classes/security/Validation.inc.php

<?php

// $Id: Validation.inc.php,v 1.34 2008/07/01 01:16:10 asmecher Exp $


import('security.Role');

class Validation {

   function &login($username, $password, &$reason, $remember = false) {
      $implicitAuth = Config::getVar('security', 'implicit_auth');

      $reason = null;
      $valid = false;
      $userDao = &DAORegistry::getDAO('UserDAO');

      if ($implicitAuth) { // Implicit auth
         if (!Validation::isLoggedIn()) {
            PluginRegistry::loadCategory('implicitAuth');

            // Call the implicitAuth hook. It will set user.

            HookRegistry::call('ImplicitAuthPlugin::implicitAuth', array(&$user));

            $valid=true;
         }
      } else { // Regular Auth
         $user = &$userDao->getUserByUsername($username, true);

         if (!isset($user)) {
            // User does not exist
            return $valid;
         }

         if ($user->getAuthId()) {
            $authDao = &DAORegistry::getDAO('AuthSourceDAO');
            $auth = &$authDao->getPlugin($user->getAuthId());
         }

         if (isset($auth)) {
            // Validate against remote authentication source
            $valid = $auth->authenticate($username, $password);
            if ($valid) {
               $oldEmail = $user->getEmail();
               $auth->doGetUserInfo($user);
               if ($user->getEmail() != $oldEmail) {
                  // FIXME OJS requires email addresses to be unique; if changed email already exists, ignore
                  if ($userDao->userExistsByEmail($user->getEmail())) {
                     $user->setEmail($oldEmail);
                  }
               }
            }
         } else {
            // Validate against OJS user database
            $valid = ($user->getPassword() === Validation::encryptCredentials($username, $password));
         }
      }

      if (!$valid) {
         // Login credentials are invalid
         return $valid;

      } else {
         if ($user->getDisabled()) {
            // The user has been disabled.
            $reason = $user->getDisabledReason();
            if ($reason === null) $reason = '';
            $valid = false;
            return $valid;
         }

         // The user is valid, mark user as logged in in current session
         $sessionManager = &SessionManager::getManager();

         // Regenerate session ID first
         $sessionManager->regenerateSessionId();

         $session = &$sessionManager->getUserSession();
         $session->setSessionVar('userId', $user->getUserId());
         $session->setUserId($user->getUserId());
         $session->setSessionVar('username', $user->getUsername());
         $session->setRemember($remember);

         if ($remember && Config::getVar('general', 'session_lifetime') > 0) {
            // Update session expiration time
            $sessionManager->updateSessionLifetime(time() +  Config::getVar('general', 'session_lifetime') * 86400);
         }

         $user->setDateLastLogin(Core::getCurrentDate());
         $userDao->updateUser($user);

         return $user;
      }
   }

   function logout() {
      $sessionManager = &SessionManager::getManager();
      $session = &$sessionManager->getUserSession();
      $session->unsetSessionVar('userId');
      $session->unsetSessionVar('signedInAs');
      $session->setUserId(null);

      if ($session->getRemember()) {
         $session->setRemember(0);
         $sessionManager->updateSessionLifetime(0);
      }

      $sessionDao = &DAORegistry::getDAO('SessionDAO');
      $sessionDao->updateSession($session);

      return true;
   }

   function redirectLogin($message = null) {
      $args = array();

      if (isset($_SERVER['REQUEST_URI'])) {
         $args['source'] = $_SERVER['REQUEST_URI'];
      }
      if ($message !== null) {
         $args['loginMessage'] = $message;
      }

      Request::redirect(null, 'login', null, null, $args);
   }

   function checkCredentials($username, $password) {
      $userDao = &DAORegistry::getDAO('UserDAO');
      $user = &$userDao->getUserByUsername($username, false);

      $valid = false;
      if (isset($user)) {
         if ($user->getAuthId()) {
            $authDao = &DAORegistry::getDAO('AuthSourceDAO');
            $auth = &$authDao->getPlugin($user->getAuthId());
         }

         if (isset($auth)) {
            $valid = $auth->authenticate($username, $password);
         } else {
            $valid = ($user->getPassword() === Validation::encryptCredentials($username, $password));
         }
      }

      return $valid;
   }

   function isAuthorized($roleId, $journalId = 0) {
      if (!Validation::isLoggedIn()) {
         return false;
      }

      if ($journalId === -1) {
         // Get journal ID from request
         $journal = &Request::getJournal();
         $journalId = $journal == null ? 0 : $journal->getJournalId();
      }

      $sessionManager = &SessionManager::getManager();
      $session = &$sessionManager->getUserSession();
      $user = &$session->getUser();

      $roleDao = &DAORegistry::getDAO('RoleDAO');
      return $roleDao->roleExists($journalId, $user->getUserId(), $roleId);
   }

   function encryptCredentials($username, $password, $encryption = false) {
      $valueToEncrypt = $username . $password;

      if ($encryption == false) {
         $encryption = Config::getVar('security', 'encryption');
      }

      switch ($encryption) {
         case 'sha1':
            if (function_exists('sha1')) {
               return sha1($valueToEncrypt);
            }
         case 'md5':
         default:
            return md5($valueToEncrypt);
      }
   }

   function generatePassword($length = 8) {
      $letters = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ';
      $numbers = '23456789';

      $password = "";
      for ($i=0; $i<$length; $i++) {
         $password .= mt_rand(1, 4) == 4 ? $numbers[mt_rand(0,strlen($numbers)-1)] : $letters[mt_rand(0, strlen($letters)-1)];
      }
      return $password;
   }

   function generatePasswordResetHash($userId) {
      $userDao = &DAORegistry::getDAO('UserDAO');
      if (($user = $userDao->getUser($userId)) == null) {
         // No such user
         return false;
      }
      return substr(md5($user->getUserId() . $user->getUsername() . $user->getPassword()), 0, 6);
   }

   function suggestUsername($firstName, $lastName) {
      $initial = String::substr($firstName, 0, 1);

      $suggestion = String::regexp_replace('/[^a-zA-Z0-9_-]/', '', String::strtolower($initial . $lastName));
      $userDao =& DAORegistry::getDAO('UserDAO');
      for ($i = ''; $userDao->userExistsByUsername($suggestion . $i); $i++);
      return $suggestion . $i;
   }

   function isLoggedIn() {
      $sessionManager = &SessionManager::getManager();
      $session = &$sessionManager->getUserSession();

      $userId = $session->getUserId();
      return isset($userId) && !empty($userId);
   }

   function isSiteAdmin() {
      return Validation::isAuthorized(ROLE_ID_SITE_ADMIN);
   }

   function isJournalManager($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_JOURNAL_MANAGER, $journalId);
   }

   function isEditor($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_EDITOR, $journalId);
   }

   function isSectionEditor($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_SECTION_EDITOR, $journalId);
   }

   function isLayoutEditor($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_LAYOUT_EDITOR, $journalId);
   }

   function isReviewer($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_REVIEWER, $journalId);
   }

   function isCopyeditor($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_COPYEDITOR, $journalId);
   }

   function isProofreader($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_PROOFREADER, $journalId);
   }

   function isAuthor($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_AUTHOR, $journalId);
   }

   function isReader($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_READER, $journalId);
   }

   function isSubscriptionManager($journalId = -1) {
      return Validation::isAuthorized(ROLE_ID_SUBSCRIPTION_MANAGER, $journalId);
   }

   function canAdminister($journalId, $userId) {
      if (Validation::isSiteAdmin()) return true;
      if (!Validation::isJournalManager($journalId)) return false;

      // Check for roles in other journals that this user
      // doesn't have administrative rights over.
      $roleDao = &DAORegistry::getDAO('RoleDAO');
      $roles = &$roleDao->getRolesByUserId($userId);
      foreach ($roles as $role) {
         if ($role->getRoleId() == ROLE_ID_SITE_ADMIN) return false;
         if (
            $role->getJournalId() != $journalId &&
            !Validation::isJournalManager($role->getJournalId())
         ) return false;
      }

      // There were no conflicting roles.
      return true;
   }
}

?>

---