Session.php

<?php
require_once('AWLUtilities.php');
require_once('AwlQuery.php');
require_once('EMail.php');
 

function check_temporary_passwords( $they_sent, $user_no ) {
  $sql = 'SELECT 1 AS ok FROM tmp_password WHERE user_no = ? AND password = text(?) AND valid_until > current_timestamp';
  $qry = new AwlQuery( $sql, $user_no, $they_sent );
  if ( $qry->Exec('Session::check_temporary_passwords') ) {
    dbg_error_log( "Login", " check_temporary_passwords: Rows = ".$qry->rows());
    if ( $row = $qry->Fetch() ) {
      dbg_error_log( "Login", " check_temporary_passwords: OK = $row->ok");
      // Remove all the temporary passwords for that user...
      $sql = 'DELETE FROM tmp_password WHERE user_no = ? ';
      $qry = new AwlQuery( $sql, $user_no );
      $qry->Exec('Login',__LINE__,__FILE__);
      return true;
    }
  }
  return false;
}

class Session
{
  var $roles;
  var $cause = '';



  var $user_no;

  var $session_id = 0;

  var $username = 'guest';

  var $fullname = 'Guest';

  var $email = '';

  var $logged_in = false;

  var $just_logged_in = false;

  var $active;

  var $email_ok;

  var $joined;

  var $updated;

  var $last_used;

  var $password;

  var $config_data;

  var $date_format_type;

  var $locale;

  var $last_session_start;

  var $last_session_end;

  var $session_start;

  var $session_config;

  var $session_end;

  var $session_key;

  var $login_failed = false;


  function __construct( $sid="" )
  {
    global $sid, $sysname;
 
    $this->roles = array();
    $this->logged_in = false;
    $this->just_logged_in = false;
    $this->login_failed = false;
 
    if ( $sid == "" ) {
      if ( ! isset($_COOKIE['sid']) ) return;
      $sid = $_COOKIE['sid'];
    }
 
    list( $session_id, $session_key ) = explode( ';', $sid, 2 );

    if ( function_exists('local_session_sql') ) {
      $sql = local_session_sql();
    }
    else {
      $sql = "SELECT session.*, usr.* FROM session JOIN usr USING ( user_no )";
    }
    $sql .= " WHERE session.session_id = ? AND session.session_key = ? ORDER BY session.session_start DESC LIMIT 2";
 
    $qry = new AwlQuery($sql, $session_id, $session_key);
    if ( $qry->Exec('Session') && 1 == $qry->rows() ) {
      $this->AssignSessionDetails( $qry->Fetch() );
      $qry = new AwlQuery('UPDATE session SET session_end = current_timestamp WHERE session_id=?', $session_id);
      $qry->Exec('Session');
    }
    else {
      //  Kill the existing cookie, which appears to be bogus
      setcookie('sid', '', 0,'/');
      $this->cause = 'ERR: Other than one session record matches. ' . $qry->rows();
      $this->Log( "WARN: Login $this->cause" );
    }
  }
 

  function Log( $whatever )
  {
    global $c;
    deprecated('Session::Log');
 
    $argc = func_num_args();
    $format = func_get_arg(0);
    if ( $argc == 1 || ($argc == 2 && func_get_arg(1) == "0" ) ) {
      error_log( "$c->sysabbr: $format" );
    }
    else {
      $args = array();
      for( $i=1; $i < $argc; $i++ ) {
        $args[] = func_get_arg($i);
      }
      error_log( sprintf("%s%s: %s", $c->sysabbr, request_id_str(),
        vsprintf($format, $args) ));
    }
  }

  function Dbg( $whatever )
  {
    global $debuggroups, $c;
    deprecated('Session::Dbg');
 
    $argc = func_num_args();
    $dgroup = func_get_arg(0);
 
    if ( ! (isset($debuggroups[$dgroup]) && $debuggroups[$dgroup]) ) return;
 
    $format = func_get_arg(1);
    if ( $argc == 2 || ($argc == 3 && func_get_arg(2) == "0" ) ) {
      error_log( sprintf("%s%s: DBG: %s: %s", $c->sysabbr, request_id_str(),
        $dgroup, $format ));
    }
    else {
      $args = array();
      for( $i=2; $i < $argc; $i++ ) {
        $args[] = func_get_arg($i);
      }
 
      error_log( sprintf("%s%s: DBG: %s: %s", $c->sysabbr, request_id_str(),
        $dgroup, vsprintf($format,$args) ));
    }
  }

  function AllowedTo ( $whatever ) {
    return ( $this->logged_in && isset($this->roles[$whatever]) && $this->roles[$whatever] );
  }
 

  function GetRoles () {
    $this->roles = array();
    $qry = new AwlQuery( 'SELECT role_name FROM role_member m join roles r ON r.role_no = m.role_no WHERE user_no = ? ', $this->user_no );
    if ( $qry->Exec('Session::GetRoles') && $qry->rows() > 0 ) {
      while( $role = $qry->Fetch() ) {
        $this->roles[$role->role_name] = true;
      }
    }
  }
 

  function AssignSessionDetails( $u ) {
    // Assign each field in the selected record to the object
    foreach( $u AS $k => $v ) {
      $this->{$k} = $v;
    }
 
    $date_format = ($this->date_format_type == 'E' ? 'European,ISO' : ($this->date_format_type == 'U' ? 'US,ISO' : 'ISO'));
    $qry = new AwlQuery( 'SET DATESTYLE TO '. $date_format );
    $qry->Exec();
 
    $this->GetRoles();
    $this->logged_in = true;
  }
 

  function Login( $username, $password, $authenticated = false ) {
    global $c;
    $rc = false;
    dbg_error_log( "Login", " Login: Attempting login for $username" );
    if ( isset($usr) ) unset($usr);  

    if ( !$authenticated && isset($c->authenticate_hook) && isset($c->authenticate_hook['call']) && function_exists($c->authenticate_hook['call']) ) {
      $usr = call_user_func( $c->authenticate_hook['call'], $username, $password );
      if ( $usr === false ) unset($usr); else $authenticated = true;
    }
 
    $sql = "SELECT * FROM usr WHERE lower(username) = text(?) AND active";
    $qry = new AwlQuery( $sql, strtolower($username) );
    if ( isset($usr) || ($qry->Exec('Login',__LINE__,__FILE__) && $qry->rows() == 1 && $usr = $qry->Fetch() ) ) {
      $user_no = ( method_exists( $usr, 'user_no' ) ? $usr->user_no() : $usr->user_no );
      if ( $authenticated || session_validate_password( $password, $usr->password ) || check_temporary_passwords( $password, $user_no ) ) {
        // Now get the next session ID to create one from...
        $qry = new AwlQuery( "SELECT nextval('session_session_id_seq')" );
        if ( $qry->Exec('Login') && $qry->rows() == 1 ) {
          $seq = $qry->Fetch();
          $session_id = $seq->nextval;
          $session_key = md5( rand(1010101,1999999999) . microtime() );  // just some random shite
          dbg_error_log( "Login", " Login: Valid username/password for $username ($user_no)" );
 
          // Set the last_used timestamp to match the previous login.
          $qry = new AwlQuery('UPDATE usr SET last_used = (SELECT session_start FROM session WHERE session.user_no = ? ORDER BY session_id DESC LIMIT 1) WHERE user_no = ?;', $usr->user_no, $usr->user_no);
          $qry->Exec('Session');
 
          // And create a session
          $sql = "INSERT INTO session (session_id, user_no, session_key) VALUES( ?, ?, ? )";
          $qry = new AwlQuery( $sql, $session_id, $user_no, $session_key );
          if ( $qry->Exec('Login') ) {
            // Assign our session ID variable
            $sid = "$session_id;$session_key";
 
            //  Create a cookie for the sesssion
            setcookie('sid',$sid, 0,'/');
            // Recognise that we have started a session now too...
            $this->__construct($sid);
            dbg_error_log( "Login", " Login: New session $session_id started for $username ($user_no)" );
            $this->just_logged_in = true;
 
            // Unset all of the submitted values, so we don't accidentally submit an unexpected form.
            unset($_POST['username']);
            unset($_POST['password']);
            unset($_POST['submit']);
            unset($_GET['submit']);
            unset($GLOBALS['submit']);
 
            if ( function_exists('local_session_sql') ) {
              $sql = local_session_sql();
            }
            else {
              $sql = "SELECT session.*, usr.* FROM session JOIN usr USING ( user_no )";
            }
            $sql .= " WHERE session.session_id = ? AND session.session_key = ? ORDER BY session.session_start DESC LIMIT 2";
 
            $qry = new AwlQuery($sql, $session_id, $session_key);
            if ( $qry->Exec('Session') && 1 == $qry->rows() ) {
              $this->AssignSessionDetails( $qry->Fetch() );
            }
 
            $rc = true;
            return $rc;
          }
   // else ...
          $this->cause = 'ERR: Could not create new session.';
        }
        else {
          $this->cause = 'ERR: Could not increment session sequence.';
        }
      }
      else {
        $c->messages[] = i18n('Invalid username or password.');
        if ( isset($c->dbg['Login']) || isset($c->dbg['ALL']) )
          $this->cause = 'WARN: Invalid password.';
        else
          $this->cause = 'WARN: Invalid username or password.';
      }
    }
    else {
    $c->messages[] = i18n('Invalid username or password.');
    if ( isset($c->dbg['Login']) || isset($c->dbg['ALL']) )
      $this->cause = 'WARN: Invalid username.';
    else
      $this->cause = 'WARN: Invalid username or password.';
    }
 
    $this->Log( "Login failure: $this->cause" );
    $this->login_failed = true;
    $rc = false;
    return $rc;
  }
 
 

  function RenderLoginPanel() {
    $action_target = htmlspecialchars(preg_replace('/\?logout.*$/','',$_SERVER['REQUEST_URI']));
    dbg_error_log( "Login", " RenderLoginPanel: action_target='%s'", $action_target );
    $userprompt = translate("User Name");
    $pwprompt = translate("Password");
    $gobutton = htmlspecialchars(translate("GO!"));
    $gotitle = htmlspecialchars(translate("Enter your username and password then click here to log in."));
    $temppwprompt = translate("If you have forgotten your password then");
    $temppwbutton = htmlspecialchars(translate("Help! I've forgotten my password!"));
    $temppwtitle = htmlspecialchars(translate("Enter a username, if you know it, and click here, to be e-mailed a temporary password."));
    $html = <<<EOTEXT
<div id="logon">
<form action="$action_target" method="post">
<table>
<tr>
<th class="prompt">$userprompt:</th>
<td class="entry">
<input class="text" type="text" name="username" size="12" /></td>
</tr>
<tr>
<th class="prompt">$pwprompt:</th>
<td class="entry">
<input class="password" type="password" name="password" size="12" />
</td>
</tr>
<tr>
<th class="prompt">&nbsp;</th>
<td class="entry">
<input type="submit" value="$gobutton" title="$gotitle" name="submit" class="submit" />
</td>
</tr>
</table>
<p>
$temppwprompt: <input type="submit" value="$temppwbutton" title="$temppwtitle" name="lostpass" class="submit" />
</p>
</form>
</div>
 
EOTEXT;
    return $html;
  }
 

  function LoginRequired( $groups = "" ) {
    global $c, $session, $page_elements;
 
    if ( $this->logged_in && $groups == "" ) return;
    if ( ! $this->logged_in ) {
//      $c->messages[] = i18n("You must log in to use this system.");
      if ( function_exists("local_index_not_logged_in") ) {
        local_index_not_logged_in();
      }
      else {
        $login_html = translate( "<h1>Log On Please</h1><p>For access to the %s you should log on withthe username and password that have been issued to you.</p><p>If you would like to request access, please e-mail %s.</p>");
        $page_content = sprintf( $login_html, $c->system_name, $c->admin_email );
        $page_content .= $this->RenderLoginPanel();
        if ( isset($page_elements) && gettype($page_elements) == 'array' ) {
          $page_elements[] = $page_content;
          @include("page-renderer.php");
          exit(0);
        }
        @include("page-header.php");
        echo $page_content;
        @include("page-footer.php");
      }
    }
    else {
      $valid_groups = explode(",", $groups);
      foreach( $valid_groups AS $k => $v ) {
        if ( $this->AllowedTo($v) ) return;
      }
      $c->messages[] = i18n("You are not authorised to use this function.");
      if ( isset($page_elements) && gettype($page_elements) == 'array' ) {
        @include("page-renderer.php");
        exit(0);
      }
      @include("page-header.php");
      @include("page-footer.php");
    }
 
    exit;
  }
 
 

  function EmailTemporaryPassword( $username, $email_address, $body_template="" ) {
    global $c;
 
    $password_sent = false;
    $where = "";
    $params = array();
    if ( isset($username) && $username != "" ) {
      $where = 'WHERE active AND lower(usr.username) = :lcusername';
      $params[':lcusername'] = strtolower($username);
    }
    else if ( isset($email_address) && $email_address != "" ) {
      $where = 'WHERE active AND lower(usr.email) = :lcemail';
      $params[':lcemail'] = strtolower($email_address);
    }
 
    if ( $where != '' ) {
      if ( !isset($body_template) || $body_template == "" ) {
        $body_template = <<<EOTEXT
 
@@debugging@@A temporary password has been requested for @@system_name@@.
 
Temporary Password: @@password@@
 
This has been applied to the following usernames:
 
@@usernames@@
and will be valid for 24 hours.
 
If you have any problems, please contact the system administrator.
 
EOTEXT;
      }
 
      $qry = new AwlQuery( 'SELECT * FROM usr '.$where, $params );
      $qry->Exec('Session::EmailTemporaryPassword');
      if ( $qry->rows() > 0 ) {
        $q2 = new AwlQuery();
        $q2->Begin();
 
        while ( $row = $qry->Fetch() ) {
          $mail = new EMail( "Access to $c->system_name" );
          $mail->SetFrom($c->admin_email );
          $usernames = "";
          $debug_to = "";
          if ( isset($c->debug_email) ) {
            $debug_to = "This e-mail would normally be sent to:\n ";
            $mail->AddTo( "Tester <$c->debug_email>" );
          }
 
          $tmp_passwd = '';
          for ( $i=0; $i < 8; $i++ ) {
            $tmp_passwd .= substr( 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+#.-=*%@0123456789abcdefghijklmnopqrstuvwxyz', rand(0,69), 1);
          }
 
          $q2->QDo('INSERT INTO tmp_password (user_no, password) VALUES (?, ?)', array($row->user_no, $tmp_passwd));
          if ( isset($c->debug_email) ) {
            $debug_to .= "$row->fullname <$row->email> ";
          }
          else {
            $mail->AddTo( "$row->fullname <$row->email>" );
          }
          $usernames .= "        $row->username\n";
 
          if ( $mail->To() != "" ) {
            if ( isset($c->debug_email) ) {
              $debug_to .= "\n============================================================\n";
            }
            $sql .= "COMMIT;";
            $qry = new AwlQuery( $sql );
            $qry->Exec("Session::SendTemporaryPassword");
            $body = str_replace( '@@system_name@@', $c->system_name, $body_template);
            $body = str_replace( '@@password@@', $tmp_passwd, $body);
            $body = str_replace( '@@usernames@@', $usernames, $body);
            $body = str_replace( '@@debugging@@', $debug_to, $body);
            $mail->SetBody($body);
            $mail->Send();
            $password_sent = true;
          }
        }
      }
    }
    return $password_sent;
  }
 

  function SendTemporaryPassword( ) {
    global $c, $page_elements;
 
    $password_sent = $this->EmailTemporaryPassword( (isset($_POST['username'])?$_POST['username']:null), (isset($_POST['email_address'])?$_POST['email_address']:null) );
 
    if ( ! $password_sent && ((isset($_POST['username']) && $_POST['username'] != "" )
                              || (isset($_POST['email_address']) && $_POST['email_address'] != "" )) ) {
      // Username or EMail were non-null, but we didn't find that user.
      $page_content = <<<EOTEXT
<div id="logon">
<h1>Unable to Reset Password</h1>
<p>We were unable to reset your password at this time.  Please contact
<a href="mailto:$c->admin_email">$c->admin_email</a>
to arrange for an administrator to reset your password.</p>
<p>Thank you.</p>
</div>
EOTEXT;
    }
    else if ( $password_sent ) {
      $page_content = <<<EOTEXT
<div id="logon">
<h1>Temporary Password Sent</h1>
<p>A temporary password has been e-mailed to you.  This password
will be valid for 24 hours and you will be required to change
your password after logging in.</p>
<p><a href=".">Click here to return to the login page.</a></p>
</div>
EOTEXT;
    }
    else {
      $page_content = <<<EOTEXT
<div id="logon">
<h1>Temporary Password</h1>
<form action="$action_target" method="post">
<table>
<tr>
<th class="prompt" style="white-space: nowrap;">Enter your User Name:</th>
<td class="entry"><input class="text" type="text" name="username" size="12" /></td>
</tr>
<tr>
<th class="prompt" style="white-space: nowrap;">Or your EMail Address:</th>
<td class="entry"><input class="text" type="text" name="email_address" size="50" /></td>
</tr>
<tr>
<th class="prompt" style="white-space: nowrap;">and click on -></th>
<td class="entry">
<input class="submit" type="submit" value="Send me a temporary password" alt="Enter a username, or e-mail address, and click here." name="lostpass" />
</td>
</tr>
</table>
<p>Note: If you have multiple accounts with the same e-mail address, they will <em>all</em>
be assigned a new temporary password, but only the one(s) that you use that temporary password
on will have the existing password invalidated.</p>
<h2>The temporary password will only be valid for 24 hours.</h2>
<p>You will need to log on and change your password during this time.</p>
</form>
</div>
EOTEXT;
    }
    if ( isset($page_elements) && gettype($page_elements) == 'array' ) {
      $page_elements[] = $page_content;
      @include("page-renderer.php");
      exit(0);
    }
    @include("page-header.php");
    echo $page_content;
    @include("page-footer.php");
    exit(0);
  }
 
  static function _CheckLogout() {
    if ( isset($_GET['logout']) ) {
      dbg_error_log( "Login", ":_CheckLogout: Logging out");
      if ( isset($_COOKIE['sid']) ) {
        // clean up our session in the session table
        list( $session_id, $session_key ) = explode( ';', $_COOKIE['sid'], 2 );
        $sql = 'DELETE FROM session WHERE session_id = ? AND session_key = ?';
        $qry = new AwlQuery( $sql, $session_id, $session_key );
        $qry->Exec('Logout',__LINE__,__FILE__);
        // expire sessions older than 16 hours
        $sql = "DELETE FROM session WHERE session_end < current_timestamp - interval '16 hours'";
        $qry = new AwlQuery( $sql );
        $qry->Exec('Expire',__LINE__,__FILE__);
      }
      setcookie( 'sid', '', 0,'/');
      unset($_COOKIE['sid']);
      unset($GLOBALS['sid']);
    }
  }
 
  function _CheckLogin() {
    global $c;
    if ( isset($_POST['lostpass']) ) {
      dbg_error_log( "Login", ":_CheckLogin: User '$_POST[username]' has lost the password." );
      $this->SendTemporaryPassword();
    }
    else if ( isset($_POST['username']) && isset($_POST['password']) ) {
      $username = $_POST['username'];
      // Try and log in if we have a username and password
      $this->Login( $_POST['username'], $_POST['password'] );
      @dbg_error_log( "Login", ":_CheckLogin: User %s - %s (%d) login status is %d", $username, $this->fullname, $this->user_no, $this->logged_in );
    }
    else if ( !isset($_COOKIE['sid']) && isset($c->authenticate_hook['server_auth_type']) ) {
      if ( ( is_array($c->authenticate_hook['server_auth_type'])
             && in_array( strtolower($_SERVER['AUTH_TYPE']), array_map('strtolower', $c->authenticate_hook['server_auth_type'])) )
      ||
           ( !is_array($c->authenticate_hook['server_auth_type'])
             && strtolower($c->authenticate_hook['server_auth_type']) == strtolower($_SERVER['AUTH_TYPE']) )
      ) {
        if (isset($_SERVER["REMOTE_USER"]))
          $this->Login($_SERVER['REMOTE_USER'], "", true);  // Password will not be checked.
        else
          $this->Login($_SERVER['REDIRECT_REMOTE_USER'], "", true);  // Password will not be checked.
      }
    }
  }
 

  function FormattedDate( $indate, $type='date' ) {
    $out = "";
    if ( preg_match( '#^\s*$#', $indate ) ) {
      // Looks like it's empty - just return empty
      return $indate;
    }
    if ( preg_match( '#^\d{1,2}[/-]\d{1,2}[/-]\d{2,4}#', $indate ) ) {
      // Looks like it's nice already - don't screw with it!
      return $indate;
    }
    $yr = substr($indate,0,4);
    $mo = substr($indate,5,2);
    $dy = substr($indate,8,2);
    switch ( $this->date_format_type ) {
      case 'U':
        $out = sprintf( "%d/%d/%d", $mo, $dy, $yr );
        break;
      case 'E':
        $out = sprintf( "%d/%d/%d", $dy, $mo, $yr );
        break;
      default:
        $out = sprintf( "%d-%02d-%02d", $yr, $mo, $dy );
        break;
    }
    if ( $type == 'timestamp' ) {
      $out .= substr($indate,10,6);
    }
    return $out;
  }
 

  function BuildConfirmationHash( $method, $varname ) {
    $confirmation_hash = session_salted_md5( $this->session_start.$varname.$this->session_key, "" );
    if ( $method == 'GET' ) {
      $confirm = $varname .'='. urlencode($confirmation_hash);
    }
    else {
      $confirm = sprintf( '<input type="hidden" name="%s" value="%s">', $varname, htmlspecialchars($confirmation_hash) );
    }
    return $confirm;
  }
 

  function CheckConfirmationHash( $method, $varname ) {
    if ( $method == 'GET' && isset($_GET[$varname])) {
      $hashwegot = $_GET[$varname];
      dbg_error_log('Session',':CheckConfirmationHash: We got "%s" from GET', $hashwegot );
    }
    else if ( isset($_POST[$varname]) ) {
      $hashwegot = $_POST[$varname];
      dbg_error_log('Session',':CheckConfirmationHash: We got "%s" from POST', $hashwegot );
    }
    else {
      return false;
    }
 
    if ( preg_match('{^\*(.+)\*.+$}i', $hashwegot, $regs ) ) {
      // A nicely salted md5sum like "*<salt>*<salted_md5>"
      $salt = $regs[1];
      dbg_error_log('Session',':CheckConfirmationHash: Salt "%s"', $salt );
      $test_against = session_salted_md5( $this->session_start.$varname.$this->session_key, $salt ) ;
      dbg_error_log('Session',':CheckConfirmationHash: Testing against "%s"', $test_against );
 
      return ($hashwegot == $test_against);
    }
    return false;
  }
 
}
 

 
if ( !isset($session) ) {
  Session::_CheckLogout();
  $session = new Session();
  $session->_CheckLogin();
}