Source for file User.inc

<?php
################################################################
# This file is part of the Core module of CompInaBox           #
# Copyright 2002. Eric D. Nielsen, All rights reserverd        #
# CompInaBox is availible for license under the GPL, see       #
# the COPYING file in the root directory of the install for    #
# the full terms of the GPL.                                   #
#                                                              #
# File: User.inc                                               #
# Author: Eric D. Nielsen                                      #
# Description: Authenticated user class                        #
# Attributes:                                                  #
# Constructor:                                                 #
# Methods:                                                     #
################################################################
 
 
 
class User
{
  var $db;
  var $username;
  var $permissions;
  var $isSuperUser;
 
  function User($db)
    {
      $this->db=$db;
      $this->username = "";
      $this->permissions=array();
    }
 
  function isSiteAdmin()
    {
      return $this->isSuperUser;
    }
 
  function getKeys()
    {
      return $this->permissions;
 
    }
 
  function getEmail()
    {
      $query="SELECT email FROM users NATURAL JOIN people_email WHERE username='".$this->username."' AND main_addr = TRUE;";
      $result=$this->db->query($query);
      list($email)=$result->getRowAt(0);
      return $email;
    }
 
 
  function login($username,$password)
    {
      $query = "SELECT hashed FROM users WHERE username='$username' AND status_name='ACTIVE';";
      $result = $this->db->query($query);
      if ($result->numrows()!=1)
    return FALSE;
      list($ref_pass)=$result->getRowAt(0);
      $test_pass = crypt($password,$ref_pass);
      if ($test_pass==$ref_pass)
    {
      $this->private_retrieve($username);
      return TRUE;
    }
      else
    return FALSE;
    }
 
  function retrieve($username)
    {
      GLOBAL $HTTP_SESSION_VARS,$HTTP_REFERER;
      $ref_hash = $HTTP_SESSION_VARS["security_hash"];
      $test_hash = md5($username . session_id() . $HTTP_REFERER . $ref_hash);
      if ($ref_hash==$test_hash)
    {
      private_retrieve($username);
      return TRUE;
    }
      else
    return FALSE;
    }
    
  function getUsername()
    {
      return $this->username;
    }
  
  function isLoggedIn()
    {
      return $this->username!="";
    }
 
  function mayAuthorizeKey($key)
    {
      if ($this->isSiteAdmin()) return TRUE;
      $userKeys = $this->getKeys();
      if (count($userKeys)==0) return FALSE;
      switch($key["Type"])
    {
    case "Site" : return FALSE;break;
    case "Comp" : 
      foreach ($userKey as $testKey) 
        {
          if ($testKey["Type"]=="Comp" &&
          $testKey["Compname"]==$key["Compname"] &&
          equalOrGreaterKeyLevel($key["Level"],
                     $testKey["Level"],"Comp"))
        return TRUE;
        }
      return FALSE;
      break;
    case "Team" : 
      foreach ($userKey as $testKey) 
        {
          if ($testKey["Type"]=="Team" &&
          $testKey["TeamID"]==$key["TeamID"] &&
          equalOrGreaterKeyLevel($testkey["Level"],
                     $key["Level"],"Team"))
        return TRUE;
        }
      return FALSE;
      break;
    default: return FALSE;
    }
    }
 
  function getComps()
    {
      $comps = array();
      $isSiteAdmin = $this->isSiteAdmin();
      $compList = $this->db->getHostedComps();
      $username = $this->getUsername();
      foreach ($compList as $aComp)
    {
      $name = $aComp["Label"];
      $compunix = $aComp["Link"];
      $tasks = array();
      $query = "SELECT * FROM hosted_comps_view WHERE compname='$name' ";
      $query .= "AND status_name='OPEN';";
      $result = $this->db->query($query);
      if ($result->numrows())
        $tasks[]="Register";
      $query = "SELECT * FROM user_comp_roles ";
      $query .= "WHERE username='$username' AND compunix='$compunix';";
      $result = $this->db->query($query);
      if ($result->numrows() || $isSiteAdmin)
        {
          $tasks[] = "Reg Admin";
          $tasks[] = "Setup";
        }
      $query = "SELECT * FROM user_team_roles ";
      $query .= "WHERE username='$username' AND rolename <>'Affiliation Member';";
      $result = $this->db->query($query);
      if ($result->numrows() || $isSiteAdmin)
        {
          $tasks[] = "Affil";
        }
      if (count($tasks))
          $comps[] = array("CompName"=>$name,
                   "CompUnixname"=>$compunix,
                   "Tasks"=>$tasks);
    }
      return $comps;
    }
 
 
 
 
  function private_retrieve($username)
    {
      $this->username=$username;
      $query = "SELECT siteadmin FROM users WHERE username='$username';";
      $result = $this->db->query($query);
      if ($result->numrows())
    {
      list($siteadmin) = $result->getRowAt(0);
      $this->permissions=array();
      if ($siteadmin=='t')
        {
          $this->isSuperUser=TRUE;
          $this->permissions[]=array("Type"=>"Site",
                     "Level"=>"Admin");
        }
      $query = "SELECT compunix,rolename FROM ";
      $query .= "user_comp_roles ";
      $query .= "WHERE username='{$this->username}' ";
      $query .= "ORDER BY compunix, rolename;";
      $result = $this->db->query($query);
      $numPermissions = $result->numrows();
      for ($i=0;$i< $numPermissions;$i++)
        { 
          list($comp,$role) = $result->getRowAt($i);
          $this->permissions[]=array("Type"=>"Comp",
                     "Compname"=>"$comp",
                     "Level"=>"$role");
        }
      $query = "SELECT teamid,rolename FROM  ";
      $query .= "user_team_roles ";
      $query .= "WHERE username='{$this->username}' ";
      $query .= "ORDER BY teamid, rolename;";
      $result = $this->db->query($query);
      $numPermissions = $result->numrows();
      for ($i=0;$i< $numPermissions;$i++)
        { 
          list($team,$role) = $result->getRowAt($i);
          $this->permissions[]=array("Type"=>"Team",
                     "TeamID"=>"$team",
                     "Level"=>"$role");
        }
      return TRUE;
    }
      else
    return FALSE;
    }
 
  // OBE: Gate/Guard combo handles this now
#  function mayView($page,$roleRestrict="")
#    {
#      // if the page asking for permission isn't a CIB page return false
#      if (FALSE===strpos(COMPINABOX_SECURE_URL,$page))
#    return FALSE;
#      // superuser doesn't need to use permission table
#      if ($this->isSuperUser)
#    return TRUE;##
#
#      // strip the common base url
#      $baseLen = strlen(COMPINABOX_SECURE_URL);
#      $dispatchString = substr($page,$baseLen);#
#
#      // everyone may view the CompInaBox index page
#      $lastSlash = strrpos($dispatchString,'/');
#      if ($lastSlash==0)
#    return TRUE;
#      
#      $requestPage = substr($dispatchString,$lastSlash);
#      $path = substr($dispatchString,0,strlen($dispatchString)-
#                               strlen($requestPage));#
#
#
#      $directories = explode("/",$path);
#      // directories[0]=""
#      // directories[1]=toolname, if present
#      // directories[2]=compname, if present#
#
#      // All top level pages are public
#      if (count($directories) < 3)
#    return TRUE;#
#
#      if (isset($this->permissions[$directories[2]]))
#    {
#      // if the user has this permission, and the calling page hasn't
#      // imposed additional restrictions, the user may view the page
#      if ($roleRestrict=="")
#          return TRUE;
#      else
#        {
#          $perms = $this->permissions[$directories[2]];
#          if (count(array_intersect($perms,$roleRestrict)))
#          return TRUE;
#          else
#          return FALSE;
#        }
#    }
#      else
#    return FALSE;
#    }
 
  function mail_username($email)
    {
      $query = "SELECT username FROM users NATURAL JOIN people_email WHERE email='$email';";
      $result = $this->db->query($query);
      if ($result->numrows()==1)
    {
      list($username)=$result->getRowAt(0);
      mail($email,"[CompInaBox] Username reminder",
           "Someone, hopefully you, requested the username associated with
this email address.  The username is $username .  If you did not request this
mailing please contact ".COMPINABOX_ADMIN_EMAIL." immediately.",
           "From: noreply@".COMPINABOX_DOMAIN."\r\n");
      return TRUE;
    }
      else
      return FALSE;
    }      
 
  //:NOTE: siteadmin may NOT request their password in this manner
  function reset_and_mail_password($username)
    {
      $query = "SELECT email FROM users NATURAL JOIN people_email where username='$username' AND siteadmin=FALSE;";
      $result = $this->db->query($query);
      if ($result->numrows()==1)
    {
      list($email)=$result->getRowAt(0);
      $password="";
#:TODO: SEED the random number generate somewhere....
      for ($i=0;$i<8;$i++)
        $password.=$this->encode(random(70));
      mail($email,"[CompInaBox] Password reset",
           "Somebody, hopefully you, requested that the password associated
with your accoun be reset.  The new password is $password .  Please log in
immediately and change it as this message was sent in the clear.  If you did
not request this please contact ".COMPINABOX_ADMIN_EMAIL." immediately.",
           "From: noreply@".COMPINABOX_DOMAIN."\r\n");
      return $this->private_change_password($password,$username);
    }
      else
    {
      return FALSE;
    }
    }
 
  function private_change_password($password,$username="")
    {  
      if ($username=="" && $this->username=="") return FALSE;
      if ($username=="") $username=$this->username;
      // generate an MD5-style salt
      $salt = '$1$'.substr(md5(microtime().getmypid()),0,12);
      $hashed = crypt($password,$salt);
      $query = "UPDATE users SET hashed='$hashed' WHERE username='$username';";
      $this->db->query($query);
      return TRUE;
    }
 
  function createPendingAccount($username,$email,$password,$firstname,$lastname)
    {
      GLOBAL $CIB_SERVER_HOST_NAME, $CIB_ADMIN_EMAIL, $CIB_SECURE_URL;
      GLOBAL $CIB_DOMAIN, $CIB_HOSTNAME;
      GLOBAL $CIB_HASH_SECRET;
      // generate an MD5-style salt
      $salt = '$1$'.substr(md5(microtime().getmypid()),0,12);
      $hashed = crypt($password,$salt);
      $this->db->startTransaction();
      //      $query = "SELECT peopleid FROM people where firstname='$firstname' AND lastname='$lastname';";
      $query ="SELECT nextval('people_peopleid_seq');";
      $result = $this->db->query($query);
      list($peopleid)=$result->getRowAt(0);
      $query = "INSERT INTO people (peopleid,firstname, lastname) VALUES ($peopleid,'$firstname', '$lastname');";
      $result = $this->db->query($query);
      $query = "SELECT email FROM people_email WHERE peopleid=$peopleid;";
      $result = $this->db->query($query);
      if ($result->numrows())
    {
      $numEmails = $result->numrows();
      $matched=FALSE;
      for ($i=0;$i < $numEmails;$i++)
        {  
          list($tempEmail) = $result->getRowAt($i);
          if ($tempEmail==$email) $matched=TRUE;
          if ($matched) break;
        }
      if (!$matched)
        {
      $query = "INSERT INTO people_email (peopleid,email,main_addr) VALUES ($peopleid,'$email',FALSE);";
        }
    }
      else
    {
      $query = "INSERT INTO people_email (peopleid,email,main_addr) VALUES ($peopleid,'$email',TRUE);";
    }
      $query = $this->db->query($query);
      $query = "INSERT INTO users (status_name,username,hashed,peopleid,siteadmin) ";
      $query.= " VALUES ('PENDING','$username','$hashed',$peopleid,FALSE);";
      $result = $this->db->query($query);
 
      $confirmation_hash = MD5($CIB_HASH_SECRET . $username);
      $query = "INSERT INTO user_hashes (username, hash) VALUES ";
      $query.= "('$username','$confirmation_hash')";
      $result = $this->db->query($query);
      $mail_to = $email;
      $title = "[CompInaBox-$CIB_SERVER_HOST_NAME] New Account";
      /* The following block is a HEREDOC, make sure you understand how
     they work before you edit it, don't event add spaces/tabes */
      $body =<<<END_EMAIL
This Email is sent to you to confirm your new account on the 
$CIB_SERVER_HOST_NAME CompInaBox Server.  To complete your registration
simply follow the following link (or cut and paste it into a browser).
$CIB_SECURE_URL/accounts/confirm_account.php?hash=$confirmation_hash
 
If you did not request this account, you may safely ignore this
email or you may contact $CIB_ADMIN_EMAIL to report this.
 
-- The $CIB_SERVER_HOST_NAME CompInaBox staff
END_EMAIL;
      $headers='From: noreply@'.$CIB_HOSTNAME.$CIB_DOMAIN."\r\n";
      mail($mail_to,$title,$body,$headers);
      $this->db->commit();
    }
 
  function activate_user($username)
    {
      GLOBAL $CIB_DB_NAME, $CIB_AUTH_USER,$CIB_AUTH_PASS;
      GLOBAL $CIB_ADMIN_USER,$CIB_ADMIN_PASS;
      if (""==$username) return;
      // upgrade database connection to an authenticated user
      $this->db = new CIB_DB($CIB_DB_NAME,$CIB_AUTH_USER,$CIB_AUTH_PASS);
 
      $query = "UPDATE users SET status_name='ACTIVE' WHERE username='$username';";
      $this->db->query($query);
      $query= "DELETE FROM user_hashes WHERE username='$username';";
      $tempDB = new CIB_DB($CIB_DB_NAME,$CIB_ADMIN_USER,$CIB_ADMIN_PASS);
      $tempDB->query($query);
      return;
    }
 
}