[platal.git] / include / xnet / session.inc.php

<?php
/***************************************************************************
 *  Copyright (C) 2003-2007 Polytechnique.org                              *
 *  http://opensource.polytechnique.org/                                   *
 *                                                                         *
 *  This program is free software; you can redistribute it and/or modify   *
 *  it under the terms of the GNU General Public License as published by   *
 *  the Free Software Foundation; either version 2 of the License, or      *
 *  (at your option) any later version.                                    *
 *                                                                         *
 *  This program is distributed in the hope that it will be useful,        *
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
 *  GNU General Public License for more details.                           *
 *                                                                         *
 *  You should have received a copy of the GNU General Public License      *
 *  along with this program; if not, write to the Free Software            *
 *  Foundation, Inc.,                                                      *
 *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
 ***************************************************************************/

class XnetSession
{
    // {{{ function init

    public static function init()
    {
        global $globals;

        S::init();

        if (!S::logged()) {
            // prevent connexion to be linked to deconnexion
            if (($i = strpos($_SERVER['REQUEST_URI'], 'exit')) !== false)
                $returl = "http://{$_SERVER['SERVER_NAME']}".substr($_SERVER['REQUEST_URI'], 0, $i);
            else
                $returl = "http://{$_SERVER['SERVER_NAME']}{$_SERVER['REQUEST_URI']}";
            $url  = "https://www.polytechnique.org/auth-groupex";
            $url .= "?session=" . session_id();
            $url .= "&challenge=" . S::v('challenge');
            $url .= "&pass=" . md5(S::v('challenge') . $globals->xnet->secret);
            $url .= "&url=".urlencode($returl);
            $_SESSION['loginX'] = $url;
        }

        if (S::logged() && $globals->asso()) {
            $perms = S::v('perms');
            $perms->rmFlag('groupadmin');
            $perms->rmFlag('groupmember');
            $perms->rmFlag('groupannu');
            if (may_update()) {
                $perms->addFlag('groupadmin');
                $perms->addFlag('groupmember');
                $perms->addFlag('groupannu');
            }
            if (is_member()) {
                $perms->addFlag('groupmember');
                if ($globals->asso('pub') != 'private') {
                    $perms->addFlag('groupannu');
                }
            }
            if ($globals->asso('cat') == 'Promotions') {
                $perms->addFlag('groupannu');
            }
            $_SESSION['perms'] = $perms;
        }
    }

    // }}}
    // {{{ public static function destroy()

    public static function destroy() {
        S::destroy();
        XnetSession::init();
    }

    // }}}
    // {{{ public static function doAuth()

    /** Try to do an authentication.
     *
     * @param page the calling page (by reference)
     */
    public static function doAuth()
    {
    	if (S::identified()) { // ok, c'est bon, on n'a rien à faire
	        return true;
    	}

        if (Get::has('auth')) {
            return XnetSession::doAuthX();
        }

        return false;
    }

    // }}}
    // {{{ doAuthCookie

    public static function doAuthCookie() {
        return XnetSession::doAuth();
    }

    // }}}
    // {{{ doAuthX

    public static function doAuthX()
    {
        global $globals, $page;

        if (md5('1'.S::v('challenge').$globals->xnet->secret.Get::i('uid').'1') != Get::v('auth')) {
            if (!$page) {
                require_once 'xnet.inc.php';
                new_skinned_page('platal/index.tpl');
            }
            $page->kill("Erreur d'authentification avec polytechnique.org !");
        }

        $res  = XDB::query("
            SELECT  u.user_id AS uid, prenom, nom, perms, promo, password, FIND_IN_SET('femme', u.flags) AS femme,
                    a.alias AS forlife, a2.alias AS bestalias, q.core_mail_fmt AS mail_fmt, q.core_rss_hash
              FROM  auth_user_md5   AS u
        INNER JOIN  auth_user_quick AS q  USING(user_id)
        INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type='a_vie')
        INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias',a2.flags))
             WHERE  u.user_id = {?} AND u.perms IN('admin','user')
             LIMIT  1", Get::i('uid'));
        $_SESSION = array_merge($_SESSION, $res->fetchOneAssoc());
        $_SESSION['auth'] = AUTH_MDP;
        require_once 'xorg/session.inc.php';
        $_SESSION['perms'] =& XorgSession::make_perms(S::v('perms'));
        S::kill('challenge');
        S::kill('loginX');
        S::kill('may_update');
        S::kill('is_member');
        Get::kill('auth');
        Get::kill('uid');
        $path = Get::v('n');
        Get::kill('n');
        Get::kill('PHPSESSID');

        $args = array();
        foreach($_GET as $key => $val) {
            $args[] = urlencode($key).'='.urlencode($val);
        }

        http_redirect($globals->baseurl . '/' . $path, join('&', $args));
    }

    // }}}
    // {{{ doSelfSuid

    public static function doSelfSuid()
    {
        if (!S::has('suid')) {
            $_SESSION['suid'] = $_SESSION;
        }
        require_once 'xorg/session.inc.php';
        $_SESSION['perms'] =& XorgSession::make_perms('user');
    }

    // }}}
    // {{{ killSuid

    public static function killSuid()
    {
        if (!S::has('suid')) {
            return;
        }
        $suid = S::v('suid');
        S::kill('suid');
        S::kill('may_update');
        S::kill('is_member');
        $_SESSION['perms'] = $suid['perms'];
    }

    // }}}
}

// }}}
// {{{ function may_update

/** Return administration rights for the current asso
 * @param force Force administration rights to be read from database
 * @param lose  Force administration rights to be false
 */
function may_update($force = false, $lose = false)
{
    if (!isset($_SESSION['may_update'])) {
        $_SESSION['may_update'] = array();
    }
    $may_update =& $_SESSION['may_update'];

    global $globals;
    $asso_id = $globals->asso('id');
    if (!$asso_id) {
        return false;
    } elseif ($lose) {
        $may_update[$asso_id] = false;
    } elseif (S::has_perms() || (S::has('suid') && $force)) {
        $may_update[$asso_id] = true;
    } elseif (!isset($may_update[$asso_id]) || $force) {
        $res = XDB::query("SELECT  perms
                             FROM  groupex.membres
                            WHERE  uid={?} AND asso_id={?}",
                          S::v('uid'), $asso_id);
        $may_update[$asso_id] = ($res->fetchOneCell() == 'admin');
    }
    return $may_update[$asso_id];
}

// }}}
// {{{ function is_member

/** Get membership informations for the current asso
 * @param force Force membership to be read from database
 * @param lose  Force membership to be false
 */
function is_member($force = false, $lose = false)
{
    if (!isset($_SESSION['is_member'])) {
        $_SESSION['is_member'] = array();
    }
    $is_member =& $_SESSION['is_member'];

    global $globals;
    $asso_id = $globals->asso('id');
    if (!$asso_id) {
        return false;
    } elseif ($lose) {
        $is_member[$asso_id] = false;
    } elseif (S::has('suid') && $force) {
        $is_member[$asso_id] = true;
    } elseif (!isset($is_member[$asso_id]) || $force) {
        $res = XDB::query("SELECT  COUNT(*)
                             FROM  groupex.membres
                            WHERE  uid={?} AND asso_id={?}",
                S::v('uid'), $asso_id);
        $is_member[$asso_id] = ($res->fetchOneCell() == 1);
    }
    return $is_member[$asso_id];
}

// }}}
// vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
?>
Commit	Line	Data
	1	<?php
	2	/***************************************************************************
	3	* Copyright (C) 2003-2007 Polytechnique.org *
	4	* http://opensource.polytechnique.org/ *
	5	* *
	6	* This program is free software; you can redistribute it and/or modify *
	7	* it under the terms of the GNU General Public License as published by *
	8	* the Free Software Foundation; either version 2 of the License, or *
	9	* (at your option) any later version. *
	10	* *
	11	* This program is distributed in the hope that it will be useful, *
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
	14	* GNU General Public License for more details. *
	15	* *
	16	* You should have received a copy of the GNU General Public License *
	17	* along with this program; if not, write to the Free Software *
	18	* Foundation, Inc., *
	19	* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
	20	***************************************************************************/
	21
	22	class XnetSession
	23	{
	24	// {{{ function init
	25
	26	public static function init()
	27	{
	28	global $globals;
	29
	30	S::init();
	31
	32	if (!S::logged()) {
	33	// prevent connexion to be linked to deconnexion
	34	if (($i = strpos($_SERVER['REQUEST_URI'], 'exit')) !== false)
	35	$returl = "http://{$_SERVER['SERVER_NAME']}".substr($_SERVER['REQUEST_URI'], 0, $i);
	36	else
	37	$returl = "http://{$_SERVER['SERVER_NAME']}{$_SERVER['REQUEST_URI']}";
	38	$url = "https://www.polytechnique.org/auth-groupex";
	39	$url .= "?session=" . session_id();
	40	$url .= "&challenge=" . S::v('challenge');
	41	$url .= "&pass=" . md5(S::v('challenge') . $globals->xnet->secret);
	42	$url .= "&url=".urlencode($returl);
	43	$_SESSION['loginX'] = $url;
	44	}
	45
	46	if (S::logged() && $globals->asso()) {
	47	$perms = S::v('perms');
	48	$perms->rmFlag('groupadmin');
	49	$perms->rmFlag('groupmember');
	50	$perms->rmFlag('groupannu');
	51	if (may_update()) {
	52	$perms->addFlag('groupadmin');
	53	$perms->addFlag('groupmember');
	54	$perms->addFlag('groupannu');
	55	}
	56	if (is_member()) {
	57	$perms->addFlag('groupmember');
	58	if ($globals->asso('pub') != 'private') {
	59	$perms->addFlag('groupannu');
	60	}
	61	}
	62	if ($globals->asso('cat') == 'Promotions') {
	63	$perms->addFlag('groupannu');
	64	}
	65	$_SESSION['perms'] = $perms;
	66	}
	67	}
	68
	69	// }}}
	70	// {{{ public static function destroy()
	71
	72	public static function destroy() {
	73	S::destroy();
	74	XnetSession::init();
	75	}
	76
	77	// }}}
	78	// {{{ public static function doAuth()
	79
	80	/** Try to do an authentication.
	81	*
	82	* @param page the calling page (by reference)
	83	*/
	84	public static function doAuth()
	85	{
	86	if (S::identified()) { // ok, c'est bon, on n'a rien à faire
	87	return true;
	88	}
	89
	90	if (Get::has('auth')) {
	91	return XnetSession::doAuthX();
	92	}
	93
	94	return false;
	95	}
	96
	97	// }}}
	98	// {{{ doAuthCookie
	99
	100	public static function doAuthCookie() {
	101	return XnetSession::doAuth();
	102	}
	103
	104	// }}}
	105	// {{{ doAuthX
	106
	107	public static function doAuthX()
	108	{
	109	global $globals, $page;
	110
	111	if (md5('1'.S::v('challenge').$globals->xnet->secret.Get::i('uid').'1') != Get::v('auth')) {
	112	if (!$page) {
	113	require_once 'xnet.inc.php';
	114	new_skinned_page('platal/index.tpl');
	115	}
	116	$page->kill("Erreur d'authentification avec polytechnique.org !");
	117	}
	118
	119	$res = XDB::query("
	120	SELECT u.user_id AS uid, prenom, nom, perms, promo, password, FIND_IN_SET('femme', u.flags) AS femme,
	121	a.alias AS forlife, a2.alias AS bestalias, q.core_mail_fmt AS mail_fmt, q.core_rss_hash
	122	FROM auth_user_md5 AS u
	123	INNER JOIN auth_user_quick AS q USING(user_id)
	124	INNER JOIN aliases AS a ON (u.user_id = a.id AND a.type='a_vie')
	125	INNER JOIN aliases AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias',a2.flags))
	126	WHERE u.user_id = {?} AND u.perms IN('admin','user')
	127	LIMIT 1", Get::i('uid'));
	128	$_SESSION = array_merge($_SESSION, $res->fetchOneAssoc());
	129	$_SESSION['auth'] = AUTH_MDP;
	130	require_once 'xorg/session.inc.php';
	131	$_SESSION['perms'] =& XorgSession::make_perms(S::v('perms'));
	132	S::kill('challenge');
	133	S::kill('loginX');
	134	S::kill('may_update');
	135	S::kill('is_member');
	136	Get::kill('auth');
	137	Get::kill('uid');
	138	$path = Get::v('n');
	139	Get::kill('n');
	140	Get::kill('PHPSESSID');
	141
	142	$args = array();
	143	foreach($_GET as $key => $val) {
	144	$args[] = urlencode($key).'='.urlencode($val);
	145	}
	146
	147	http_redirect($globals->baseurl . '/' . $path, join('&', $args));
	148	}
	149
	150	// }}}
	151	// {{{ doSelfSuid
	152
	153	public static function doSelfSuid()
	154	{
	155	if (!S::has('suid')) {
	156	$_SESSION['suid'] = $_SESSION;
	157	}
	158	require_once 'xorg/session.inc.php';
	159	$_SESSION['perms'] =& XorgSession::make_perms('user');
	160	}
	161
	162	// }}}
	163	// {{{ killSuid
	164
	165	public static function killSuid()
	166	{
	167	if (!S::has('suid')) {
	168	return;
	169	}
	170	$suid = S::v('suid');
	171	S::kill('suid');
	172	S::kill('may_update');
	173	S::kill('is_member');
	174	$_SESSION['perms'] = $suid['perms'];
	175	}
	176
	177	// }}}
	178	}
	179
	180	// }}}
	181	// {{{ function may_update
	182
	183	/** Return administration rights for the current asso
	184	* @param force Force administration rights to be read from database
	185	* @param lose Force administration rights to be false
	186	*/
	187	function may_update($force = false, $lose = false)
	188	{
	189	if (!isset($_SESSION['may_update'])) {
	190	$_SESSION['may_update'] = array();
	191	}
	192	$may_update =& $_SESSION['may_update'];
	193
	194	global $globals;
	195	$asso_id = $globals->asso('id');
	196	if (!$asso_id) {
	197	return false;
	198	} elseif ($lose) {
	199	$may_update[$asso_id] = false;
	200	} elseif (S::has_perms() \|\| (S::has('suid') && $force)) {
	201	$may_update[$asso_id] = true;
	202	} elseif (!isset($may_update[$asso_id]) \|\| $force) {
	203	$res = XDB::query("SELECT perms
	204	FROM groupex.membres
	205	WHERE uid={?} AND asso_id={?}",
	206	S::v('uid'), $asso_id);
	207	$may_update[$asso_id] = ($res->fetchOneCell() == 'admin');
	208	}
	209	return $may_update[$asso_id];
	210	}
	211
	212	// }}}
	213	// {{{ function is_member
	214
	215	/** Get membership informations for the current asso
	216	* @param force Force membership to be read from database
	217	* @param lose Force membership to be false
	218	*/
	219	function is_member($force = false, $lose = false)
	220	{
	221	if (!isset($_SESSION['is_member'])) {
	222	$_SESSION['is_member'] = array();
	223	}
	224	$is_member =& $_SESSION['is_member'];
	225
	226	global $globals;
	227	$asso_id = $globals->asso('id');
	228	if (!$asso_id) {
	229	return false;
	230	} elseif ($lose) {
	231	$is_member[$asso_id] = false;
	232	} elseif (S::has('suid') && $force) {
	233	$is_member[$asso_id] = true;
	234	} elseif (!isset($is_member[$asso_id]) \|\| $force) {
	235	$res = XDB::query("SELECT COUNT(*)
	236	FROM groupex.membres
	237	WHERE uid={?} AND asso_id={?}",
	238	S::v('uid'), $asso_id);
	239	$is_member[$asso_id] = ($res->fetchOneCell() == 1);
	240	}
	241	return $is_member[$asso_id];
	242	}
	243
	244	// }}}
	245	// vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
	246	?>