classes/security/Validation.inc.php

<?php

import('lib.pkp.classes.security.UserGroup');

class Validation {

   function &login($username, $password, &$reason, $remember = false) {
      $implicitAuth = Config::getVar('security', 'implicit_auth');

      $reason = null;
      $valid = false;
      $userDao =& DAORegistry::getDAO('UserDAO');

      if ($implicitAuth) { // Implicit auth
         if (!Validation::isLoggedIn()) {
            PluginRegistry::loadCategory('implicitAuth');

            // Call the implicitAuth hook. It will set user.

            HookRegistry::call('ImplicitAuthPlugin::implicitAuth', array(&$user));

            $valid=true;
         }
      } else { // Regular Auth
         $user =& $userDao->getByUsername($username, true);

         if (!isset($user)) {
            // User does not exist
            return $valid;
         }

         if ($user->getAuthId()) {
            $authDao =& DAORegistry::getDAO('AuthSourceDAO');
            $auth =& $authDao->getPlugin($user->getAuthId());
         }

         if (isset($auth)) {
            // Validate against remote authentication source
            $valid = $auth->authenticate($username, $password);
            if ($valid) {
               $oldEmail = $user->getEmail();
               $auth->doGetUserInfo($user);
               if ($user->getEmail() != $oldEmail) {
                  // FIXME OMP requires email addresses to be unique; if changed email already exists, ignore
                  if ($userDao->userExistsByEmail($user->getEmail())) {
                     $user->setEmail($oldEmail);
                  }
               }
            }
         } else {
            // Validate against OMP user database
            $valid = ($user->getPassword() === Validation::encryptCredentials($username, $password));
         }
      }

      if (!$valid) {
         // Login credentials are invalid
         return $valid;

      } else {
         if ($user->getDisabled()) {
            // The user has been disabled.
            $reason = $user->getDisabledReason();
            if ($reason === null) $reason = '';
            $valid = false;
            return $valid;
         }

         // The user is valid, mark user as logged in in current session
         $sessionManager =& SessionManager::getManager();

         // Regenerate session ID first
         $sessionManager->regenerateSessionId();

         $session =& $sessionManager->getUserSession();
         $session->setSessionVar('userId', $user->getId());
         $session->setUserId($user->getId());
         $session->setSessionVar('username', $user->getUsername());
         $session->setRemember($remember);

         if ($remember && Config::getVar('general', 'session_lifetime') > 0) {
            // Update session expiration time
            $sessionManager->updateSessionLifetime(time() +  Config::getVar('general', 'session_lifetime') * 86400);
         }

         $user->setDateLastLogin(Core::getCurrentDate());
         $userDao->updateObject($user);

         return $user;
      }
   }

   function logout() {
      $sessionManager =& SessionManager::getManager();
      $session =& $sessionManager->getUserSession();
      $session->unsetSessionVar('userId');
      $session->unsetSessionVar('signedInAs');
      $session->setUserId(null);

      if ($session->getRemember()) {
         $session->setRemember(0);
         $sessionManager->updateSessionLifetime(0);
      }

      $sessionDao =& DAORegistry::getDAO('SessionDAO');
      $sessionDao->updateObject($session);

      return true;
   }

   function redirectLogin($message = null) {
      $args = array();

      if (isset($_SERVER['REQUEST_URI'])) {
         $args['source'] = $_SERVER['REQUEST_URI'];
      }
      if ($message !== null) {
         $args['loginMessage'] = $message;
      }

      Request::redirect(null, 'login', null, null, $args);
   }

   function checkCredentials($username, $password) {
      $userDao =& DAORegistry::getDAO('UserDAO');
      $user =& $userDao->getByUsername($username, false);

      $valid = false;
      if (isset($user)) {
         if ($user->getAuthId()) {
            $authDao =& DAORegistry::getDAO('AuthSourceDAO');
            $auth =& $authDao->getPlugin($user->getAuthId());
         }

         if (isset($auth)) {
            $valid = $auth->authenticate($username, $password);
         } else {
            $valid = ($user->getPassword() === Validation::encryptCredentials($username, $password));
         }
      }

      return $valid;
   }

   function isAuthorized($roleId, $pressId = 0) {
      if (!Validation::isLoggedIn()) {
         return false;
      }

      if ($pressId === -1) {
         // Get press ID from request
         $press =& Request::getPress();
         $pressId = $press == null ? 0 : $press->getId();
      }

      $sessionManager =& SessionManager::getManager();
      $session =& $sessionManager->getUserSession();
      $user =& $session->getUser();

      $roleDao =& DAORegistry::getDAO('RoleDAO');
      return $roleDao->userHasRole($pressId, $user->getId(), $roleId);
   }

   function encryptCredentials($username, $password, $encryption = false) {
      $valueToEncrypt = $username . $password;

      if ($encryption == false) {
         $encryption = Config::getVar('security', 'encryption');
      }

      switch ($encryption) {
         case 'sha1':
            if (function_exists('sha1')) {
               return sha1($valueToEncrypt);
            }
         case 'md5':
         default:
            return md5($valueToEncrypt);
      }
   }

   function generatePassword($length = 8) {
      $letters = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ';
      $numbers = '23456789';

      $password = "";
      for ($i=0; $i<$length; $i++) {
         $password .= mt_rand(1, 4) == 4 ? $numbers[mt_rand(0,strlen($numbers)-1)] : $letters[mt_rand(0, strlen($letters)-1)];
      }
      return $password;
   }

   function generatePasswordResetHash($userId) {
      $userDao =& DAORegistry::getDAO('UserDAO');
      if (($user = $userDao->getById($userId)) == null) {
         // No such user
         return false;
      }
      return substr(md5($user->getId() . $user->getUsername() . $user->getPassword()), 0, 6);
   }

   function suggestUsername($firstName, $lastName) {
      $initial = String::substr($firstName, 0, 1);

      $suggestion = String::regexp_replace('/[^a-zA-Z0-9_-]/', '', String::strtolower($initial . $lastName));
      $userDao =& DAORegistry::getDAO('UserDAO');
      for ($i = ''; $userDao->userExistsByUsername($suggestion . $i); $i++);
      return $suggestion . $i;
   }

   function isLoggedIn() {
      $sessionManager =& SessionManager::getManager();
      $session =& $sessionManager->getUserSession();

      $userId = $session->getUserId();
      return isset($userId) && !empty($userId);
   }

   function isSiteAdmin() {
      return Validation::isAuthorized(ROLE_ID_SITE_ADMIN);
   }

   function isPressManager($pressId = -1) {
      return Validation::isAuthorized(ROLE_ID_PRESS_MANAGER, $pressId);
   }

   function isSeriesEditor($pressId = -1) {
      return Validation::isAuthorized(ROLE_ID_SERIES_EDITOR, $pressId);
   }

   function canAdminister($administeredUserId, $administratorUserId) {
      $roleDao =& DAORegistry::getDAO('RoleDAO');

      if ($roleDao->userHasRole(0, $administratorUserId, ROLE_ID_SITE_ADMIN)) return true;

      // Check for administered user group assignments in other presses
      // that the administrator user doesn't have a manager role in.
      $pressDao =& DAORegistry::getDao('PressDAO');
      $presses =& $pressDao->getPresses();
      $userGroupDao =& DAORegistry::getDAO('UserGroupDAO');
      while(!$presses->eof()) {
         $press = $presses->next();
         $userGroups = $userGroupDao->getByUserId($administeredUserId, $press->getId());
         while (!$userGroups->eof()) {
            $userGroup =& $userGroups->next();
            if (!$roleDao->userHasRole($userGroup->getContextId(), $administratorUserId, ROLE_ID_PRESS_MANAGER)) {
               // Found an assignment: disqualified.
               return false;
            }
            unset($userGroup);
         }
         unset($press, $userGroups);
      }

      // There were no conflicting roles.
      return true;
   }
}

?>