && $data['user_ban_expire'] < time() ) { 
    65             // if this user's email address is marked as bad, reset the countdown counter 
    66             $data['user_bad_email'] = $data['user_bad_email'] == 0 ? 0 : time(); 
    67             // reset the user status and the expiry date 
    68             $result = dbquery("UPDATE ".$db_prefix."users SET user_status='0', user_ban_expire='0', user_bad_email = '".$data['user_bad_email']."' WHERE user_id='".$data['user_id']."'"); 
    69             $data['user_status'] = 0; 
    70         } 
    71         if ($data['user_status'] == 0) {     
    72             header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
    73             // set the 'remember me' status value  
    74             $_SESSION['remember_me'] = isset($_POST['remember_me']) ? "yes" : "no"; 
    75             $_SESSION['userinfo'] = $data['user_id'].".".$user_pass; 
    76             // login expiry defined? 
    77             if ($settings['login_expire']) { 
    78                 if (isset($_POST['remember_me']) && $_POST['remember_me'] == "yes") { 
    79                     $_SESSION['login_expire'] = time() + $settings['login_extended_expire']; 
    80                 } else { 
    81                     $_SESSION['login_expire'] = time() + $settings['login_expire']; 
     48        // replace the pre v7.1 cookie if needed 
     49        if ($_COOKIE['site_visited'] == "yes") { 
     50            $site_visited = md5(uniqid(rand(), true)); 
     51            setcookie("site_visited", $site_visited, time() + 31536000, "/", "", "0"); 
     52        } else { 
     53            $site_visited = $_COOKIE['site_visited']; 
     54        } 
     55    } 
     56} 
     57 
     58// Check if a user is logging in 
     59if (isset($_POST['login'])) { 
     60    $auth_result = false; 
     61    $auth_methods = explode(",",$settings['auth_type'].","); 
     62    foreach($auth_methods as $auth_method) { 
     63        switch($auth_method) { 
     64            case "local": 
     65                // authentication against the local user database 
     66                if (!empty($_POST['user_name']) && !empty($_POST['user_pass'])) { 
     67                    $auth_result = auth_local($_POST['user_name'], $_POST['user_pass']); 
    8268                } 
    83             } else { 
    84                 $_SESSION['login_expire'] = mktime(0,0,0,1,1,2038); // do not expire 
    85             } 
    86             redirect(BASEDIR."setuser.php?user=".$data['user_name'], "script"); 
    87             exit; 
    88         } elseif ($data['user_status'] == 1) { 
    89             redirect(BASEDIR."setuser.php?user_id=".$data['user_id']."&error=1", "script"); 
    90             exit; 
    91         } elseif ($data['user_status'] == 2) { 
    92             redirect(BASEDIR."setuser.php?error=2", "script"); 
    93             exit; 
    94         } 
    95     } else { 
    96         redirect(BASEDIR."setuser.php?error=3", "script"); 
    97         exit; 
     69                break; 
     70            case "ldap": 
     71                break; 
     72            case "ad": 
     73                break; 
     74            case "openid": 
     75                // authentication against an openid provider 
     76                if (!empty($_POST['user_openid_url'])) { 
     77                    $auth_result = auth_openid($_POST['user_openid_url']); 
     78                } 
     79                break; 
     80            case "default": 
     81                // empty or unknown entry, ignore 
     82                break; 
     83        } 
     84    } 
     85    // check the result of the authentication attempt, and process it 
     86    if (is_array($auth_result)) { 
     87        switch($auth_result[0]) { 
     88            case "redirect": 
     89                redirect($auth_result[1], $auth_result[2]); 
     90                exit;  
     91            default: 
     92                // unknown result code 
     93                _debug($auth_result); 
     94                terminate("unknown result code from an authentication module!"); 
     95        } 
    9896    } 
    9997} 
    … …  
    226224} 
    227225 
     226// update the last users online information for guests 
     227if (iGUEST) { 
     228    $result = dbquery("SELECT * FROM ".$db_prefix."online WHERE online_user='0' AND online_ip='".USER_IP."'"); 
     229    if (dbrows($result) != 0) { 
     230        $result = dbquery("UPDATE ".$db_prefix."online SET online_lastactive='".time()."' WHERE online_user='0' AND online_ip='".USER_IP."'"); 
     231    } else { 
     232        $result = dbquery("INSERT INTO ".$db_prefix."online (online_user, online_ip, online_lastactive) VALUES ('0', '".USER_IP."', '".time()."')"); 
     233    } 
     234} 
     235// update the last users online information for members 
     236if (iMEMBER) { 
     237    $result = dbquery("SELECT * FROM ".$db_prefix."online WHERE online_user='".$userdata['user_id']."'"); 
     238    if (dbrows($result) != 0) { 
     239        $result = dbquery("UPDATE ".$db_prefix."online SET online_lastactive='".time()."' WHERE online_user='0' AND online_ip='".USER_IP."'"); 
     240    } else { 
     241        $result = dbquery("INSERT INTO ".$db_prefix."online (online_user, online_ip, online_lastactive) VALUES ('".$userdata['user_id']."', '".USER_IP."', '".time()."')"); 
     242    } 
     243} 
     244// users inactive for more than 180 seconds are not considered to be online 
     245$result = dbquery("DELETE FROM ".$db_prefix."online WHERE online_lastactive<".(time()-180).""); 
     246 
    228247// update the threads_read table for the current user 
    229248if (iMEMBER) { 
    … …  
    241260    define("iAUTH", substr(md5($userdata['user_password']),16,32)); 
    242261    $aidlink = "?aid=".iAUTH; 
     262} 
     263 
     264/*---------------------------------------------------+ 
     265| User authentication functions                      | 
     266+----------------------------------------------------*/ 
     267 
     268// authentication against the local user database 
     269function auth_local($userid, $password) { 
     270    global $db_prefix; 
     271     
     272    // check and validate the given userid and pasword 
     273    $user_pass = md5(md5($password)); 
     274    $user_name = preg_replace(array("/\=/","/\#/","/\sOR\s/"), "", stripinput($userid)); 
     275 
     276    // check if we have a user record for this userid and password 
     277    $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_name='$user_name' AND user_password='".$user_pass."'"); 
     278    if (dbrows($result) == 0) { 
     279        // not found, display an error message 
     280        return array("redirect", BASEDIR."setuser.php?error=3", "script"); 
     281    } else { 
     282        // found, get the record and do some more validation 
     283        $ret = auth_user_validate(dbarray($result)); 
     284        return $ret; 
     285    } 
     286} 
     287 
     288// authentication against an LDAP server 
     289function auth_ldap($userid, $password) { 
     290    return array('auth_ldap not defined yet!'); 
     291} 
     292 
     293// authentication against an Active Directory server 
     294function auth_ad($userid, $password) { 
     295    return array('auth_ad not defined yet!'); 
     296} 
     297 
     298// authentication using an OpenID 
     299function auth_openid($openid_url) { 
     300    global $settings; 
     301 
     302    // check if the URL is valid 
     303    if (isURL($openid_url)) { 
     304        require_once(PATH_INCLUDES."class.openid.php"); 
     305        $openid = new SimpleOpenID; 
     306        $openid->SetIdentity($openid_url); 
     307        $openid->SetApprovedURL($settings['siteurl']."setuser.php"); 
     308        $openid->SetTrustRoot($settings['siteurl']); 
     309        $server_url = $openid->GetOpenIDServer(); 
     310        if ($server_url) { 
     311            return array("redirect", $openid->GetRedirectURL() , "script"); 
     312        } 
     313    } else { 
     314        // for now... 
     315        return false; 
     316    } 
     317} 
     318 
     319// further validation on the userid found 
     320function auth_user_validate($userrecord) { 
     321 
     322    // if the account is suspended, check for an expiry date 
     323    if ($userrecord['user_status'] == 1 && $userrecord['user_ban_expire'] > 0 && $userrecord['user_ban_expire'] < time() ) { 
     324        // if this user's email address is marked as bad, reset the countdown counter 
     325        $userrecord['user_bad_email'] = $userrecord['user_bad_email'] == 0 ? 0 : time(); 
     326        // reset the user status and the expiry date 
     327        $result = dbquery("UPDATE ".$db_prefix."users SET user_status='0', user_ban_expire='0', user_bad_email = '".$userrecord['user_bad_email']."' WHERE user_id='".$userrecord['user_id']."'"); 
     328        $userrecord['user_status'] = 0; 
     329    } 
     330    if ($userrecord['user_status'] == 0) {   
     331        header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
     332        // set the 'remember me' status value  
     333        $_SESSION['remember_me'] = isset($_POST['remember_me']) ? "yes" : "no"; 
     334        $_SESSION['userinfo'] = $userrecord['user_id'].".".$userrecord['user_password']; 
     335        // login expiry defined? 
     336        if ($settings['login_expire']) { 
     337            if (isset($_POST['remember_me']) && $_POST['remember_me'] == "yes") { 
     338                $_SESSION['login_expire'] = time() + $settings['login_extended_expire']; 
     339            } else { 
     340                $_SESSION['login_expire'] = time() + $settings['login_expire']; 
     341            } 
     342        } else { 
     343            $_SESSION['login_expire'] = mktime(0,0,0,1,1,2038); // do not expire 
     344        } 
     345        return array("redirect", BASEDIR."setuser.php?user=".$userrecord['user_name'], "script"); 
     346    } elseif ($userrecord['user_status'] == 1) { 
     347        return array("redirect", BASEDIR."setuser.php?user_id=".$userrecord['user_id']."&error=1", "script"); 
     348    } elseif ($userrecord['user_status'] == 2) { 
     349        return array("redirect", BASEDIR."setuser.php?error=2", "script"); 
     350    } 
    243351} 
    244352 
Note: See TracChangeset for help on using the changeset viewer.