Fix AX-Client for synchro
[platal.git] / include / xnet / session.inc.php
CommitLineData
0337d704 1<?php
2/***************************************************************************
5ddeb07c 3 * Copyright (C) 2003-2007 Polytechnique.org *
0337d704 4 * http://opensource.polytechnique.org/ *
5 * *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
10 * *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
15 * *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
18 * Foundation, Inc., *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
21
4869f665 22class XnetSession
0337d704 23{
0337d704 24 // {{{ function init
cab08090 25
6995a9b9 26 public static function init() {
0337d704 27 global $globals;
28
cab08090 29 S::init();
30
cab08090 31 if (!S::logged()) {
0337d704 32 // prevent connexion to be linked to deconnexion
71fe935c 33 if (($i = strpos($_SERVER['REQUEST_URI'], 'exit')) !== false)
0337d704 34 $returl = "http://{$_SERVER['SERVER_NAME']}".substr($_SERVER['REQUEST_URI'], 0, $i);
35 else
36 $returl = "http://{$_SERVER['SERVER_NAME']}{$_SERVER['REQUEST_URI']}";
37 $url = "https://www.polytechnique.org/auth-groupex.php";
38 $url .= "?session=" . session_id();
cab08090 39 $url .= "&challenge=" . S::v('challenge');
40 $url .= "&pass=" . md5(S::v('challenge') . $globals->xnet->secret);
0337d704 41 $url .= "&url=".urlencode($returl);
cab08090 42 $_SESSION['loginX'] = $url;
0337d704 43 }
bf517daf 44
45 if (S::logged() && $globals->asso()) {
46 $perms = S::v('perms');
47 $perms->rmFlag('groupadmin');
48 $perms->rmFlag('groupmember');
49 if (may_update()) {
50 $perms->addFlag('groupadmin');
51 $perms->addFlag('groupmember');
52 }
53 if (is_member()) {
54 $perms->addFlag('groupmember');
55 }
56 $_SESSION['perms'] = $perms;
57 }
0337d704 58 }
cab08090 59
0337d704 60 // }}}
6995a9b9 61 // {{{ public static function destroy()
cab08090 62
6995a9b9 63 public static function destroy() {
cab08090 64 S::destroy();
0337d704 65 XnetSession::init();
66 }
cab08090 67
0337d704 68 // }}}
6995a9b9 69 // {{{ public static function doAuth()
0337d704 70
71 /** Try to do an authentication.
72 *
73 * @param page the calling page (by reference)
74 */
6995a9b9 75 public static function doAuth()
0337d704 76 {
a7de4ef7 77 if (S::identified()) { // ok, c'est bon, on n'a rien à faire
0deaff1d 78 return true;
79 }
0337d704 80
81 if (Get::has('auth')) {
b0b937fd 82 return XnetSession::doAuthX();
0337d704 83 }
63528107 84
85 return false;
0337d704 86 }
87
88 // }}}
c0d6753f 89 // {{{ doAuthCookie
90
6995a9b9 91 public static function doAuthCookie() {
c0d6753f 92 return XnetSession::doAuth();
93 }
94
95 // }}}
0337d704 96 // {{{ doAuthX
97
bf517daf 98 public static function doAuthX()
99 {
b0b937fd 100 global $globals, $page;
0337d704 101
5e2307dc 102 if (md5('1'.S::v('challenge').$globals->xnet->secret.Get::i('uid').'1') != Get::v('auth')) {
0337d704 103 $page->kill("Erreur d'authentification avec polytechnique.org !");
104 }
105
08cce2ff 106 $res = XDB::query("
0337d704 107 SELECT u.user_id AS uid, prenom, nom, perms, promo, password, FIND_IN_SET('femme', u.flags) AS femme,
108 a.alias AS forlife, a2.alias AS bestalias, q.core_mail_fmt AS mail_fmt, q.core_rss_hash
109 FROM auth_user_md5 AS u
110 INNER JOIN auth_user_quick AS q USING(user_id)
111 INNER JOIN aliases AS a ON (u.user_id = a.id AND a.type='a_vie')
112 INNER JOIN aliases AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias',a2.flags))
113 WHERE u.user_id = {?} AND u.perms IN('admin','user')
5e2307dc 114 LIMIT 1", Get::i('uid'));
0337d704 115 $_SESSION = array_merge($_SESSION, $res->fetchOneAssoc());
116 $_SESSION['auth'] = AUTH_MDP;
bf517daf 117 require_once 'xorg/session.inc.php';
118 $_SESSION['perms'] =& XorgSession::make_perms(S::v('perms'));
cab08090 119 S::kill('challenge');
120 S::kill('loginX');
0afc7e1e 121 S::kill('may_update');
122 S::kill('is_member');
0337d704 123 Get::kill('auth');
124 Get::kill('uid');
27472b85 125 $path = Get::v('n');
126 Get::kill('n');
63528107 127 Get::kill('PHPSESSID');
b0b937fd 128
fd834b4b 129 $args = array();
b0b937fd 130 foreach($_GET as $key => $val) {
0337d704 131 $args[] = urlencode($key).'='.urlencode($val);
132 }
63528107 133
fd834b4b 134 http_redirect($globals->baseurl . '/' . $path, join('&', $args));
0337d704 135 }
136
137 // }}}
0deaff1d 138 // {{{ doSelfSuid
b8e265bf 139
0deaff1d 140 public static function doSelfSuid()
141 {
142 if (!S::has('suid')) {
143 $_SESSION['suid'] = $_SESSION;
144 }
bf517daf 145 require_once 'xorg/session.inc.php';
146 $_SESSION['perms'] =& XorgSession::make_perms('user');
b8e265bf 147 }
b8e265bf 148
0deaff1d 149 // }}}
150 // {{{ killSuid
b8e265bf 151
0deaff1d 152 public static function killSuid()
153 {
154 if (!S::has('suid')) {
155 return;
156 }
157 $suid = S::v('suid');
158 S::kill('suid');
159 S::kill('may_update');
160 S::kill('is_member');
161 $_SESSION['perms'] = $suid['perms'];
b8e265bf 162 }
0deaff1d 163
164 // }}}
b8e265bf 165}
166
167// }}}
0deaff1d 168// {{{ function may_update
0337d704 169
0deaff1d 170/** Return administration rights for the current asso
171 * @param force Force administration rights to be read from database
172 * @param lose Force administration rights to be false
173 */
b8e265bf 174function may_update($force = false, $lose = false)
175{
176 if (!isset($_SESSION['may_update'])) {
177 $_SESSION['may_update'] = array();
178 }
179 $may_update =& $_SESSION['may_update'];
180
0337d704 181 global $globals;
b8e265bf 182 $asso_id = $globals->asso('id');
0deaff1d 183 if (!$asso_id) {
184 return false;
185 } elseif ($lose) {
186 $may_update[$asso_id] = false;
187 } elseif (S::has_perms() || (S::has('suid') && $force)) {
188 $may_update[$asso_id] = true;
189 } elseif (!isset($may_update[$asso_id]) || $force) {
b8e265bf 190 $res = XDB::query("SELECT perms
191 FROM groupex.membres
192 WHERE uid={?} AND asso_id={?}",
a14159bf 193 S::v('uid'), $asso_id);
b8e265bf 194 $may_update[$asso_id] = ($res->fetchOneCell() == 'admin');
b8e265bf 195 }
196 return $may_update[$asso_id];
0337d704 197}
198
199// }}}
0deaff1d 200// {{{ function is_member
0337d704 201
0deaff1d 202/** Get membership informations for the current asso
203 * @param force Force membership to be read from database
204 * @param lose Force membership to be false
205 */
b8e265bf 206function is_member($force = false, $lose = false)
c1863ee9 207{
b8e265bf 208 if (!isset($_SESSION['is_member'])) {
209 $_SESSION['is_member'] = array();
210 }
211 $is_member =& $_SESSION['is_member'];
212
0337d704 213 global $globals;
258b9710 214 $asso_id = $globals->asso('id');
0deaff1d 215 if (!$asso_id) {
216 return false;
b8e265bf 217 } elseif ($lose) {
218 $is_member[$asso_id] = false;
0deaff1d 219 } elseif (S::has('suid') && $force) {
220 $is_member[$asso_id] = true;
221 } elseif (!isset($is_member[$asso_id]) || $force) {
222 $res = XDB::query("SELECT COUNT(*)
223 FROM groupex.membres
224 WHERE uid={?} AND asso_id={?}",
225 S::v('uid'), $asso_id);
226 $is_member[$asso_id] = ($res->fetchOneCell() == 1);
258b9710 227 }
228 return $is_member[$asso_id];
0337d704 229}
230
231// }}}
a7de4ef7 232// vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
0337d704 233?>