local.inc.php 38 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2009 Dokeos SPRL
  6. Copyright (c) 2003-2005 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Hugues Peeters
  9. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  10. Copyright (c) Patrick Cool
  11. Copyright (c) Julio Montoya Armas
  12. For a full list of contributors, see "credits.txt".
  13. The full license can be read in "license.txt".
  14. This program is free software; you can redistribute it and/or
  15. modify it under the terms of the GNU General Public License
  16. as published by the Free Software Foundation; either version 2
  17. of the License, or (at your option) any later version.
  18. See the GNU General Public License for more details.
  19. Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
  20. Mail: info@dokeos.com
  21. ==============================================================================
  22. */
  23. /**
  24. ==============================================================================
  25. *
  26. * SCRIPT PURPOSE
  27. *
  28. * This script initializes and manages Dokeos session information. It
  29. * keeps available session information up to date.
  30. *
  31. * You can request a course id. It will check if the course Id requested is the
  32. * same as the current one. If it isn't it will update session information from
  33. * the database. You can also force the course reset if you want ($cidReset).
  34. *
  35. * All the course information is stored in the $_course array.
  36. *
  37. * You can request a group id. The script will check if the group id requested is the
  38. * same as the current one. If it isn't it will update session information from
  39. * the database. You can also force the course reset if you want ($gidReset).
  40. *
  41. The course id is stored in $_cid session variable.
  42. * The group id is stored in $_gid session variable.
  43. *
  44. *
  45. * VARIABLES AFFECTING THE SCRIPT BEHAVIOR
  46. *
  47. * string $login
  48. * string $password
  49. * boolean $logout
  50. *
  51. * string $cidReq : course id requested
  52. * boolean $cidReset : ask for a course Reset, if no $cidReq is provided in the
  53. * same time, all course informations is removed from the
  54. * current session
  55. *
  56. * int $gidReq : group Id requested
  57. * boolean $gidReset : ask for a group Reset, if no $gidReq is provided in the
  58. * same time, all group informations is removed from the
  59. * current session
  60. *
  61. *
  62. * VARIABLES SET AND RETURNED BY THE SCRIPT
  63. *
  64. * All the variables below are set and returned by this script.
  65. *
  66. * USER VARIABLES
  67. *
  68. * string $_user ['firstName' ]
  69. * string $_user ['lastName' ]
  70. * string $_user ['mail' ]
  71. * string $_user ['lastLogin' ]
  72. * string $_user ['official_code']
  73. * string $_user ['picture_uri' ]
  74. * string $_user['user_id']
  75. *
  76. * boolean $is_platformAdmin
  77. * boolean $is_allowedCreateCourse
  78. *
  79. * COURSE VARIABLES
  80. *
  81. * string $_cid (the course id)
  82. *
  83. * int $_course['id' ] - auto-assigned integer
  84. * string $_course['name' ] - the title of the course
  85. * string $_course['official_code'] - the visual / fake / official code
  86. * string $_course['sysCode' ]
  87. * string $_course['path' ]
  88. * string $_course['dbName' ]
  89. * string $_course['dbNameGlu' ]
  90. * string $_course['titular' ]
  91. * string $_course['language' ]
  92. * string $_course['extLink' ]['url' ]
  93. * string $_course['extLink' ]['name']
  94. * string $_course['categoryCode']
  95. * string $_course['categoryName']
  96. * boolean $is_courseMember
  97. * boolean $is_courseTutor
  98. * boolean $is_courseAdmin
  99. *
  100. *
  101. * GROUP VARIABLES
  102. *
  103. * int $_gid (the group id)
  104. *
  105. *
  106. * IMPORTANT ADVICE FOR DEVELOPERS
  107. *
  108. * We strongly encourage developers to use a connection layer at the top of
  109. * their scripts rather than use these variables, as they are, inside the core
  110. * of their scripts. It will make code maintenance much easier.
  111. *
  112. * Many if the functions you need you can already find in the
  113. * main_api.lib.php
  114. *
  115. * We encourage you to use functions to access these global "kernel" variables.
  116. * You can add them to e.g. the main API library.
  117. *
  118. *
  119. * SCRIPT STRUCTURE
  120. *
  121. * 1. The script determines if there is an authentication attempt. This part
  122. * only chek if the login name and password are valid. Afterwards, it set the
  123. * $_user['user_id'] (user id) and the $uidReset flag. Other user informations are retrieved
  124. * later. It's also in this section that optional external authentication
  125. * devices step in.
  126. *
  127. * 2. The script determines what other session informations have to be set or
  128. * reset, setting correctly $cidReset (for course) and $gidReset (for group).
  129. *
  130. * 3. If needed, the script retrieves the other user informations (first name,
  131. * last name, ...) and stores them in session.
  132. *
  133. * 4. If needed, the script retrieves the course information and stores them
  134. * in session
  135. *
  136. * 5. The script initializes the user permission status and permission for the
  137. * course level
  138. *
  139. * 6. If needed, the script retrieves group informations an store them in
  140. * session.
  141. *
  142. * 7. The script initializes the user status and permission for the group level.
  143. *
  144. * @package dokeos.include
  145. ==============================================================================
  146. */
  147. /*
  148. ==============================================================================
  149. INIT SECTION
  150. variables should be initialised here
  151. ==============================================================================
  152. */
  153. // parameters passed via GET
  154. $logout = isset($_GET["logout"]) ? $_GET["logout"] : '';
  155. $gidReq = isset($_GET["gidReq"]) ? Database::escape_string($_GET["gidReq"]) : '';
  156. //this fixes some problems with generic functionalities like
  157. //My Agenda & What's New icons linking to courses
  158. // $cidReq can be set in the index.php file of a course-area
  159. $cidReq = isset($cidReq) ? Database::escape_string($cidReq) : '';
  160. // $cidReq can be set in URL-parameter
  161. $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $cidReq;
  162. $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
  163. // $cidReset can be set in URL-parameter
  164. $cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq']!=$_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
  165. // $cDir is a special url param sent by courses/.htaccess
  166. $cDir = (!empty($_GET['cDir']) ? $_GET['cDir'] : null);
  167. $gidReset = isset($gidReset) ? $gidReset : '';
  168. // $gidReset can be set in URL-parameter
  169. // parameters passed via POST
  170. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  171. // passed through other means
  172. //$cidReq -- passed from course folder index.php
  173. /*
  174. ==============================================================================
  175. MAIN CODE
  176. ==============================================================================
  177. */
  178. if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout)) {
  179. // uid is in session => login already done, continue with this value
  180. $_user['user_id'] = $_SESSION['_user']['user_id'];
  181. } else {
  182. if (isset($_user['user_id'])) {
  183. unset($_user['user_id']);
  184. }
  185. if (isset($_POST['login']) && isset($_POST['password'])) {
  186. // $login && $password are given to log in
  187. $login = $_POST['login'];
  188. $password = $_POST['password'];
  189. //lookup the user in the main database
  190. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  191. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  192. FROM $user_table
  193. WHERE username = '".trim(addslashes($login))."'";
  194. $result = api_sql_query($sql,__FILE__,__LINE__);
  195. if (Database::num_rows($result) > 0) {
  196. $uData = Database::fetch_array($result);
  197. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  198. //the authentification of this user is managed by Dokeos itself
  199. $password = trim(stripslashes($password));
  200. // determine if the password needs to be encrypted before checking
  201. // $userPasswordCrypted is set in an external configuration file
  202. if ($userPasswordCrypted) {
  203. $password = md5($password);
  204. }
  205. // check the user's password
  206. if ($password == $uData['password'] AND (trim($login) == $uData['username'])) {
  207. // check if the account is active (not locked)
  208. if ($uData['active']=='1') {
  209. // check if the expiration date has not been reached
  210. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  211. global $_configuration;
  212. if ($_configuration['multiple_access_urls']==true) {
  213. //check the access_url configuration setting if the user is registered in the access_url_rel_user table
  214. //getting the current access_url_id of the platform
  215. $current_access_url_id = api_get_current_access_url_id();
  216. // my user is subscribed in these sites => $my_url_list
  217. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  218. if (is_array($my_url_list) && count($my_url_list)>0 ){
  219. // the user have the permissions to enter at this site
  220. if (in_array($current_access_url_id, $my_url_list)) {
  221. $_user['user_id'] = $uData['user_id'];
  222. api_session_register('_user');
  223. if (!function_exists('event_login')){
  224. include(api_get_path(LIBRARY_PATH)."events.lib.inc.php");
  225. event_login();
  226. }
  227. } else {
  228. $loginFailed = true;
  229. api_session_unregister('_uid');
  230. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  231. exit;
  232. }
  233. } else {
  234. $loginFailed = true;
  235. api_session_unregister('_uid');
  236. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  237. exit;
  238. }
  239. } else {
  240. $_user['user_id'] = $uData['user_id'];
  241. api_session_register('_user');
  242. if (!function_exists('event_login')){
  243. include(api_get_path(LIBRARY_PATH)."events.lib.inc.php");
  244. event_login();
  245. }
  246. }
  247. } else {
  248. $loginFailed = true;
  249. api_session_unregister('_uid');
  250. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  251. exit;
  252. }
  253. } else {
  254. $loginFailed = true;
  255. api_session_unregister('_uid');
  256. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  257. exit;
  258. }
  259. } else {
  260. // login failed: username or password incorrect
  261. $loginFailed = true;
  262. api_session_unregister('_uid');
  263. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
  264. exit;
  265. }
  266. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id']) {
  267. //first login for a not self registred
  268. //e.g. registered by a teacher
  269. //do nothing (code may be added later)
  270. }
  271. } elseif (!empty($extAuthSource[$uData['auth_source']]['login']) && file_exists($extAuthSource[$uData['auth_source']]['login'])) {
  272. /*
  273. * Process external authentication
  274. * on the basis of the given login name
  275. */
  276. $loginFailed = true; // Default initialisation. It could
  277. // change after the external authentication
  278. $key = $uData['auth_source']; //'ldap','shibboleth'...
  279. /* >>>>>>>> External authentication modules <<<<<<<<< */
  280. // see configuration.php to define these
  281. include_once($extAuthSource[$key]['login']);
  282. /* >>>>>>>> External authentication modules <<<<<<<<< */
  283. } else // no standard Dokeos login - try external authentification
  284. {
  285. //huh... nothing to do... we shouldn't get here
  286. error_log('Dokeos Authentication file '. $extAuthSource[$uData['auth_source']]['login']. ' could not be found - this might prevent your system from doing the corresponding authentication process',0);
  287. }
  288. if (!empty($_SESSION['request_uri'])) {
  289. $req = $_SESSION['request_uri'];
  290. unset($_SESSION['request_uri']);
  291. header('location: '.$req);
  292. } else {
  293. if (isset($param)) {
  294. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login').$param);
  295. } else {
  296. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login'));
  297. }
  298. }
  299. } else {
  300. // login failed, mysql_num_rows($result) <= 0
  301. $loginFailed = true; // Default initialisation. It could
  302. // change after the external authentication
  303. /*
  304. * In this section:
  305. * there is no entry for the $login user in the Dokeos
  306. * database. This also means there is no auth_source for the user.
  307. * We let all external procedures attempt to add him/her
  308. * to the system.
  309. *
  310. * Process external login on the basis
  311. * of the authentication source list
  312. * provided by the configuration settings.
  313. * If the login succeeds, for going further,
  314. * Dokeos needs the $_user['user_id'] variable to be
  315. * set and registered in the session. It's the
  316. * responsability of the external login script
  317. * to provide this $_user['user_id'].
  318. */
  319. if (isset($extAuthSource) && is_array($extAuthSource)) {
  320. foreach($extAuthSource as $thisAuthSource) {
  321. if (!empty($thisAuthSource['newUser']) && file_exists($thisAuthSource['newUser'])) {
  322. include_once($thisAuthSource['newUser']);
  323. } else {
  324. error_log('Dokeos Authentication file '. $thisAuthSource['newUser']. ' could not be found - this might prevent your system from using the authentication process in the user creation process',0);
  325. }
  326. }
  327. } //end if is_array($extAuthSource)
  328. } //end else login failed
  329. } elseif (api_get_setting('openid_authentication')=='true') {
  330. if (!empty($_POST['openid_url'])) {
  331. include('main/auth/openid/login.php');
  332. openid_begin(trim($_POST['openid_url']),api_get_path(WEB_PATH).'index.php');
  333. //this last function should trigger a redirect, so we can die here safely
  334. die('Openid login redirection should be in progress');
  335. } elseif (!empty($_GET['openid_identity']))
  336. { //it's usual for PHP to replace '.' (dot) by '_' (underscore) in URL parameters
  337. include('main/auth/openid/login.php');
  338. $res = openid_complete($_GET);
  339. if ($res['status'] == 'success') {
  340. $id1 = Database::escape_string($res['openid.identity']);
  341. //have another id with or without the final '/'
  342. $id2 = (substr($id1,-1,1)=='/'?substr($id1,0,-1):$id1.'/');
  343. //lookup the user in the main database
  344. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  345. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  346. FROM $user_table
  347. WHERE openid = '$id1'
  348. OR openid = '$id2' ";
  349. $result = api_sql_query($sql);
  350. if ($result !== false) {
  351. if (Database::num_rows($result)>0) {
  352. //$row = Database::fetch_array($res);
  353. $uData = Database::fetch_array($result);
  354. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  355. //the authentification of this user is managed by Dokeos itself
  356. // check if the account is active (not locked)
  357. if ($uData['active']=='1') {
  358. // check if the expiration date has not been reached
  359. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  360. $_user['user_id'] = $uData['user_id'];
  361. api_session_register('_user');
  362. if (!function_exists('event_login')){
  363. include(api_get_path(LIBRARY_PATH)."events.lib.inc.php");
  364. event_login();
  365. }
  366. } else {
  367. $loginFailed = true;
  368. api_session_unregister('_uid');
  369. header('Location: index.php?loginFailed=1&error=account_expired');
  370. exit;
  371. }
  372. } else {
  373. $loginFailed = true;
  374. api_session_unregister('_uid');
  375. header('Location: index.php?loginFailed=1&error=account_inactive');
  376. exit;
  377. }
  378. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id'])
  379. {
  380. //first login for a not self registred
  381. //e.g. registered by a teacher
  382. //do nothing (code may be added later)
  383. }
  384. }
  385. } else {
  386. //Redirect to the subscription form
  387. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php?username='.$res['openid.sreg.nickname'].'&email='.$res['openid.sreg.email'].'&openid='.$res['openid.identity'].'&openid_msg=idnotfound');
  388. //$loginFailed = true;
  389. }
  390. } else {
  391. $loginFailed = true;
  392. }
  393. } else {
  394. $loginFailed = true;
  395. }
  396. }
  397. }
  398. // else {} => continue as anonymous user
  399. $uidReset = true;
  400. // $cidReset = true;
  401. // $gidReset = true;
  402. }
  403. //Now check for anonymous user mode
  404. if (isset($use_anonymous) && $use_anonymous == true) {
  405. //if anonymous mode is set, then try to set the current user as anonymous
  406. //if he doesn't have a login yet
  407. api_set_anonymous();
  408. } else {
  409. //if anonymous mode is not set, then check if this user is anonymous. If it
  410. //is, clean it from being anonymous (make him a nobody :-))
  411. api_clear_anonymous();
  412. }
  413. // if there is a cDir parameter in the URL (coming from courses/.htaccess redirection)
  414. if (!empty($cDir)) {
  415. require_once api_get_path(LIBRARY_PATH).'course.lib.php';
  416. $c = CourseManager::get_course_id_from_path($cDir);
  417. if ($c != false) { $cidReq = $c; }
  418. }
  419. // if the requested course is different from the course in session
  420. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid']))) {
  421. $cidReset = true;
  422. $gidReset = true; // As groups depend from courses, group id is reset
  423. }
  424. // if the requested group is different from the group in session
  425. $gid = isset($_SESSION['_gid'])?$_SESSION['_gid']:'';
  426. if ($gidReq && $gidReq != $gid) {
  427. $gidReset = true;
  428. }
  429. //////////////////////////////////////////////////////////////////////////////
  430. // USER INIT
  431. //////////////////////////////////////////////////////////////////////////////
  432. if (isset($uidReset) && $uidReset) // session data refresh requested
  433. {
  434. $is_platformAdmin = false; $is_allowedCreateCourse = false;
  435. if (isset($_user['user_id']) && $_user['user_id']) // a uid is given (log in succeeded)
  436. {
  437. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  438. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  439. if ($_configuration['tracking_enabled']) {
  440. $sql = "SELECT user.*, a.user_id is_admin,
  441. UNIX_TIMESTAMP(login.login_date) login_date
  442. FROM $user_table
  443. LEFT JOIN $admin_table a
  444. ON user.user_id = a.user_id
  445. LEFT JOIN ".$_configuration['statistics_database'].".track_e_login login
  446. ON user.user_id = login.login_user_id
  447. WHERE user.user_id = '".$_user['user_id']."'
  448. ORDER BY login.login_date DESC LIMIT 1";
  449. } else {
  450. $sql = "SELECT user.*, a.user_id is_admin
  451. FROM $user_table
  452. LEFT JOIN $admin_table a
  453. ON user.user_id = a.user_id
  454. WHERE user.user_id = '".$_user['user_id']."'";
  455. }
  456. $result = api_sql_query($sql,__FILE__,__LINE__);
  457. if (Database::num_rows($result) > 0) {
  458. // Extracting the user data
  459. $uData = Database::fetch_array($result);
  460. $_user ['firstName'] = $uData ['firstname' ];
  461. $_user ['lastName' ] = $uData ['lastname' ];
  462. $_user ['mail' ] = $uData ['email' ];
  463. $_user ['lastLogin'] = $uData ['login_date'];
  464. $_user ['official_code'] = $uData ['official_code'];
  465. $_user ['picture_uri'] = $uData ['picture_uri'];
  466. $_user ['user_id'] = $uData ['user_id'];
  467. $_user ['language'] = $uData ['language'];
  468. $_user ['auth_source'] = $uData ['auth_source'];
  469. $_user ['theme'] = $uData ['theme'];
  470. $_user ['status'] = $uData ['status'];
  471. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  472. $is_allowedCreateCourse = (bool) ($uData ['status'] == 1);
  473. api_session_register('_user');
  474. } else {
  475. header('location:'.api_get_path(WEB_PATH));
  476. //exit("WARNING UNDEFINED UID !! ");
  477. }
  478. } else { // no uid => logout or Anonymous
  479. api_session_unregister('_user');
  480. api_session_unregister('_uid');
  481. }
  482. api_session_register('is_platformAdmin');
  483. api_session_register('is_allowedCreateCourse');
  484. } else { // continue with the previous values
  485. $_user = $_SESSION['_user'];
  486. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  487. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  488. }
  489. //////////////////////////////////////////////////////////////////////////////
  490. // COURSE INIT
  491. //////////////////////////////////////////////////////////////////////////////
  492. if (isset($cidReset) && $cidReset) { // course session data refresh requested or empty data
  493. if ($cidReq) {
  494. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  495. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  496. $sql = "SELECT course.*, course_category.code faCode, course_category.name faName
  497. FROM $course_table
  498. LEFT JOIN $course_cat_table
  499. ON course.category_code = course_category.code
  500. WHERE course.code = '$cidReq'";
  501. $result = api_sql_query($sql,__FILE__,__LINE__);
  502. if (Database::num_rows($result)>0) {
  503. $cData = Database::fetch_array($result);
  504. $_cid = $cData['code' ];
  505. $_course = array();
  506. $_course['id' ] = $cData['code' ]; //auto-assigned integer
  507. $_course['name' ] = $cData['title' ];
  508. $_course['official_code'] = $cData['visual_code' ]; // use in echo
  509. $_course['sysCode' ] = $cData['code' ]; // use as key in db
  510. $_course['path' ] = $cData['directory' ]; // use as key in path
  511. $_course['dbName' ] = $cData['db_name' ]; // use as key in db list
  512. $_course['dbNameGlu' ] = $_configuration['table_prefix'] . $cData['db_name'] . $_configuration['db_glue']; // use in all queries
  513. $_course['titular' ] = $cData['tutor_name' ];
  514. $_course['language' ] = $cData['course_language' ];
  515. $_course['extLink' ]['url' ] = $cData['department_url' ];
  516. $_course['extLink' ]['name'] = $cData['department_name'];
  517. $_course['categoryCode'] = $cData['faCode' ];
  518. $_course['categoryName'] = $cData['faName' ];
  519. $_course['visibility' ] = $cData['visibility'];
  520. $_course['subscribe_allowed'] = $cData['subscribe'];
  521. $_course['unubscribe_allowed'] = $cData['unsubscribe'];
  522. api_session_register('_cid');
  523. api_session_register('_course');
  524. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  525. //We add a new record in the course tracking table
  526. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  527. $time = api_get_datetime();
  528. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  529. "VALUES('".$_course['official_code']."', '".$_user['user_id']."', '$time', '$time', '1')";
  530. api_sql_query($sql,__FILE__,__LINE__);
  531. }
  532. // if a session id has been given in url, we store the session
  533. if (api_get_setting('use_session_mode')=='true') {
  534. // Database Table Definitions
  535. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  536. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  537. $tbl_session_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
  538. $tbl_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  539. if (!empty($_GET['id_session'])) {
  540. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  541. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.$_SESSION['id_session'] . '"';
  542. $rs = api_sql_query($sql,__FILE__,__LINE__);
  543. list($_SESSION['session_name']) = Database::fetch_array($rs);
  544. } else {
  545. api_session_unregister('session_name');
  546. api_session_unregister('id_session');
  547. }
  548. }
  549. } else {
  550. //exit("WARNING UNDEFINED CID !! ");
  551. header('location:'.api_get_path(WEB_PATH));
  552. }
  553. } else {
  554. api_session_unregister('_cid');
  555. api_session_unregister('_course');
  556. }
  557. } else { // continue with the previous values
  558. if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
  559. $_cid = -1; //set default values that will be caracteristic of being unset
  560. $_course = -1;
  561. } else {
  562. $_cid = $_SESSION['_cid' ];
  563. $_course = $_SESSION['_course'];
  564. // these lines are usefull for tracking. Indeed we can have lost the id_session and not the cid.
  565. // Moreover, if we want to track a course with another session it can be usefull
  566. if (!empty($_GET['id_session'])) {
  567. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  568. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  569. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.$_SESSION['id_session'] . '"';
  570. $rs = api_sql_query($sql,__FILE__,__LINE__);
  571. list($_SESSION['session_name']) = Database::fetch_array($rs);
  572. }
  573. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  574. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  575. $time = api_get_datetime();
  576. //We select the last record for the current course in the course tracking table
  577. $sql="SELECT course_access_id FROM $course_tracking_table WHERE user_id=".intval($_user ['user_id'])." ORDER BY login_course_date DESC LIMIT 0,1";
  578. $result=api_sql_query($sql,__FILE__,__LINE__);
  579. if (Database::num_rows($result)>0) {
  580. $i_course_access_id = Database::result($result,0,0);
  581. //We update the course tracking table
  582. $sql="UPDATE $course_tracking_table " .
  583. "SET logout_course_date = '$time', " .
  584. "counter = counter+1 " .
  585. "WHERE course_access_id=".intval($i_course_access_id);
  586. api_sql_query($sql,__FILE__,__LINE__);
  587. } else {
  588. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  589. "VALUES('".$_course['official_code']."', '".$_user['user_id']."', '$time', '$time', '1')";
  590. api_sql_query($sql,__FILE__,__LINE__);
  591. }
  592. }
  593. }
  594. }
  595. //////////////////////////////////////////////////////////////////////////////
  596. // COURSE / USER REL. INIT
  597. //////////////////////////////////////////////////////////////////////////////
  598. if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  599. if (isset($_user['user_id']) && $_user['user_id'] && isset($_cid) && $_cid) { // have keys to search data
  600. if (api_get_setting('use_session_mode') != 'true') {
  601. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  602. $sql = "SELECT * FROM $course_user_table
  603. WHERE user_id = '".$_user['user_id']."'
  604. AND course_code = '$cidReq'";
  605. $result = api_sql_query($sql,__FILE__,__LINE__);
  606. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  607. $cuData = Database::fetch_array($result);
  608. $is_courseMember = true;
  609. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  610. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  611. api_session_register('_courseUser');
  612. } else { // this user has no status related to this course
  613. $is_courseMember = false;
  614. $is_courseAdmin = false;
  615. $is_courseTutor = false;
  616. }
  617. $is_courseAdmin = (bool) ($is_courseAdmin || $is_platformAdmin);
  618. } else {
  619. $tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  620. $sql = "SELECT * FROM ".$tbl_course_user."
  621. WHERE user_id = '".$_user['user_id']."'
  622. AND course_code = '$cidReq'";
  623. $result = api_sql_query($sql,__FILE__,__LINE__);
  624. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  625. $cuData = Database::fetch_array($result);
  626. $_courseUser['role'] = $cuData['role' ];
  627. $is_courseMember = true;
  628. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  629. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  630. api_session_register('_courseUser');
  631. }
  632. if (empty($is_courseAdmin)) { // this user has no status related to this course
  633. // is it the session coach or the session admin ?
  634. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  635. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  636. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  637. $sql = "SELECT session.id_coach, session_admin_id
  638. FROM ".$tbl_session." as session
  639. INNER JOIN ".$tbl_session_course."
  640. ON session_rel_course.id_session = session.id
  641. AND session_rel_course.course_code='$_cid'";
  642. $result = api_sql_query($sql,__FILE__,__LINE__);
  643. $row = api_store_result($result);
  644. if ($row[0]['id_coach']==$_user['user_id']) {
  645. $_courseUser['role'] = 'Professor';
  646. $is_courseMember = true;
  647. $is_courseTutor = true;
  648. $is_courseCoach = true;
  649. $is_sessionAdmin = false;
  650. if (api_get_setting('extend_rights_for_coach')=='true') {
  651. $is_courseAdmin = true;
  652. } else {
  653. $is_courseAdmin = false;
  654. }
  655. api_session_register('_courseUser');
  656. } elseif ($row[0]['session_admin_id']==$_user['user_id']) {
  657. $_courseUser['role'] = 'Professor';
  658. $is_courseMember = false;
  659. $is_courseTutor = false;
  660. $is_courseAdmin = false;
  661. $is_courseCoach = false;
  662. $is_sessionAdmin = true;
  663. } else {
  664. // Check if the current user is the course coach
  665. $sql = "SELECT 1
  666. FROM ".$tbl_session_course."
  667. WHERE session_rel_course.course_code='$_cid'
  668. AND session_rel_course.id_coach = '".$_user['user_id']."'";
  669. $result = api_sql_query($sql,__FILE__,__LINE__);
  670. if ($row = Database::fetch_array($result)) {
  671. $_courseUser['role'] = 'Professor';
  672. $is_courseMember = true;
  673. $is_courseTutor = true;
  674. $is_courseCoach = true;
  675. $is_sessionAdmin = false;
  676. if (api_get_setting('extend_rights_for_coach')=='true') {
  677. $is_courseAdmin = true;
  678. } else {
  679. $is_courseAdmin = false;
  680. }
  681. api_session_register('_courseUser');
  682. } else {
  683. // Check if the user is a student is this session
  684. $sql = "SELECT * FROM ".$tbl_session_course_user."
  685. WHERE id_user = '".$_user['user_id']."'
  686. AND course_code = '$cidReq'";
  687. $result = api_sql_query($sql,__FILE__,__LINE__);
  688. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  689. while($row = Database::fetch_array($result)){
  690. $is_courseMember = true;
  691. $is_courseTutor = false;
  692. $is_courseAdmin = false;
  693. $is_sessionAdmin = false;
  694. api_session_register('_courseUser');
  695. }
  696. }
  697. }
  698. }
  699. }
  700. }
  701. } else { // keys missing => not anymore in the course - user relation
  702. //// course
  703. $is_courseMember = false;
  704. $is_courseAdmin = false;
  705. $is_courseTutor = false;
  706. $is_courseCoach = false;
  707. $is_sessionAdmin = false;
  708. api_session_unregister('_courseUser');
  709. }
  710. //DEPRECATED
  711. //$is_courseAllowed=($_cid && ($_course['visibility'] || $is_courseMember || $is_platformAdmin))?true:false;
  712. //NEW
  713. if (isset($_course)) {
  714. if ($_course['visibility'] == COURSE_VISIBILITY_OPEN_WORLD)
  715. $is_allowed_in_course = true;
  716. elseif ($_course['visibility'] == COURSE_VISIBILITY_OPEN_PLATFORM && isset($_user['user_id']) && !api_is_anonymous($_user['user_id']))
  717. $is_allowed_in_course = true;
  718. elseif ($_course['visibility'] == COURSE_VISIBILITY_REGISTERED && ($is_platformAdmin || $is_courseMember))
  719. $is_allowed_in_course = true;
  720. elseif ($_course['visibility'] == COURSE_VISIBILITY_CLOSED && ($is_platformAdmin || $is_courseAdmin))
  721. $is_allowed_in_course = true;
  722. else $is_allowed_in_course = false;
  723. }
  724. // save the states
  725. api_session_register('is_courseMember');
  726. api_session_register('is_courseAdmin');
  727. //api_session_register('is_courseAllowed'); //deprecated old permission var
  728. api_session_register('is_courseTutor');
  729. api_session_register('is_allowed_in_course'); //new permission var
  730. api_session_register('is_courseCoach');
  731. api_session_register('is_sessionAdmin');
  732. } else { // continue with the previous values
  733. if (isset($_SESSION ['_courseUser'])) {
  734. $_courseUser = $_SESSION ['_courseUser'];
  735. }
  736. $is_courseMember = $_SESSION ['is_courseMember' ];
  737. $is_courseAdmin = $_SESSION ['is_courseAdmin' ];
  738. //$is_courseAllowed = $_SESSION ['is_courseAllowed']; //deprecated
  739. $is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
  740. $is_courseTutor = $_SESSION ['is_courseTutor' ];
  741. $is_courseCoach = $_SESSION ['is_courseCoach' ];
  742. }
  743. //////////////////////////////////////////////////////////////////////////////
  744. // GROUP INIT
  745. //////////////////////////////////////////////////////////////////////////////
  746. if ((isset($gidReset) && $gidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  747. if ($gidReq && $_cid ) { // have keys to search data
  748. $group_table = Database::get_course_table(TABLE_GROUP);
  749. $sql = "SELECT * FROM $group_table WHERE id = '$gidReq'";
  750. $result = api_sql_query($sql,__FILE__,__LINE__);
  751. if (Database::num_rows($result) > 0) { // This group has recorded status related to this course
  752. $gpData = Database::fetch_array($result);
  753. $_gid = $gpData ['id' ];
  754. api_session_register('_gid');
  755. } else {
  756. exit("WARNING UNDEFINED GID !! ");
  757. }
  758. } elseif (isset($_SESSION['_gid']) or isset($_gid)) { // Keys missing => not anymore in the group - course relation
  759. api_session_unregister('_gid');
  760. }
  761. } elseif (isset($_SESSION['_gid'])) { // continue with the previous values
  762. $_gid = $_SESSION ['_gid' ];
  763. } else { //if no previous value, assign caracteristic undefined value
  764. $_gid = -1;
  765. }
  766. //set variable according to student_view_enabled choices
  767. if (api_get_setting('student_view_enabled') == "true") {
  768. if (isset($_GET['isStudentView'])) {
  769. if ($_GET['isStudentView'] == 'true') {
  770. if (isset($_SESSION['studentview'])) {
  771. if (!empty($_SESSION['studentview'])) {
  772. // switching to studentview
  773. $_SESSION['studentview'] = 'studentview';
  774. }
  775. }
  776. } elseif ($_GET['isStudentView'] == 'false') {
  777. if (isset($_SESSION['studentview'])) {
  778. if (!empty($_SESSION['studentview'])) {
  779. // switching to teacherview
  780. $_SESSION['studentview'] = 'teacherview';
  781. }
  782. }
  783. }
  784. } elseif (!empty($_SESSION['studentview'])) {
  785. //all is fine, no change to that, obviously
  786. } elseif (empty($_SESSION['studentview'])) {
  787. // We are in teacherview here
  788. $_SESSION['studentview'] = 'teacherview';
  789. }
  790. }
  791. if (isset($_cid)) {
  792. $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
  793. $time = api_get_datetime();
  794. $sql="UPDATE $tbl_course SET last_visit= '$time' WHERE code='$_cid'";
  795. api_sql_query($sql,__FILE__,__LINE__);
  796. }