Browse Source

Changing URL sent to user see #6113

Julio Montoya 12 years ago
parent
commit
c2f8bb1dce
1 changed files with 41 additions and 47 deletions
  1. 41 47
      main/inc/lib/login.lib.php

+ 41 - 47
main/inc/lib/login.lib.php

@@ -29,7 +29,6 @@ class Login
     public static function get_user_account_list($user, $reset = false, $by_username = false)
     {
         global $_configuration;
-        //$portal_url = $_configuration['root_web'];
         $portal_url = api_get_path(WEB_PATH);
 
         if ($_configuration['multiple_access_urls']) {
@@ -112,13 +111,13 @@ class Login
         if (api_mail_html('', $email_to, $email_subject, $email_body, $sender_name, $email_admin) == 1) {
             return get_lang('your_password_has_been_reset');
         } else {
-            $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));            
-            return sprintf(get_lang('ThisPlatformWasUnableToSendTheEmailPleaseContactXForMoreInformation'), $admin_email);            
+            $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));
+            return sprintf(get_lang('ThisPlatformWasUnableToSendTheEmailPleaseContactXForMoreInformation'), $admin_email);
         }
     }
 
     /**
-     * Handle encrypted password, send an email to a user with his password 
+     * Handle encrypted password, send an email to a user with his password
      *
      * @param int	user id
      * @param bool	$by_username
@@ -126,7 +125,6 @@ class Login
      * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
      */
     public static function handle_encrypted_password($user, $by_username = false) {
-        global $_configuration;
         $email_subject = "[" . api_get_setting('siteName') . "] " . get_lang('LoginRequest'); // SUBJECT
 
         if ($by_username) { // Show only for lost password
@@ -136,8 +134,6 @@ class Login
             $user_account_list = self::get_user_account_list($user, true); // BODY
             $email_to = $user[0]['email'];
         }
-
-        $secret_word = self::get_secret_word($email_to);
         $email_body = get_lang('DearUser') . " :\n" . get_lang('password_request') . "\n";
         $email_body .= $user_account_list . "\n-----------------------------------------------\n\n";
         $email_body .= get_lang('PasswordEncryptedForSecurity');
@@ -148,16 +144,15 @@ class Login
         $email_admin = api_get_setting('emailAdministrator');
 
         if (@api_mail_html('', $email_to, $email_subject, $email_body, $sender_name, $email_admin) == 1) {
-
             if (CustomPages::enabled()) {
                 return get_lang('YourPasswordHasBeenEmailed');
             } else {
                 Display::display_confirmation_message(get_lang('YourPasswordHasBeenEmailed'));
             }
         } else {
-            $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));            
+            $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));
             $message = sprintf(get_lang('ThisPlatformWasUnableToSendTheEmailPleaseContactXForMoreInformation'), $admin_email);
-            
+
             if (CustomPages::enabled()) {
                 return $message;
             } else {
@@ -172,8 +167,7 @@ class Login
      */
     public static function get_secret_word($add)
     {
-        global $_configuration;
-        return $secret_word = md5($_configuration['security_key'] . $add);
+        return $secret_word = sha1($add);
     }
 
     /**
@@ -194,12 +188,12 @@ class Login
             return get_lang('CouldNotResetPassword');
         }
 
-        if (self::get_secret_word($user['email']) == $secret) { // OK, secret word is good. Now change password and mail it.
+        if (self::get_secret_word($user['email']) == $secret) {
+            // OK, secret word is good. Now change password and mail it.
             $user['password'] = api_generate_password();
-            $crypted = $user['password'];
-            $crypted = api_get_encrypted_password($crypted);
+            $crypted = api_get_encrypted_password($user['password']);
             $sql = "UPDATE " . $tbl_user . " SET password='$crypted' WHERE user_id = $id";
-            $result = Database::query($sql);
+            Database::query($sql);
             return self::send_password_to_user($user, $by_username);
         } else {
             return get_lang('NotAllowed');
@@ -210,7 +204,7 @@ class Login
      *
      * @global bool   $is_platformAdmin
      * @global bool   $is_allowedCreateCourse
-     * @global object $_user 
+     * @global object $_user
      */
     public static function init_user($user_id, $reset)
     {
@@ -267,8 +261,8 @@ class Login
                     Session::write('is_platformAdmin', $is_platformAdmin);
                     Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
 
-//                  
-//                    
+//
+//
 //                    // If request_uri is setted we have to go further to have course permissions
 //                    if (empty($_SESSION['request_uri']) || !isset($_SESSION['request_uri'])) {
 //                        if (isset($_SESSION['noredirection'])) {
@@ -311,9 +305,9 @@ class Login
      * @global type $is_courseMember
      * @global type $is_sessionAdmin
      * @global type $is_allowed_in_course
-     * 
+     *
      * @param type $course_id
-     * @param type $reset 
+     * @param type $reset
      */
     static function init_course($course_id, $reset)
     {
@@ -335,7 +329,7 @@ class Login
         global $is_allowed_in_course;
 
         if ($reset) {
-            // Course session data refresh requested or empty data        
+            // Course session data refresh requested or empty data
             if ($course_id) {
                 $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
                 $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
@@ -383,7 +377,7 @@ class Login
                     Session::write('_real_cid', $_real_cid);
 
                     // if a session id has been given in url, we store the session
-                    
+
                     // Database Table Definitions
                     $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
                     $tbl_session_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
@@ -425,14 +419,14 @@ class Login
                         }
                     }
                 }
-                //Deleting session info 
+                //Deleting session info
                 if (api_get_session_id()) {
                     Session::erase('id_session');
                     Session::erase('session_name');
                 }
             }
         } else {
-            // Continue with the previous values       
+            // Continue with the previous values
             if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
                 $_cid = -1;        //set default values that will be caracteristic of being unset
                 $_course = -1;
@@ -441,7 +435,7 @@ class Login
                 $_course = $_SESSION['_course'];
 
                 // these lines are usefull for tracking. Indeed we can have lost the id_session and not the cid.
-                // Moreover, if we want to track a course with another session it can be usefull        
+                // Moreover, if we want to track a course with another session it can be usefull
                 if (!empty($_GET['id_session'])) {
                     $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
                     $sql = 'SELECT name FROM ' . $tbl_session . ' WHERE id="' . intval($_SESSION['id_session']) . '"';
@@ -464,9 +458,9 @@ class Login
 
                         /*
                          * When $_configuration['session_lifetime'] is too big 100 hours (in order to let users take exercises with no problems)
-                         * the function Tracking::get_time_spent_on_the_course() returns big values (200h) due the condition: 
+                         * the function Tracking::get_time_spent_on_the_course() returns big values (200h) due the condition:
                          * login_course_date > now() - INTERVAL $session_lifetime SECOND
-                         * 
+                         *
                          */
                         /*
                           if (isset($_configuration['session_lifetime'])) {
@@ -483,10 +477,10 @@ class Login
                         if (isset($_user['user_id']) && !empty($_user['user_id'])) {
 
                             //We select the last record for the current course in the course tracking table
-                            //But only if the login date is < than now + max_life_time            
+                            //But only if the login date is < than now + max_life_time
                             $sql = "SELECT course_access_id FROM $course_tracking_table
                             WHERE   user_id     = " . intval($_user ['user_id']) . " AND
-                                    course_code = '$course_code' AND 
+                                    course_code = '$course_code' AND
                                     session_id  = " . api_get_session_id() . " AND
                                     login_course_date > now() - INTERVAL $session_lifetime SECOND
                         ORDER BY login_course_date DESC LIMIT 0,1";
@@ -495,7 +489,7 @@ class Login
                             if (Database::num_rows($result) > 0) {
                                 $i_course_access_id = Database::result($result, 0, 0);
                                 //We update the course tracking table
-                                $sql = "UPDATE $course_tracking_table  SET logout_course_date = '$time', counter = counter+1  
+                                $sql = "UPDATE $course_tracking_table  SET logout_course_date = '$time', counter = counter+1
                                 WHERE course_access_id = " . intval($i_course_access_id) . " AND session_id = " . api_get_session_id();
                                 //error_log($sql);
                                 Database::query($sql);
@@ -526,7 +520,7 @@ class Login
 
             if (isset($user_id) && $user_id && isset($_cid) && $_cid) {
 
-                //Check if user is subscribed in a course        
+                //Check if user is subscribed in a course
                 $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
                 $sql = "SELECT * FROM $course_user_table
                    WHERE user_id  = '" . $user_id . "' AND relation_type <> " . COURSE_RELATION_TYPE_RRHH . "
@@ -556,7 +550,7 @@ class Login
                 //We are in a session course? Check session permissions
                 if (!empty($session_id)) {
 
-                    //I'm not the teacher of the course 
+                    //I'm not the teacher of the course
                     if ($is_courseAdmin == false) {
                         // this user has no status related to this course
                         // The user is subscribed in a session? The user is a Session coach a Session admin ?
@@ -565,19 +559,19 @@ class Login
                         $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
                         $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
 
-                        //Session coach, session admin, course coach admin 
+                        //Session coach, session admin, course coach admin
                         $sql = "SELECT session.id_coach, session_admin_id, session_rcru.id_user
                 		FROM $tbl_session session, $tbl_session_course_user session_rcru
-					    WHERE  session_rcru.id_session  = session.id AND 
-					           session_rcru.course_code = '$_cid' AND 
-					           session_rcru.id_user     = '$user_id' AND 
+					    WHERE  session_rcru.id_session  = session.id AND
+					           session_rcru.course_code = '$_cid' AND
+					           session_rcru.id_user     = '$user_id' AND
                                session_rcru.id_session  = $session_id AND
 					           session_rcru.status      = 2";
 
                         $result = Database::query($sql);
                         $row = Database::store_result($result);
 
-                        //I'm a session admin?                
+                        //I'm a session admin?
                         if (isset($row) && isset($row[0]) && $row[0]['session_admin_id'] == $user_id) {
                             $_courseUser['role'] = 'Professor';
                             $is_courseMember = false;
@@ -588,9 +582,9 @@ class Login
                         } else {
                             //Im a coach or a student?
                             $sql = "SELECT id_user, status FROM " . $tbl_session_course_user . "
-                            WHERE   course_code = '$_cid' AND 
+                            WHERE   course_code = '$_cid' AND
                                     id_user     = '" . $user_id . "' AND
-                                    id_session  = '" . $session_id . "'                                    
+                                    id_session  = '" . $session_id . "'
                             LIMIT 1";
                             $result = Database::query($sql);
 
@@ -728,9 +722,9 @@ class Login
      * @global int $_cid
      * @global array $_course
      * @global int $_gid
-     * 
+     *
      * @param int $group_id
-     * @param bool $reset 
+     * @param bool $reset
      */
     static function init_group($group_id, $reset)
     {
@@ -785,14 +779,14 @@ class Login
             }
         }
     }
-    
+
     /**
      * Returns true if user exists in the platform when asking the password
-     * 
+     *
      * @param string $username (email or username)
      * @return boolean
      */
-    function get_user_accounts_by_username($username) {        
+    function get_user_accounts_by_username($username) {
         if (strpos($username,'@')){
             $username = api_strtolower($username);
             $email = true;
@@ -809,8 +803,8 @@ class Login
         }
 
 		$tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
-		$query = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, username AS loginName, password, email, 
-                         status AS status, official_code, phone, picture_uri, creator_id 
+		$query = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, username AS loginName, password, email,
+                         status AS status, official_code, phone, picture_uri, creator_id
 				 FROM  $tbl_user
 				 WHERE ( $condition AND active = 1) ";
 		$result 	= Database::query($query);