local.inc.php 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2005 Dokeos S.A.
  6. Copyright (c) 2003-2005 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Hugues Peeters
  9. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  10. Copyright (c) Patrick Cool
  11. For a full list of contributors, see "credits.txt".
  12. The full license can be read in "license.txt".
  13. This program is free software; you can redistribute it and/or
  14. modify it under the terms of the GNU General Public License
  15. as published by the Free Software Foundation; either version 2
  16. of the License, or (at your option) any later version.
  17. See the GNU General Public License for more details.
  18. Contact address: Dokeos, 44 rue des palais, B-1030 Brussels, Belgium
  19. Mail: info@dokeos.com
  20. ==============================================================================
  21. */
  22. /**
  23. ==============================================================================
  24. *
  25. * SCRIPT PURPOSE
  26. *
  27. * This script initializes and manages Dokeos session information. It
  28. * keeps available session information up to date.
  29. *
  30. * You can request a course id. It will check if the course Id requested is the
  31. * same as the current one. If it isn't it will update session information from
  32. * the database. You can also force the course reset if you want ($cidReset).
  33. *
  34. * All the course information is stored in the $_course array.
  35. *
  36. * You can request a group id. The script will check if the group id requested is the
  37. * same as the current one. If it isn't it will update session information from
  38. * the database. You can also force the course reset if you want ($gidReset).
  39. *
  40. The course id is stored in $_cid session variable.
  41. * The group id is stored in $_gid session variable.
  42. *
  43. *
  44. * VARIABLES AFFECTING THE SCRIPT BEHAVIOR
  45. *
  46. * string $login
  47. * string $password
  48. * boolean $logout
  49. *
  50. * string $cidReq : course id requested
  51. * boolean $cidReset : ask for a course Reset, if no $cidReq is provided in the
  52. * same time, all course informations is removed from the
  53. * current session
  54. *
  55. * int $gidReq : group Id requested
  56. * boolean $gidReset : ask for a group Reset, if no $gidReq is provided in the
  57. * same time, all group informations is removed from the
  58. * current session
  59. *
  60. *
  61. * VARIABLES SET AND RETURNED BY THE SCRIPT
  62. *
  63. * All the variables below are set and returned by this script.
  64. *
  65. * USER VARIABLES
  66. *
  67. * string $_user ['firstName' ]
  68. * string $_user ['lastName' ]
  69. * string $_user ['mail' ]
  70. * string $_user ['lastLogin' ]
  71. * string $_user ['official_code']
  72. * string $_user ['picture_uri' ]
  73. * string $_user['user_id']
  74. *
  75. * boolean $is_platformAdmin
  76. * boolean $is_allowedCreateCourse
  77. *
  78. * COURSE VARIABLES
  79. *
  80. * string $_cid (the course id)
  81. *
  82. * int $_course['id' ] - auto-assigned integer
  83. * string $_course['name' ] - the title of the course
  84. * string $_course['official_code'] - the visual / fake / official code
  85. * string $_course['sysCode' ]
  86. * string $_course['path' ]
  87. * string $_course['dbName' ]
  88. * string $_course['dbNameGlu' ]
  89. * string $_course['titular' ]
  90. * string $_course['language' ]
  91. * string $_course['extLink' ]['url' ]
  92. * string $_course['extLink' ]['name']
  93. * string $_course['categoryCode']
  94. * string $_course['categoryName']
  95. * boolean $is_courseMember
  96. * boolean $is_courseTutor
  97. * boolean $is_courseAdmin
  98. *
  99. *
  100. * GROUP VARIABLES
  101. *
  102. * int $_gid (the group id)
  103. *
  104. *
  105. * IMPORTANT ADVICE FOR DEVELOPERS
  106. *
  107. * We strongly encourage developers to use a connection layer at the top of
  108. * their scripts rather than use these variables, as they are, inside the core
  109. * of their scripts. It will make code maintenance much easier.
  110. *
  111. * Many if the functions you need you can already find in the
  112. * main_api.lib.php
  113. *
  114. * We encourage you to use functions to access these global "kernel" variables.
  115. * You can add them to e.g. the main API library.
  116. *
  117. *
  118. * SCRIPT STRUCTURE
  119. *
  120. * 1. The script determines if there is an authentication attempt. This part
  121. * only chek if the login name and password are valid. Afterwards, it set the
  122. * $_user['user_id'] (user id) and the $uidReset flag. Other user informations are retrieved
  123. * later. It's also in this section that optional external authentication
  124. * devices step in.
  125. *
  126. * 2. The script determines what other session informations have to be set or
  127. * reset, setting correctly $cidReset (for course) and $gidReset (for group).
  128. *
  129. * 3. If needed, the script retrieves the other user informations (first name,
  130. * last name, ...) and stores them in session.
  131. *
  132. * 4. If needed, the script retrieves the course information and stores them
  133. * in session
  134. *
  135. * 5. The script initializes the user permission status and permission for the
  136. * course level
  137. *
  138. * 6. If needed, the script retrieves group informations an store them in
  139. * session.
  140. *
  141. * 7. The script initializes the user status and permission for the group level.
  142. *
  143. * @package dokeos.include
  144. ==============================================================================
  145. */
  146. /*
  147. ==============================================================================
  148. INIT SECTION
  149. variables should be initialised here
  150. ==============================================================================
  151. */
  152. // parameters passed via GET
  153. $logout = isset($_GET["logout"]) ? $_GET["logout"] : '';
  154. $gidReq = isset($_GET["gidReq"]) ? Database::escape_string($_GET["gidReq"]) : '';
  155. //this fixes some problems with generic functionalities like
  156. //My Agenda & What's New icons linking to courses
  157. // $cidReq can be set in the index.php file of a course-area
  158. $cidReq = isset($cidReq) ? Database::escape_string($cidReq) : '';
  159. // $cidReq can be set in URL-parameter
  160. $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $cidReq;
  161. $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
  162. // $cidReset can be set in URL-parameter
  163. $cidReset = isset($_GET["cidReq"])&&$_GET["cidReq"]!=$_SESSION['_cid'] ? Database::escape_string($_GET["cidReq"]) : $cidReset;
  164. $gidReset = isset($gidReset) ? $gidReset : '';
  165. // $gidReset can be set in URL-parameter
  166. // parameters passed via POST
  167. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  168. // passed through other means
  169. //$cidReq -- passed from course folder index.php
  170. /*
  171. ==============================================================================
  172. MAIN CODE
  173. ==============================================================================
  174. */
  175. if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout))
  176. {
  177. // uid is in session => login already done, continue with this value
  178. $_user['user_id'] = $_SESSION['_user']['user_id'];
  179. }
  180. else
  181. {
  182. unset($_user['user_id']); // uid not in session ? prevent any hacking
  183. if(isset($_POST['login']) && isset($_POST['password'])) // $login && $password are given to log in
  184. {
  185. $login = $_POST['login'];
  186. $password = $_POST['password'];
  187. //lookup the user in the main database
  188. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  189. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  190. FROM $user_table
  191. WHERE username = '".trim(addslashes($login))."'";
  192. $result = api_sql_query($sql,__FILE__,__LINE__);
  193. if (mysql_num_rows($result) > 0)
  194. {
  195. $uData = mysql_fetch_array($result);
  196. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE)
  197. {
  198. //the authentification of this user is managed by Dokeos itself
  199. $password = trim(stripslashes($password));
  200. // determine if the password needs to be encrypted before checking
  201. // $userPasswordCrypted is set in an external configuration file
  202. if ($userPasswordCrypted)
  203. {
  204. $password = md5($password);
  205. }
  206. // check the user's password
  207. if ($password == $uData['password'] AND (trim($login) == $uData['username']))
  208. {
  209. // check if the account is active (not locked)
  210. if ($uData['active']=='1')
  211. {
  212. // check if the expiration date has not been reached
  213. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00')
  214. {
  215. $_user['user_id'] = $uData['user_id'];
  216. api_session_register('_user');
  217. if(!function_exists('event_login')){
  218. include(api_get_path(LIBRARY_PATH)."events.lib.inc.php");
  219. event_login();
  220. }
  221. }
  222. else
  223. {
  224. $loginFailed = true;
  225. api_session_unregister('_uid');
  226. header('Location: index.php?loginFailed=1&error=account_expired');
  227. exit;
  228. }
  229. }
  230. else
  231. {
  232. $loginFailed = true;
  233. api_session_unregister('_uid');
  234. header('Location: index.php?loginFailed=1&error=account_inactive');
  235. exit;
  236. }
  237. }
  238. else // login failed: username or password incorrect
  239. {
  240. $loginFailed = true;
  241. api_session_unregister('_uid');
  242. header('Location: index.php?loginFailed=1&error=user_password_incorrect');
  243. exit;
  244. }
  245. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id'])
  246. {
  247. //first login for a not self registred
  248. //e.g. registered by a teacher
  249. //do nothing (code may be added later)
  250. }
  251. }
  252. else // no standard Dokeos login - try external authentification
  253. {
  254. /*
  255. * Process external authentication
  256. * on the basis of the given login name
  257. */
  258. $loginFailed = true; // Default initialisation. It could
  259. // change after the external authentication
  260. $key = $uData['auth_source'];
  261. /* >>>>>>>>>>>>>>>> External authentication modules <<<<<<<<<<<<<<<< */
  262. // see configuration.php to define these
  263. include_once($extAuthSource[$key]['login']);
  264. /* >>>>>>>>>>>>>>>> External authentication modules <<<<<<<<<<<<<<<<<< */
  265. }
  266. if(!empty($_SESSION['request_uri']))
  267. {
  268. $req = $_SESSION['request_uri'];
  269. unset($_SESSION['request_uri']);
  270. header('location: '.$req);
  271. }
  272. else
  273. {
  274. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login').$param);
  275. }
  276. }
  277. else // login failed, mysql_num_rows($result) <= 0
  278. {
  279. $loginFailed = true; // Default initialisation. It could
  280. // change after the external authentication
  281. /*
  282. * In this section:
  283. * there is no entry for the $login user in the Dokeos
  284. * database. This also means there is no auth_source for the user.
  285. * We let all external procedures attempt to add him/her
  286. * to the system.
  287. *
  288. * Process external login on the basis
  289. * of the authentication source list
  290. * provided by the configuration settings.
  291. * If the login succeeds, for going further,
  292. * Dokeos needs the $_user['user_id'] variable to be
  293. * set and registered in the session. It's the
  294. * responsability of the external login script
  295. * to provide this $_user['user_id'].
  296. */
  297. if (is_array($extAuthSource))
  298. {
  299. foreach($extAuthSource as $thisAuthSource)
  300. {
  301. include_once($thisAuthSource['newUser']);
  302. }
  303. } //end if is_array($extAuthSource)
  304. } //end else login failed
  305. }
  306. // else {} => continue as anonymous user
  307. $uidReset = true;
  308. // $cidReset = true;
  309. // $gidReset = true;
  310. }
  311. //Now check for anonymous user mode
  312. if(isset($use_anonymous) && $use_anonymous == true)
  313. {
  314. //if anonymous mode is set, then try to set the current user as anonymous
  315. //if he doesn't have a login yet
  316. api_set_anonymous();
  317. }
  318. else
  319. {
  320. //if anonymous mode is not set, then check if this user is anonymous. If it
  321. //is, clean it from being anonymous (make him a nobody :-))
  322. api_clear_anonymous();
  323. }
  324. // if the requested course is different from the course in session
  325. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid'])))
  326. {
  327. $cidReset = true;
  328. $gidReset = true; // As groups depend from courses, group id is reset
  329. }
  330. // if the requested group is different from the group in session
  331. if ($gidReq && $gidReq != $_SESSION['_gid'])
  332. {
  333. $gidReset = true;
  334. }
  335. //////////////////////////////////////////////////////////////////////////////
  336. // USER INIT
  337. //////////////////////////////////////////////////////////////////////////////
  338. if (isset($uidReset) && $uidReset) // session data refresh requested
  339. {
  340. $is_platformAdmin = false; $is_allowedCreateCourse = false;
  341. if (isset($_user['user_id']) && $_user['user_id']) // a uid is given (log in succeeded)
  342. {
  343. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  344. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  345. if ($_configuration['tracking_enabled'])
  346. {
  347. $sql = "SELECT `user`.*, `a`.`user_id` `is_admin`,
  348. UNIX_TIMESTAMP(`login`.`login_date`) `login_date`
  349. FROM $user_table
  350. LEFT JOIN $admin_table `a`
  351. ON `user`.`user_id` = `a`.`user_id`
  352. LEFT JOIN `".$_configuration['statistics_database']."`.`track_e_login` `login`
  353. ON `user`.`user_id` = `login`.`login_user_id`
  354. WHERE `user`.`user_id` = '".$_user['user_id']."'
  355. ORDER BY `login`.`login_date` DESC LIMIT 1";
  356. }
  357. else
  358. {
  359. $sql = "SELECT `user`.*, `a`.`user_id` `is_admin`
  360. FROM $user_table
  361. LEFT JOIN $admin_table `a`
  362. ON `user`.`user_id` = `a`.`user_id`
  363. WHERE `user`.`user_id` = '".$_user['user_id']."'";
  364. }
  365. $result = api_sql_query($sql,__FILE__,__LINE__);
  366. if (mysql_num_rows($result) > 0)
  367. {
  368. // Extracting the user data
  369. $uData = mysql_fetch_array($result);
  370. $_user ['firstName'] = $uData ['firstname' ];
  371. $_user ['lastName' ] = $uData ['lastname' ];
  372. $_user ['mail' ] = $uData ['email' ];
  373. $_user ['lastLogin'] = $uData ['login_date'];
  374. $_user ['official_code'] = $uData ['official_code'];
  375. $_user ['picture_uri'] = $uData ['picture_uri'];
  376. $_user ['user_id'] = $uData ['user_id'];
  377. $_user ['language'] = $uData ['language'];
  378. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  379. $is_allowedCreateCourse = (bool) ($uData ['status'] == 1);
  380. api_session_register('_user');
  381. }
  382. else
  383. {
  384. exit("WARNING UNDEFINED UID !! ");
  385. }
  386. }
  387. else // no uid => logout or Anonymous
  388. {
  389. api_session_unregister('_user');
  390. api_session_unregister('_uid');
  391. }
  392. api_session_register('is_platformAdmin');
  393. api_session_register('is_allowedCreateCourse');
  394. }
  395. else // continue with the previous values
  396. {
  397. $_user = $_SESSION['_user'];
  398. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  399. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  400. }
  401. //////////////////////////////////////////////////////////////////////////////
  402. // COURSE INIT
  403. //////////////////////////////////////////////////////////////////////////////
  404. if (isset($cidReset) && $cidReset) // course session data refresh requested or empty data
  405. {
  406. if ($cidReq)
  407. {
  408. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  409. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  410. $sql = "SELECT `course`.*, `course_category`.`code` `faCode`, `course_category`.`name` `faName`
  411. FROM $course_table
  412. LEFT JOIN $course_cat_table
  413. ON `course`.`category_code` = `course_category`.`code`
  414. WHERE `course`.`code` = '$cidReq'";
  415. $result = api_sql_query($sql,__FILE__,__LINE__);
  416. if (mysql_num_rows($result)>0)
  417. {
  418. $cData = mysql_fetch_array($result);
  419. $_cid = $cData['code' ];
  420. $_course = array();
  421. $_course['id' ] = $cData['code' ]; //auto-assigned integer
  422. $_course['name' ] = $cData['title' ];
  423. $_course['official_code'] = $cData['visual_code' ]; // use in echo
  424. $_course['sysCode' ] = $cData['code' ]; // use as key in db
  425. $_course['path' ] = $cData['directory' ]; // use as key in path
  426. $_course['dbName' ] = $cData['db_name' ]; // use as key in db list
  427. $_course['dbNameGlu' ] = $_configuration['table_prefix'] . $cData['db_name'] . $_configuration['db_glue']; // use in all queries
  428. $_course['titular' ] = $cData['tutor_name' ];
  429. $_course['language' ] = $cData['course_language' ];
  430. $_course['extLink' ]['url' ] = $cData['department_url' ];
  431. $_course['extLink' ]['name'] = $cData['department_name'];
  432. $_course['categoryCode'] = $cData['faCode' ];
  433. $_course['categoryName'] = $cData['faName' ];
  434. $_course['visibility' ] = $cData['visibility'];
  435. $_course['subscribe_allowed'] = $cData['subscribe'];
  436. $_course['unubscribe_allowed'] = $cData['unsubscribe'];
  437. api_session_register('_cid');
  438. api_session_register('_course');
  439. //We add a new record in the course tracking table
  440. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  441. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  442. "VALUES('".$_course['official_code']."', '".$_user['user_id']."', NOW(), NOW(), '1')";
  443. api_sql_query($sql,__FILE__,__LINE__);
  444. // if a session id has been given in url, we store the session
  445. if(api_get_setting('use_session_mode')=='true')
  446. {
  447. // Database Table Definitions
  448. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  449. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  450. $tbl_session_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
  451. $tbl_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  452. if(!empty($_GET['id_session']))
  453. {
  454. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  455. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.$_SESSION['id_session'] . '"';
  456. $rs = api_sql_query($sql,__FILE__,__LINE__);
  457. list($_SESSION['session_name']) = mysql_fetch_array($rs);
  458. }
  459. else
  460. {
  461. api_session_unregister('session_name');
  462. api_session_unregister('id_session');
  463. }
  464. }
  465. }
  466. else
  467. {
  468. exit("WARNING UNDEFINED CID !! ");
  469. }
  470. }
  471. else
  472. {
  473. api_session_unregister('_cid');
  474. api_session_unregister('_course');
  475. }
  476. }
  477. else // continue with the previous values
  478. {
  479. if(empty($_SESSION['_course']) OR empty($_SESSION['_cid']))
  480. { //no previous values...
  481. $_cid = -1; //set default values that will be caracteristic of being unset
  482. $_course = -1;
  483. }
  484. else
  485. {
  486. $_cid = $_SESSION['_cid' ];
  487. $_course = $_SESSION['_course'];
  488. if($_configuration['tracking_enabled'])
  489. {
  490. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  491. //We select the last record for the current course in the course tracking table
  492. $sql="SELECT course_access_id FROM $course_tracking_table WHERE user_id=".intval($_user ['user_id'])." ORDER BY login_course_date DESC LIMIT 0,1";
  493. $result=api_sql_query($sql,__FILE__,__LINE__);
  494. if(Database::num_rows($result)>0)
  495. {
  496. $i_course_access_id = mysql_result($result,0,0);
  497. //We update the course tracking table
  498. $sql="UPDATE $course_tracking_table " .
  499. "SET logout_course_date = NOW(), " .
  500. "counter = counter+1 " .
  501. "WHERE course_access_id=".intval($i_course_access_id);
  502. api_sql_query($sql,__FILE__,__LINE__);
  503. }
  504. else
  505. {
  506. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  507. "VALUES('".$_course['official_code']."', '".$_user['user_id']."', NOW(), NOW(), '1')";
  508. api_sql_query($sql,__FILE__,__LINE__);
  509. }
  510. }
  511. }
  512. }
  513. //////////////////////////////////////////////////////////////////////////////
  514. // COURSE / USER REL. INIT
  515. //////////////////////////////////////////////////////////////////////////////
  516. if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) // session data refresh requested
  517. {
  518. if (isset($_user['user_id']) && $_user['user_id'] && isset($_cid) && $_cid) // have keys to search data
  519. {
  520. if(api_get_setting('use_session_mode') != 'true')
  521. {
  522. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  523. $sql = "SELECT * FROM $course_user_table
  524. WHERE `user_id` = '".$_user['user_id']."'
  525. AND `course_code` = '$cidReq'";
  526. $result = api_sql_query($sql,__FILE__,__LINE__);
  527. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  528. {
  529. $cuData = mysql_fetch_array($result);
  530. $is_courseMember = true;
  531. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  532. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  533. api_session_register('_courseUser');
  534. }
  535. else // this user has no status related to this course
  536. {
  537. $is_courseMember = false;
  538. $is_courseAdmin = false;
  539. $is_courseTutor = false;
  540. }
  541. $is_courseAdmin = (bool) ($is_courseAdmin || $is_platformAdmin);
  542. }
  543. else
  544. {
  545. $tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  546. $sql = "SELECT * FROM ".$tbl_course_user."
  547. WHERE `user_id` = '".$_user['user_id']."'
  548. AND `course_code` = '$cidReq'";
  549. $result = api_sql_query($sql,__FILE__,__LINE__);
  550. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  551. {
  552. $cuData = mysql_fetch_array($result);
  553. $_courseUser['role'] = $cuData['role' ];
  554. $is_courseMember = true;
  555. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  556. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  557. api_session_register('_courseUser');
  558. }
  559. else // this user has no status related to this course
  560. {
  561. // is it the session coach ?
  562. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  563. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  564. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  565. $sql = "SELECT 1
  566. FROM ".$tbl_session."
  567. INNER JOIN ".$tbl_session_course."
  568. ON session_rel_course.id_session = session.id
  569. AND session_rel_course.course_code='$_cid'
  570. WHERE session.id_coach = '".$_user['user_id']."'";
  571. $result = api_sql_query($sql,__FILE__,__LINE__);
  572. if($row = mysql_fetch_array($result)){
  573. $_courseUser['role'] = 'Professor';
  574. $is_courseMember = true;
  575. $is_courseTutor = true;
  576. $is_courseAdmin = false;
  577. $is_courseCoach = true;
  578. api_session_register('_courseUser');
  579. }
  580. else
  581. {
  582. // Check if the current user is the course coach
  583. $sql = "SELECT 1
  584. FROM ".$tbl_session_course."
  585. WHERE session_rel_course.course_code='$_cid'
  586. AND session_rel_course.id_coach = '".$_user['user_id']."'";
  587. $result = api_sql_query($sql,__FILE__,__LINE__);
  588. if($row = mysql_fetch_array($result))
  589. {
  590. $_courseUser['role'] = 'Professor';
  591. $is_courseMember = true;
  592. $is_courseTutor = true;
  593. $is_courseCoach = true;
  594. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  595. $sql="SELECT status FROM ".$tbl_user." WHERE user_id = ".$_user['user_id']."";
  596. $result=api_sql_query($sql);
  597. if(mysql_result($result,0,0)==1){
  598. $is_courseAdmin = true;
  599. }
  600. else{
  601. $is_courseAdmin = false;
  602. }
  603. api_session_register('_courseUser');
  604. }
  605. else
  606. {
  607. // Check if the user is a student is this session
  608. $sql = "SELECT * FROM ".$tbl_session_course_user."
  609. WHERE `id_user` = '".$_user['user_id']."'
  610. AND `course_code` = '$cidReq'";
  611. $result = api_sql_query($sql,__FILE__,__LINE__);
  612. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  613. {
  614. while($row = mysql_fetch_array($result)){
  615. $is_courseMember = true;
  616. $is_courseTutor = false;
  617. $is_courseAdmin = false;
  618. api_session_register('_courseUser');
  619. }
  620. }
  621. }
  622. }
  623. }
  624. }
  625. }
  626. else // keys missing => not anymore in the course - user relation
  627. {
  628. //// course
  629. $is_courseMember = false;
  630. $is_courseAdmin = false;
  631. $is_courseTutor = false;
  632. $is_courseCoach = false;
  633. api_session_unregister('_courseUser');
  634. }
  635. //DEPRECATED
  636. //$is_courseAllowed=($_cid && ($_course['visibility'] || $is_courseMember || $is_platformAdmin))?true:false;
  637. //NEW
  638. if (isset($_course))
  639. {
  640. if ($_course['visibility'] == COURSE_VISIBILITY_OPEN_WORLD)
  641. $is_allowed_in_course = true;
  642. elseif ($_course['visibility'] == COURSE_VISIBILITY_OPEN_PLATFORM && isset($_user['user_id']) )
  643. $is_allowed_in_course = true;
  644. elseif ($_course['visibility'] == COURSE_VISIBILITY_REGISTERED && ($is_platformAdmin || $is_courseMember))
  645. $is_allowed_in_course = true;
  646. elseif ($_course['visibility'] == COURSE_VISIBILITY_CLOSED && ($is_platformAdmin || $is_courseAdmin))
  647. $is_allowed_in_course = true;
  648. else $is_allowed_in_course = false;
  649. }
  650. // save the states
  651. api_session_register('is_courseMember');
  652. api_session_register('is_courseAdmin');
  653. //api_session_register('is_courseAllowed'); //deprecated old permission var
  654. api_session_register('is_courseTutor');
  655. api_session_register('is_allowed_in_course'); //new permission var
  656. api_session_register('is_courseCoach');
  657. }
  658. else // continue with the previous values
  659. {
  660. $_courseUser = $_SESSION ['_courseUser' ];
  661. $is_courseMember = $_SESSION ['is_courseMember' ];
  662. $is_courseAdmin = $_SESSION ['is_courseAdmin' ];
  663. //$is_courseAllowed = $_SESSION ['is_courseAllowed']; //deprecated
  664. $is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
  665. $is_courseTutor = $_SESSION ['is_courseTutor' ];
  666. $is_courseCoach = $_SESSION ['is_courseCoach' ];
  667. }
  668. //////////////////////////////////////////////////////////////////////////////
  669. // GROUP INIT
  670. //////////////////////////////////////////////////////////////////////////////
  671. if ((isset($gidReset) && $gidReset) || (isset($cidReset) && $cidReset)) // session data refresh requested
  672. {
  673. if ($gidReq && $_cid ) // have keys to search data
  674. {
  675. $group_table = Database::get_course_table(TABLE_GROUP);
  676. $sql = "SELECT * FROM $group_table WHERE `id` = '$gidReq'";
  677. $result = api_sql_query($sql,__FILE__,__LINE__);
  678. if (mysql_num_rows($result) > 0) // This group has recorded status related to this course
  679. {
  680. $gpData = mysql_fetch_array($result);
  681. $_gid = $gpData ['id' ];
  682. api_session_register('_gid');
  683. }
  684. else
  685. {
  686. exit("WARNING UNDEFINED GID !! ");
  687. }
  688. }
  689. elseif(isset($_SESSION['_gid']) or isset($_gid)) // Keys missing => not anymore in the group - course relation
  690. {
  691. api_session_unregister('_gid');
  692. }
  693. }
  694. elseif(isset($_SESSION['_gid'])) // continue with the previous values
  695. {
  696. $_gid = $_SESSION ['_gid' ];
  697. }
  698. else
  699. { //if no previous value, assign caracteristic undefined value
  700. $_gid = -1;
  701. }
  702. if(isset($_cid))
  703. {
  704. $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
  705. $sql="UPDATE $tbl_course SET last_visit=NOW() WHERE code='$_cid'";
  706. api_sql_query($sql,__FILE__,__LINE__);
  707. }
  708. ?>