Ver código fonte

All admins can login to all portals when multiple access url is enabled see CT#1308

Julio Montoya 15 anos atrás
pai
commit
fdc4a36c37
1 arquivos alterados com 128 adições e 92 exclusões
  1. 128 92
      main/inc/local.inc.php

+ 128 - 92
main/inc/local.inc.php

@@ -212,10 +212,9 @@ if (api_get_setting('allow_terms_conditions')=='true') {
 			}
 		}
 	}
-
 }
 
-	if ((isset($_POST['login']) && isset($_POST['password']))) {
+	if ((isset($_POST['login']) && isset($_POST['password']))) { 
     	// $login && $password are given to log in
 		$login = $_POST['login'];
 		$password = $_POST['password'];
@@ -243,7 +242,7 @@ if (api_get_setting('allow_terms_conditions')=='true') {
 	                if (isset($_POST['password']) && isset($_SESSION['info_current_user'][2]) && $_POST['password']==$_SESSION['info_current_user'][2]) {
 	                	$password=$_POST['password'];
 	                } else {
-	                	  $password = api_get_encrypted_password($password);
+	               		$password = api_get_encrypted_password($password);
 	                }
                 } else {
                 	$password = api_get_encrypted_password($password);
@@ -272,31 +271,51 @@ if (api_get_setting('allow_terms_conditions')=='true') {
                 		// Check if the expiration date has not been reached
                 		if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
                 			global $_configuration;
-                			if ($_configuration['multiple_access_urls']==true) {
-								//Check the access_url configuration setting if the user is registered in the access_url_rel_user table
-								//Getting the current access_url_id of the platform
-                				$current_access_url_id = api_get_current_access_url_id();
-                				// my user is subscribed in these sites => $my_url_list
-                				$my_url_list = api_get_access_url_from_user($uData['user_id']);
-
-                				if (is_array($my_url_list) && count($my_url_list)>0 ){
-                					// the user have the permissions to enter at this site
-                					if (in_array($current_access_url_id, $my_url_list)) {
-                						$_user['user_id'] = $uData['user_id'];
-										api_session_register('_user');
-										event_login();
-                					} else {
+                			
+                			if ($_configuration['multiple_access_urls'] == true) {
+								$admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
+								
+                				//Check if user is an admin 
+								$sql = "SELECT user_id FROM $admin_table
+							            WHERE user_id = '".trim(addslashes($uData['user_id']))."' LIMIT 1";
+							    $result = Database::query($sql);
+							    
+							    $my_user_is_admin = false;							
+							    if (Database::num_rows($result) > 0) {
+									$my_user_is_admin = true;
+							    }
+					            
+					            if ($my_user_is_admin === false) {
+									//Check the access_url configuration setting if the user is registered in the access_url_rel_user table
+									//Getting the current access_url_id of the platform
+	                				$current_access_url_id = api_get_current_access_url_id();
+	                				// my user is subscribed in these sites => $my_url_list
+	                				$my_url_list = api_get_access_url_from_user($uData['user_id']);
+	
+	                				if (is_array($my_url_list) && count($my_url_list)>0 ){
+	                					// the user have the permissions to enter at this site
+	                					if (in_array($current_access_url_id, $my_url_list)) {
+	                						$_user['user_id'] = $uData['user_id'];
+											api_session_register('_user');
+											event_login();
+	                					} else {
+		                					$loginFailed = true;
+											api_session_unregister('_uid');
+											header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
+											exit;
+	                					}
+	                				} else {
 	                					$loginFailed = true;
 										api_session_unregister('_uid');
 										header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
 										exit;
-                					}
-                				} else {
-                					$loginFailed = true;
-									api_session_unregister('_uid');
-									header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
-									exit;
-                				}
+	                				}
+					            } else {
+					            	//All admins can login in any multiple URL
+				            		$_user['user_id'] = $uData['user_id'];
+									api_session_register('_user');
+									event_login();				            	
+					            }
                 			} else {
                 				$_user['user_id'] = $uData['user_id'];
 								api_session_register('_user');
@@ -399,10 +418,10 @@ if (api_get_setting('allow_terms_conditions')=='true') {
     	 * - $master variable should be recovered from chamilo settings.
     	*/
         $master = array(
-    		'domain' => api_get_setting('sso_authentication_domain'), 			//	'localhost/project/drupal5',
-    		'auth_uri' => api_get_setting('sso_authentication_auth_uri'),		//	'/?q=user',
-    		'deauth_uri' => api_get_setting('sso_authentication_unauth_uri'),	//	'/?q=logout',
-    		'protocol' => api_get_setting('sso_authentication_protocol')		//	'http://',
+    		'domain' 		=> api_get_setting('sso_authentication_domain'), 			//	'localhost/project/drupal5',
+    		'auth_uri' 		=> api_get_setting('sso_authentication_auth_uri'),		//	'/?q=user',
+    		'deauth_uri'	=> api_get_setting('sso_authentication_unauth_uri'),	//	'/?q=logout',
+    		'protocol' 		=> api_get_setting('sso_authentication_protocol')		//	'http://',
         );
         $referer = $master['protocol'] . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
         if (isset($_SESSION['_user']['user_id'])) {
@@ -418,73 +437,90 @@ if (api_get_setting('allow_terms_conditions')=='true') {
                 header('Location: '. $master['protocol'] . $master['domain'] . $master['deauth_uri']);
                 exit;
             }
-      } elseif(!$logout) {
-          $master_url = $master['domain'] . $master['auth_uri'];
-          // Handle cookie comming from Master Server
-          if (!isset($_GET['sso_referer']) && !isset($_GET['loginFailed'])) {
-              // Target to redirect after success SSO
-              $target = api_get_path(WEB_PATH);
-              // Redirect to master server
-              header('Location: ' . $master['protocol'] . $master_url . '&sso_referer=' . urlencode($referer) . '&sso_target=' . urlencode($target));
-              exit;
-          } elseif (isset($_GET['sso_cookie'])) {
-              if (isset($_GET['sso_referer']) ? $_GET['sso_referer'] === $master['protocol']. $master_url : FALSE) {
-                  $sso = unserialize(base64_decode($_GET['sso_cookie']));
-                  //lookup the user in the main database
-                  $user_table = Database::get_main_table(TABLE_MAIN_USER);
-                  $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
+	} elseif(!$logout) {
+          	$master_url = $master['domain'] . $master['auth_uri'];
+        	// Handle cookie comming from Master Server
+		if (!isset($_GET['sso_referer']) && !isset($_GET['loginFailed'])) {
+            // Target to redirect after success SSO
+            $target = api_get_path(WEB_PATH);
+            // Redirect to master server
+            header('Location: ' . $master['protocol'] . $master_url . '&sso_referer=' . urlencode($referer) . '&sso_target=' . urlencode($target));
+        	exit;
+		} elseif (isset($_GET['sso_cookie'])) {
+			if (isset($_GET['sso_referer']) ? $_GET['sso_referer'] === $master['protocol']. $master_url : FALSE) {
+                $sso = unserialize(base64_decode($_GET['sso_cookie']));
+                //lookup the user in the main database
+                $user_table = Database::get_main_table(TABLE_MAIN_USER);
+                $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
                           FROM $user_table
                           WHERE username = '".trim(addslashes($sso['username']))."'";
 
-                  $result = Database::query($sql);
-
-                  if (Database::num_rows($result) > 0) {
-                      $uData = Database::fetch_array($result);
-                      // check the user's password
-                      if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
-                          // Make sure password is encrypted with md5
-                          if (!$userPasswordCrypted) {
-                              $uData['password'] = md5($uData['password']);
-                          }
-                          //the authentification of this user is managed by Dokeos itself// check the user's password
-                          // password hash comes into a sha1
-                          if ($sso['secret'] === sha1($uData['password']) && ($sso['username'] == $uData['username'])) {
-                              // check if the account is active (not locked)
-                              if ($uData['active']=='1') {
-                                  // check if the expiration date has not been reached
-                                  if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
-                                      global $_configuration;
-                                      if ($_configuration['multiple_access_urls'] == true) {
-                                          //check the access_url configuration setting if the user is registered in the access_url_rel_user table
-                                          //getting the current access_url_id of the platform
-                                          $current_access_url_id = api_get_current_access_url_id();
-                                          // my user is subscribed in these sites => $my_url_list
-                                          $my_url_list = api_get_access_url_from_user($uData['user_id']);
-
-                                          if (is_array($my_url_list) && count($my_url_list)>0 ) {
-                                              if (in_array($current_access_url_id, $my_url_list)) {
-                                                  // the user has permission to enter at this site
-                                                  $_user['user_id'] = $uData['user_id'];
-                                                  api_session_register('_user');
-                                                  event_login();
-
-                                                  // Redirect to homepage
-                                                  $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
-                                                  header('Location: '. $sso_target);
-                                              } else {
-                                                  // user does not have permission for this site
-                                                  $loginFailed = true;
-                                                  api_session_unregister('_uid');
-                                                  header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
-                                                  exit;
-                                              }
-                                          } else {
-                                              // there is no URL in the multiple urls list for this user
-                                              $loginFailed = true;
-                                              api_session_unregister('_uid');
-                                              header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
-                                              exit;
-                                          }
+                $result = Database::query($sql);
+
+				if (Database::num_rows($result) > 0) {
+					$uData = Database::fetch_array($result);
+					//Check the user's password
+					if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
+                        // Make sure password is encrypted with md5
+                        if (!$userPasswordCrypted) {
+                        	$uData['password'] = md5($uData['password']);
+                        }
+                        //the authentification of this user is managed by Dokeos itself// check the user's password
+                        // password hash comes into a sha1
+						if ($sso['secret'] === sha1($uData['password']) && ($sso['username'] == $uData['username'])) {
+							//Check if the account is active (not locked)
+							if ($uData['active']=='1') {
+                                // check if the expiration date has not been reached
+								if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
+                                    global $_configuration;
+									if ($_configuration['multiple_access_urls'] == true) {
+                                      	$admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
+										//Check if user is an admin 
+										$sql = "SELECT user_id FROM $admin_table
+									            WHERE user_id = '".trim(addslashes($uData['user_id']))."' LIMIT 1";
+									    $result = Database::query($sql);									    
+									    $my_user_is_admin = false;							
+									    if (Database::num_rows($result) > 0) {
+											$my_user_is_admin = true;
+									    }							            
+							            if ($my_user_is_admin === false) {						            	
+		                                      //check the access_url configuration setting if the user is registered in the access_url_rel_user table
+		                                      //getting the current access_url_id of the platform
+		                                      $current_access_url_id = api_get_current_access_url_id();
+		                                      // my user is subscribed in these sites => $my_url_list
+		                                      $my_url_list = api_get_access_url_from_user($uData['user_id']);
+		
+		                                      if (is_array($my_url_list) && count($my_url_list)>0 ) {
+		                                          if (in_array($current_access_url_id, $my_url_list)) {
+		                                              // the user has permission to enter at this site
+		                                              $_user['user_id'] = $uData['user_id'];
+		                                              api_session_register('_user');
+		                                              event_login();
+		
+		                                              // Redirect to homepage
+		                                              $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
+		                                              header('Location: '. $sso_target);
+		                                          } else {
+		                                              // user does not have permission for this site
+		                                              $loginFailed = true;
+		                                              api_session_unregister('_uid');
+		                                              header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
+		                                              exit;
+		                                          }
+		                                      } else {
+		                                          // there is no URL in the multiple urls list for this user
+		                                          $loginFailed = true;
+		                                          api_session_unregister('_uid');
+		                                          header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
+		                                          exit;
+		                                      }
+							            } else {
+							            	//User is an admin, he can login wherever he wants
+							            	 $_user['user_id'] = $uData['user_id'];
+                                              api_session_register('_user');
+                                              event_login();
+							            	
+							            }
                                       } else {
                                             //single URL access
                                             $_user['user_id'] = $uData['user_id'];