Adds a security check on the existence of an hruid at registration time.

[platal.git] / classes / xnetsession.php

diff --git a/classes/xnetsession.php b/classes/xnetsession.php
index ccdee5c..839abb2 100644 (file)
--- a/classes/xnetsession.php
+++ b/classes/xnetsession.php
@@ -97,19 +97,21 @@ class XnetSession extends PlSession
         if ($level == -1) {
             S::set('auth', AUTH_MDP);
         }
-        $res  = XDB::query('SELECT  u.user_id AS uid, prenom, nom, perms, promo, password, FIND_IN_SET(\'femme\', u.flags) AS femme,
-                                    a.alias AS forlife, a2.alias AS bestalias, q.core_mail_fmt AS mail_fmt, q.core_rss_hash
+        $res  = XDB::query("SELECT  u.user_id AS uid, u.hruid, prenom, nom, perms, promo, password, FIND_IN_SET('femme', u.flags) AS femme,
+                                    CONCAT(a.alias, '@{$globals->mail->domain}') AS forlife,
+                                    CONCAT(a2.alias, '@{$globals->mail->domain}') AS bestalias,
+                                    q.core_mail_fmt AS mail_fmt, q.core_rss_hash
                               FROM  auth_user_md5   AS u
                         INNER JOIN  auth_user_quick AS q  USING(user_id)
-                        INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type = \'a_vie\')
-                        INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET(\'bestalias\', a2.flags))
-                             WHERE  u.user_id = {?} AND u.perms IN(\'admin\', \'user\')
-                             LIMIT  1', $user);
+                        INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type = 'a_vie')
+                        INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias', a2.flags))
+                             WHERE  u.user_id = {?} AND u.perms IN('admin', 'user')
+                             LIMIT  1", $user);
         $sess = $res->fetchOneAssoc();
         $perms = $sess['perms'];
         unset($sess['perms']);
         $_SESSION = array_merge($_SESSION, $sess);
-        $this->makePerms($perms);
+        S::set('perms', User::makePerms($perms));
         S::kill('challenge');
         S::kill('loginX');
         S::kill('may_update');
@@ -126,26 +128,14 @@ class XnetSession extends PlSession
 
     public function tokenAuth($login, $token)
     {
-        // FIXME: we broke the session here because some RSS feeds (mainly wiki feeds) require
-        // a valid nome and checks the permissions. When the PlUser object will be ready, we'll
-        // be able to return a simple 'PlUser' object here without trying to alterate the
-        // session.
-        $res = XDB::query('SELECT  u.user_id AS uid, u.perms, u.nom, u.nom_usage, u.prenom, u.promo, FIND_IN_SET(\'femme\', u.flags) AS sexe
+        $res = XDB::query('SELECT  u.hruid
                              FROM  aliases         AS a
                        INNER JOIN  auth_user_md5   AS u ON (a.id = u.user_id AND u.perms IN ("admin", "user"))
                        INNER JOIN  auth_user_quick AS q ON (a.id = q.user_id AND q.core_rss_hash = {?})
                             WHERE  a.alias = {?} AND a.type != "homonyme"', $token, $login);
         if ($res->numRows() == 1) {
-            $sess = $res->fetchOneAssoc();
-            if (!S::has('uid')) {
-                $_SESSION = $sess;
-                $this->makePerms($sess['perms']);
-                return S::i('uid');
-            } else if (S::i('uid') == $sess['uid']) {
-                return S::i('uid');
-            } else {
-                Platal::page()->kill('Invalid state. To be fixed when hruid is ready');
-            }
+            $data = $res->fetchOneAssoc();
+            return new User($res->fetchOneCell());
         }
         return null;
     }
@@ -155,7 +145,7 @@ class XnetSession extends PlSession
         if (!$this->startSUID(S::i('uid'))) {
             return false;
         }
-        $this->makePerms('user');
+        S::set('perms', User::makePerms('user'));
         return true;
     }
 
@@ -186,6 +176,11 @@ class XnetSession extends PlSession
         S::set('perms', $flags);
     }
 
+    public function loggedLevel()
+    {
+        return AUTH_COOKIE;
+    }
+
     public function sureLevel()
     {
         return AUTH_MDP;