147 global $sid, $sysname;
149 $this->roles = array();
150 $this->logged_in =
false;
151 $this->just_logged_in =
false;
152 $this->login_failed =
false;
155 if ( ! isset($_COOKIE[
'sid']) )
return;
156 $sid = $_COOKIE[
'sid'];
159 list( $session_id, $session_key ) = explode(
';', $sid, 2 );
170 if ( function_exists(
'local_session_sql') ) {
171 $sql = local_session_sql();
174 $sql =
"SELECT session.*, usr.* FROM session JOIN usr USING ( user_no )";
176 $sql .=
" WHERE session.session_id = ? AND session.session_key = ? ORDER BY session.session_start DESC LIMIT 2";
178 $qry =
new AwlQuery($sql, $session_id, $session_key);
179 if ( $qry->Exec(
'Session') && 1 == $qry->rows() ) {
181 $qry =
new AwlQuery(
'UPDATE session SET session_end = current_timestamp WHERE session_id=?', $session_id);
182 $qry->Exec(
'Session');
186 setcookie(
'sid',
'', 0,
'/');
187 $this->cause =
'ERR: Other than one session record matches. ' . $qry->rows();
188 $this->
Log(
"WARN: Login $this->cause" );
206 deprecated(
'Session::Log');
208 $argc = func_num_args();
209 $format = func_get_arg(0);
210 if ( $argc == 1 || ($argc == 2 && func_get_arg(1) ==
"0" ) ) {
211 error_log(
"$c->sysabbr: $format" );
215 for( $i=1; $i < $argc; $i++ ) {
216 $args[] = func_get_arg($i);
218 error_log(
"$c->sysabbr: " . vsprintf($format,$args) );
235 global $debuggroups, $c;
236 deprecated(
'Session::Dbg');
238 $argc = func_num_args();
239 $dgroup = func_get_arg(0);
241 if ( ! (isset($debuggroups[$dgroup]) && $debuggroups[$dgroup]) )
return;
243 $format = func_get_arg(1);
244 if ( $argc == 2 || ($argc == 3 && func_get_arg(2) ==
"0" ) ) {
245 error_log(
"$c->sysabbr: DBG: $dgroup: $format" );
249 for( $i=2; $i < $argc; $i++ ) {
250 $args[] = func_get_arg($i);
252 error_log(
"$c->sysabbr: DBG: $dgroup: " . vsprintf($format,$args) );
316 function Login( $username, $password, $authenticated =
false ) {
319 dbg_error_log(
"Login",
" Login: Attempting login for $username" );
320 if ( isset($usr) ) unset($usr);
328 if ( !$authenticated && isset($c->authenticate_hook) && isset($c->authenticate_hook[
'call']) && function_exists($c->authenticate_hook[
'call']) ) {
339 $usr = call_user_func( $c->authenticate_hook[
'call'], $username, $password );
340 if ( $usr ===
false ) unset($usr);
else $authenticated =
true;
343 $sql =
"SELECT * FROM usr WHERE lower(username) = text(?) AND active";
344 $qry =
new AwlQuery( $sql, strtolower($username) );
345 if ( isset($usr) || ($qry->Exec(
'Login',__LINE__,__FILE__) && $qry->rows() == 1 && $usr = $qry->Fetch() ) ) {
346 $user_no = ( method_exists( $usr,
'user_no' ) ? $usr->user_no() : $usr->user_no );
347 if ( $authenticated || session_validate_password( $password, $usr->password ) || check_temporary_passwords( $password, $user_no ) ) {
349 $qry =
new AwlQuery(
"SELECT nextval('session_session_id_seq')" );
350 if ( $qry->Exec(
'Login') && $qry->rows() == 1 ) {
351 $seq = $qry->Fetch();
352 $session_id = $seq->nextval;
353 $session_key = md5( rand(1010101,1999999999) . microtime() );
354 dbg_error_log(
"Login",
" Login: Valid username/password for $username ($user_no)" );
357 $qry =
new AwlQuery(
'UPDATE usr SET last_used = (SELECT session_start FROM session WHERE session.user_no = ? ORDER BY session_id DESC LIMIT 1) WHERE user_no = ?;', $usr->user_no, $usr->user_no);
358 $qry->Exec(
'Session');
361 $sql =
"INSERT INTO session (session_id, user_no, session_key) VALUES( ?, ?, ? )";
362 $qry =
new AwlQuery( $sql, $session_id, $user_no, $session_key );
363 if ( $qry->Exec(
'Login') ) {
365 $sid =
"$session_id;$session_key";
368 setcookie(
'sid',$sid, 0,
'/');
371 dbg_error_log(
"Login",
" Login: New session $session_id started for $username ($user_no)" );
372 $this->just_logged_in =
true;
375 unset($_POST[
'username']);
376 unset($_POST[
'password']);
377 unset($_POST[
'submit']);
378 unset($_GET[
'submit']);
379 unset($GLOBALS[
'submit']);
381 if ( function_exists(
'local_session_sql') ) {
382 $sql = local_session_sql();
385 $sql =
"SELECT session.*, usr.* FROM session JOIN usr USING ( user_no )";
387 $sql .=
" WHERE session.session_id = ? AND session.session_key = ? ORDER BY session.session_start DESC LIMIT 2";
389 $qry =
new AwlQuery($sql, $session_id, $session_key);
390 if ( $qry->Exec(
'Session') && 1 == $qry->rows() ) {
398 $this->cause =
'ERR: Could not create new session.';
401 $this->cause =
'ERR: Could not increment session sequence.';
405 $c->messages[] = i18n(
'Invalid username or password.');
406 if ( isset($c->dbg[
'Login']) || isset($c->dbg[
'ALL']) )
407 $this->cause =
'WARN: Invalid password.';
409 $this->cause =
'WARN: Invalid username or password.';
413 $c->messages[] = i18n(
'Invalid username or password.');
414 if ( isset($c->dbg[
'Login']) || isset($c->dbg[
'ALL']) )
415 $this->cause =
'WARN: Invalid username.';
417 $this->cause =
'WARN: Invalid username or password.';
420 $this->
Log(
"Login failure: $this->cause" );
421 $this->login_failed =
true;
434 $action_target = htmlspecialchars(preg_replace(
'/\?logout.*$/',
'',$_SERVER[
'REQUEST_URI']));
435 dbg_error_log(
"Login",
" RenderLoginPanel: action_target='%s'", $action_target );
436 $userprompt = translate(
"User Name");
437 $pwprompt = translate(
"Password");
438 $gobutton = htmlspecialchars(translate(
"GO!"));
439 $gotitle = htmlspecialchars(translate(
"Enter your username and password then click here to log in."));
440 $temppwprompt = translate(
"If you have forgotten your password then");
441 $temppwbutton = htmlspecialchars(translate(
"Help! I've forgotten my password!"));
442 $temppwtitle = htmlspecialchars(translate(
"Enter a username, if you know it, and click here, to be e-mailed a temporary password."));
445<form action=
"$action_target" method=
"post">
448<th
class=
"prompt">$userprompt:</th>
450<input
class=
"text" type=
"text" name=
"username" size=
"12" /></td>
453<th
class=
"prompt">$pwprompt:</th>
455<input
class=
"password" type=
"password" name=
"password" size=
"12" />
459<th
class=
"prompt"> </th>
461<input type=
"submit" value=
"$gobutton" title=
"$gotitle" name=
"submit" class=
"submit" />
466$temppwprompt: <input type=
"submit" value=
"$temppwbutton" title=
"$temppwtitle" name=
"lostpass" class=
"submit" />
486 global $c, $session, $page_elements;
488 if ( $this->logged_in && $groups ==
"" )
return;
489 if ( ! $this->logged_in ) {
491 if ( function_exists(
"local_index_not_logged_in") ) {
492 local_index_not_logged_in();
495 $login_html = translate(
"<h1>Log On Please</h1><p>For access to the %s you should log on withthe username and password that have been issued to you.</p><p>If you would like to request access, please e-mail %s.</p>");
496 $page_content = sprintf( $login_html, $c->system_name, $c->admin_email );
498 if ( isset($page_elements) && gettype($page_elements) ==
'array' ) {
499 $page_elements[] = $page_content;
500 @include(
"page-renderer.php");
503 @include(
"page-header.php");
505 @include(
"page-footer.php");
509 $valid_groups = explode(
",", $groups);
510 foreach( $valid_groups AS $k => $v ) {
513 $c->messages[] = i18n(
"You are not authorised to use this function.");
514 if ( isset($page_elements) && gettype($page_elements) ==
'array' ) {
515 @include(
"page-renderer.php");
518 @include(
"page-header.php");
519 @include(
"page-footer.php");
538 $password_sent =
false;
541 if ( isset($username) && $username !=
"" ) {
542 $where =
'WHERE active AND lower(usr.username) = :lcusername';
543 $params[
':lcusername'] = strtolower($username);
545 else if ( isset($email_address) && $email_address !=
"" ) {
546 $where =
'WHERE active AND lower(usr.email) = :lcemail';
547 $params[
':lcemail'] = strtolower($email_address);
550 if ( $where !=
'' ) {
551 if ( !isset($body_template) || $body_template ==
"" ) {
552 $body_template = <<<EOTEXT
554@@debugging@@A temporary password has been requested
for @@system_name@@.
556Temporary Password: @@password@@
558This has been applied to the following usernames:
561and will be valid
for 24 hours.
563If you have any problems, please contact the system administrator.
568 $qry =
new AwlQuery(
'SELECT * FROM usr '.$where, $params );
569 $qry->Exec(
'Session::EmailTemporaryPassword');
570 if ( $qry->rows() > 0 ) {
574 while ( $row = $qry->Fetch() ) {
575 $mail =
new EMail(
"Access to $c->system_name" );
576 $mail->SetFrom($c->admin_email );
579 if ( isset($c->debug_email) ) {
580 $debug_to =
"This e-mail would normally be sent to:\n ";
581 $mail->AddTo(
"Tester <$c->debug_email>" );
585 for ( $i=0; $i < 8; $i++ ) {
586 $tmp_passwd .= substr(
'ABCDEFGHIJKLMNOPQRSTUVWXYZ+#.-=*%@0123456789abcdefghijklmnopqrstuvwxyz', rand(0,69), 1);
589 $q2->QDo(
'INSERT INTO tmp_password (user_no, password) VALUES(?,?)', array($row->user_no, $tmp_passwd));
590 if ( isset($c->debug_email) ) {
591 $debug_to .=
"$row->fullname <$row->email> ";
594 $mail->AddTo(
"$row->fullname <$row->email>" );
596 $usernames .=
" $row->username\n";
598 if ( $mail->To() !=
"" ) {
599 if ( isset($c->debug_email) ) {
600 $debug_to .=
"\n============================================================\n";
604 $qry->Exec(
"Session::SendTemporaryPassword");
605 $body = str_replace(
'@@system_name@@', $c->system_name, $body_template);
606 $body = str_replace(
'@@password@@', $tmp_passwd, $body);
607 $body = str_replace(
'@@usernames@@', $usernames, $body);
608 $body = str_replace(
'@@debugging@@', $debug_to, $body);
609 $mail->SetBody($body);
611 $password_sent =
true;
616 return $password_sent;
628 global $c, $page_elements;
630 $password_sent = $this->
EmailTemporaryPassword( (isset($_POST[
'username'])?$_POST[
'username']:
null), (isset($_POST[
'email_address'])?$_POST[
'email_address']:
null) );
632 if ( ! $password_sent && ((isset($_POST[
'username']) && $_POST[
'username'] !=
"" )
633 || (isset($_POST[
'email_address']) && $_POST[
'email_address'] !=
"" )) ) {
635 $page_content = <<<EOTEXT
637<h1>Unable to Reset Password</h1>
638<p>We were unable to reset your password at
this time. Please contact
639<a href=
"mailto:$c->admin_email">$c->admin_email</a>
640to arrange
for an administrator to reset your password.</p>
645 else if ( $password_sent ) {
646 $page_content = <<<EOTEXT
648<h1>Temporary Password Sent</h1>
649<p>A temporary password has been e-mailed to you. This password
650will be valid
for 24 hours and you will be required to change
651your password after logging in.</p>
652<p><a href=
".">Click here to
return to the login page.</a></p>
657 $page_content = <<<EOTEXT
659<h1>Temporary Password</h1>
660<form action=
"$action_target" method=
"post">
663<th
class=
"prompt" style=
"white-space: nowrap;">Enter your
User Name:</th>
664<td
class=
"entry"><input
class=
"text" type=
"text" name=
"username" size=
"12" /></td>
667<th
class=
"prompt" style=
"white-space: nowrap;">Or your
EMail Address:</th>
668<td
class=
"entry"><input
class=
"text" type=
"text" name=
"email_address" size=
"50" /></td>
671<th
class=
"prompt" style=
"white-space: nowrap;">and click on -></th>
673<input
class=
"submit" type=
"submit" value=
"Send me a temporary password" alt=
"Enter a username, or e-mail address, and click here." name=
"lostpass" />
677<p>Note: If you have multiple accounts with the same e-mail address, they will <em>all</em>
678be assigned a
new temporary password, but only the one(s) that you use that temporary password
679on will have the existing password invalidated.</p>
680<h2>The temporary password will only be valid
for 24 hours.</h2>
681<p>You will need to log on and change your password during
this time.</p>
686 if ( isset($page_elements) && gettype($page_elements) ==
'array' ) {
687 $page_elements[] = $page_content;
688 @include(
"page-renderer.php");
691 @include(
"page-header.php");
693 @include(
"page-footer.php");
719 if ( isset($_POST[
'lostpass']) ) {
720 dbg_error_log(
"Login",
":_CheckLogin: User '$_POST[username]' has lost the password." );
723 else if ( isset($_POST[
'username']) && isset($_POST[
'password']) ) {
724 $username = $_POST[
'username'];
726 $this->
Login( $_POST[
'username'], $_POST[
'password'] );
727 @dbg_error_log(
"Login",
":_CheckLogin: User %s - %s (%d) login status is %d", $username, $this->fullname, $this->user_no, $this->logged_in );
729 else if ( !isset($_COOKIE[
'sid']) && isset($c->authenticate_hook[
'server_auth_type']) ) {
733 if ( ( is_array($c->authenticate_hook[
'server_auth_type'])
734 && in_array( strtolower($_SERVER[
'AUTH_TYPE']), array_map(
'strtolower', $c->authenticate_hook[
'server_auth_type'])) )
736 ( !is_array($c->authenticate_hook[
'server_auth_type'])
737 && strtolower($c->authenticate_hook[
'server_auth_type']) == strtolower($_SERVER[
'AUTH_TYPE']) )
739 if (isset($_SERVER[
"REMOTE_USER"]))
740 $this->
Login($_SERVER[
'REMOTE_USER'],
"",
true);
742 $this->
Login($_SERVER[
'REDIRECT_REMOTE_USER'],
"",
true);
756 if ( preg_match(
'#^\s*$#', $indate ) ) {
760 if ( preg_match(
'#^\d{1,2}[/-]\d{1,2}[/-]\d{2,4}#', $indate ) ) {
764 $yr = substr($indate,0,4);
765 $mo = substr($indate,5,2);
766 $dy = substr($indate,8,2);
767 switch ( $this->date_format_type ) {
769 $out = sprintf(
"%d/%d/%d", $mo, $dy, $yr );
772 $out = sprintf(
"%d/%d/%d", $dy, $mo, $yr );
775 $out = sprintf(
"%d-%02d-%02d", $yr, $mo, $dy );
778 if ( $type ==
'timestamp' ) {
779 $out .= substr($indate,10,6);
818 if ( $method ==
'GET' && isset($_GET[$varname])) {
819 $hashwegot = $_GET[$varname];
820 dbg_error_log(
'Session',
':CheckConfirmationHash: We got "%s" from GET', $hashwegot );
822 else if ( isset($_POST[$varname]) ) {
823 $hashwegot = $_POST[$varname];
824 dbg_error_log(
'Session',
':CheckConfirmationHash: We got "%s" from POST', $hashwegot );
830 if ( preg_match(
'{^\*(.+)\*.+$}i', $hashwegot, $regs ) ) {
833 dbg_error_log(
'Session',
':CheckConfirmationHash: Salt "%s"', $salt );
834 $test_against = session_salted_md5( $this->session_start.$varname.$this->session_key, $salt ) ;
835 dbg_error_log(
'Session',
':CheckConfirmationHash: Testing against "%s"', $test_against );
837 return ($hashwegot == $test_against);