local.inc.php 50 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2009 Dokeos SPRL
  6. Copyright (c) 2003-2005 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Hugues Peeters
  9. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  10. Copyright (c) Patrick Cool
  11. Copyright (c) Julio Montoya Armas
  12. For a full list of contributors, see "credits.txt".
  13. The full license can be read in "license.txt".
  14. This program is free software; you can redistribute it and/or
  15. modify it under the terms of the GNU General Public License
  16. as published by the Free Software Foundation; either version 2
  17. of the License, or (at your option) any later version.
  18. See the GNU General Public License for more details.
  19. Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
  20. Mail: info@dokeos.com
  21. ==============================================================================
  22. */
  23. /**
  24. ==============================================================================
  25. *
  26. * SCRIPT PURPOSE
  27. *
  28. * This script initializes and manages Dokeos session information. It
  29. * keeps available session information up to date.
  30. *
  31. * You can request a course id. It will check if the course Id requested is the
  32. * same as the current one. If it isn't it will update session information from
  33. * the database. You can also force the course reset if you want ($cidReset).
  34. *
  35. * All the course information is stored in the $_course array.
  36. *
  37. * You can request a group id. The script will check if the group id requested is the
  38. * same as the current one. If it isn't it will update session information from
  39. * the database. You can also force the course reset if you want ($gidReset).
  40. *
  41. The course id is stored in $_cid session variable.
  42. * The group id is stored in $_gid session variable.
  43. *
  44. *
  45. * VARIABLES AFFECTING THE SCRIPT BEHAVIOR
  46. *
  47. * string $login
  48. * string $password
  49. * boolean $logout
  50. *
  51. * string $cidReq : course id requested
  52. * boolean $cidReset : ask for a course Reset, if no $cidReq is provided in the
  53. * same time, all course informations is removed from the
  54. * current session
  55. *
  56. * int $gidReq : group Id requested
  57. * boolean $gidReset : ask for a group Reset, if no $gidReq is provided in the
  58. * same time, all group informations is removed from the
  59. * current session
  60. *
  61. *
  62. * VARIABLES SET AND RETURNED BY THE SCRIPT
  63. *
  64. * All the variables below are set and returned by this script.
  65. *
  66. * USER VARIABLES
  67. *
  68. * string $_user ['firstName' ]
  69. * string $_user ['lastName' ]
  70. * string $_user ['mail' ]
  71. * string $_user ['lastLogin' ]
  72. * string $_user ['official_code']
  73. * string $_user ['picture_uri' ]
  74. * string $_user['user_id']
  75. *
  76. * boolean $is_platformAdmin
  77. * boolean $is_allowedCreateCourse
  78. *
  79. * COURSE VARIABLES
  80. *
  81. * string $_cid (the course id)
  82. *
  83. * int $_course['id' ] - auto-assigned integer
  84. * string $_course['name' ] - the title of the course
  85. * string $_course['official_code'] - the visual / fake / official code
  86. * string $_course['sysCode' ]
  87. * string $_course['path' ]
  88. * string $_course['dbName' ]
  89. * string $_course['dbNameGlu' ]
  90. * string $_course['titular' ]
  91. * string $_course['language' ]
  92. * string $_course['extLink' ]['url' ]
  93. * string $_course['extLink' ]['name']
  94. * string $_course['categoryCode']
  95. * string $_course['categoryName']
  96. * boolean $is_courseMember
  97. * boolean $is_courseTutor
  98. * boolean $is_courseAdmin
  99. *
  100. *
  101. * GROUP VARIABLES
  102. *
  103. * int $_gid (the group id)
  104. *
  105. *
  106. * IMPORTANT ADVICE FOR DEVELOPERS
  107. *
  108. * We strongly encourage developers to use a connection layer at the top of
  109. * their scripts rather than use these variables, as they are, inside the core
  110. * of their scripts. It will make code maintenance much easier.
  111. *
  112. * Many if the functions you need you can already find in the
  113. * main_api.lib.php
  114. *
  115. * We encourage you to use functions to access these global "kernel" variables.
  116. * You can add them to e.g. the main API library.
  117. *
  118. *
  119. * SCRIPT STRUCTURE
  120. *
  121. * 1. The script determines if there is an authentication attempt. This part
  122. * only chek if the login name and password are valid. Afterwards, it set the
  123. * $_user['user_id'] (user id) and the $uidReset flag. Other user informations are retrieved
  124. * later. It's also in this section that optional external authentication
  125. * devices step in.
  126. *
  127. * 2. The script determines what other session informations have to be set or
  128. * reset, setting correctly $cidReset (for course) and $gidReset (for group).
  129. *
  130. * 3. If needed, the script retrieves the other user informations (first name,
  131. * last name, ...) and stores them in session.
  132. *
  133. * 4. If needed, the script retrieves the course information and stores them
  134. * in session
  135. *
  136. * 5. The script initializes the user permission status and permission for the
  137. * course level
  138. *
  139. * 6. If needed, the script retrieves group informations an store them in
  140. * session.
  141. *
  142. * 7. The script initializes the user status and permission for the group level.
  143. *
  144. * @package dokeos.include
  145. ==============================================================================
  146. */
  147. /*
  148. ==============================================================================
  149. INIT SECTION
  150. variables should be initialised here
  151. ==============================================================================
  152. */
  153. // verified if exists the username and password in session current
  154. if (isset($_SESSION['info_current_user'][1]) && isset($_SESSION['info_current_user'][2])) {
  155. require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
  156. }
  157. // parameters passed via GET
  158. $logout = isset($_GET["logout"]) ? $_GET["logout"] : '';
  159. $gidReq = isset($_GET["gidReq"]) ? Database::escape_string($_GET["gidReq"]) : '';
  160. //this fixes some problems with generic functionalities like
  161. //My Agenda & What's New icons linking to courses
  162. // $cidReq can be set in the index.php file of a course-area
  163. $cidReq = isset($cidReq) ? Database::escape_string($cidReq) : '';
  164. // $cidReq can be set in URL-parameter
  165. $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $cidReq;
  166. $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
  167. // $cidReset can be set in URL-parameter
  168. $cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq']!=$_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
  169. // $cDir is a special url param sent by courses/.htaccess
  170. $cDir = (!empty($_GET['cDir']) ? $_GET['cDir'] : null);
  171. $gidReset = isset($gidReset) ? $gidReset : '';
  172. // $gidReset can be set in URL-parameter
  173. // parameters passed via POST
  174. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  175. // passed through other means
  176. //$cidReq -- passed from course folder index.php
  177. /*
  178. ==============================================================================
  179. MAIN CODE
  180. ==============================================================================
  181. */
  182. if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout)) {
  183. // uid is in session => login already done, continue with this value
  184. $_user['user_id'] = $_SESSION['_user']['user_id'];
  185. } else {
  186. if (isset($_user['user_id'])) {
  187. unset($_user['user_id']);
  188. }
  189. //$_SESSION['info_current_user'][1] is user name
  190. //$_SESSION['info_current_user'][2] is current password encrypted
  191. //$_SESSION['update_term_and_condition'][1] is current user id, of user in session
  192. if (get_setting('allow_terms_conditions')=='true') {
  193. if (isset($_POST['login']) && isset($_POST['password']) && isset($_SESSION['update_term_and_condition'][1])) {
  194. $user_id=$_SESSION['update_term_and_condition'][1]; // user id
  195. // update the terms & conditions
  196. if ((isset($_POST['legal_accept']) && $_POST['legal_accept']=='1') || !isset($_POST['legal_accept'])) {
  197. $legal_option=true;
  198. } else {
  199. $legal_option=false;
  200. }
  201. if (isset($_POST['legal_accept_type']) && $legal_option===true) {
  202. $cond_array = explode(':',$_POST['legal_accept_type']);
  203. if (!empty($cond_array[0]) && !empty($cond_array[1])){
  204. $time = time();
  205. $condition_to_save = intval($cond_array[0]).':'.intval($cond_array[1]).':'.$time;
  206. UserManager::update_extra_field_value($user_id,'legal_accept',$condition_to_save);
  207. }
  208. }
  209. }
  210. }
  211. if ((isset($_POST['login']) && isset($_POST['password']))) {
  212. // $login && $password are given to log in
  213. $login = $_POST['login'];
  214. $password = $_POST['password'];
  215. //lookup the user in the main database
  216. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  217. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  218. FROM $user_table
  219. WHERE username = '".trim(addslashes($login))."'";
  220. $result = api_sql_query($sql,__FILE__,__LINE__);
  221. if (Database::num_rows($result) > 0) {
  222. $uData = Database::fetch_array($result);
  223. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  224. //the authentification of this user is managed by Dokeos itself
  225. $password = trim(stripslashes($password));
  226. // determine if the password needs to be encrypted before checking
  227. // $userPasswordCrypted is set in an external configuration file
  228. /*if ($userPasswordCrypted) {
  229. $password = md5($password);
  230. } */
  231. if (get_setting('allow_terms_conditions')=='true') {
  232. if (isset($_POST['password']) && isset($_SESSION['info_current_user'][2]) && $_POST['password']==$_SESSION['info_current_user'][2]) {
  233. $password=$_POST['password'];
  234. } else {
  235. $password = api_get_encrypted_password($password);
  236. }
  237. } else {
  238. $password = api_get_encrypted_password($password);
  239. }
  240. if (get_setting('allow_terms_conditions')=='true') {
  241. if ($password == $uData['password'] AND (trim($login) == $uData['username'])) {
  242. $temp_user_id = $uData['user_id'];
  243. $term_and_condition_status=api_check_term_condition($temp_user_id);//false or true
  244. if ($term_and_condition_status===false) {
  245. $_SESSION['update_term_and_condition']=array(true,$temp_user_id);
  246. $_SESSION['info_current_user']=array(true,$login,$password);
  247. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php');
  248. exit;
  249. } else {
  250. unset($_SESSION['update_term_and_condition']);
  251. unset($_SESSION['info_current_user']);
  252. }
  253. }
  254. }
  255. // check the user's password
  256. if ($password == $uData['password'] AND (trim($login) == $uData['username'])) {
  257. // check if the account is active (not locked)
  258. if ($uData['active']=='1') {
  259. // check if the expiration date has not been reached
  260. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  261. global $_configuration;
  262. if ($_configuration['multiple_access_urls']==true) {
  263. //check the access_url configuration setting if the user is registered in the access_url_rel_user table
  264. //getting the current access_url_id of the platform
  265. $current_access_url_id = api_get_current_access_url_id();
  266. // my user is subscribed in these sites => $my_url_list
  267. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  268. if (is_array($my_url_list) && count($my_url_list)>0 ){
  269. // the user have the permissions to enter at this site
  270. if (in_array($current_access_url_id, $my_url_list)) {
  271. $_user['user_id'] = $uData['user_id'];
  272. api_session_register('_user');
  273. event_login();
  274. } else {
  275. $loginFailed = true;
  276. api_session_unregister('_uid');
  277. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  278. exit;
  279. }
  280. } else {
  281. $loginFailed = true;
  282. api_session_unregister('_uid');
  283. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  284. exit;
  285. }
  286. } else {
  287. $_user['user_id'] = $uData['user_id'];
  288. api_session_register('_user');
  289. event_login();
  290. }
  291. } else {
  292. $loginFailed = true;
  293. api_session_unregister('_uid');
  294. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  295. exit;
  296. }
  297. } else {
  298. $loginFailed = true;
  299. api_session_unregister('_uid');
  300. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  301. exit;
  302. }
  303. } else {
  304. // login failed: username or password incorrect
  305. $loginFailed = true;
  306. api_session_unregister('_uid');
  307. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
  308. exit;
  309. }
  310. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id']) {
  311. //first login for a not self registred
  312. //e.g. registered by a teacher
  313. //do nothing (code may be added later)
  314. }
  315. } elseif (!empty($extAuthSource[$uData['auth_source']]['login']) && file_exists($extAuthSource[$uData['auth_source']]['login'])) {
  316. /*
  317. * Process external authentication
  318. * on the basis of the given login name
  319. */
  320. $loginFailed = true; // Default initialisation. It could
  321. // change after the external authentication
  322. $key = $uData['auth_source']; //'ldap','shibboleth'...
  323. /* >>>>>>>> External authentication modules <<<<<<<<< */
  324. // see configuration.php to define these
  325. include_once($extAuthSource[$key]['login']);
  326. /* >>>>>>>> External authentication modules <<<<<<<<< */
  327. } else // no standard Dokeos login - try external authentification
  328. {
  329. //huh... nothing to do... we shouldn't get here
  330. error_log('Dokeos Authentication file '. $extAuthSource[$uData['auth_source']]['login']. ' could not be found - this might prevent your system from doing the corresponding authentication process',0);
  331. }
  332. if (!empty($_SESSION['request_uri'])) {
  333. $req = $_SESSION['request_uri'];
  334. unset($_SESSION['request_uri']);
  335. header('location: '.$req);
  336. } else {
  337. if (isset($param)) {
  338. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login').$param);
  339. } else {
  340. // here is the main redirect of a *normal* login page in Dokeos
  341. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login'));
  342. }
  343. }
  344. } else {
  345. // login failed, mysql_num_rows($result) <= 0
  346. $loginFailed = true; // Default initialisation. It could
  347. // change after the external authentication
  348. /*
  349. * In this section:
  350. * there is no entry for the $login user in the Dokeos
  351. * database. This also means there is no auth_source for the user.
  352. * We let all external procedures attempt to add him/her
  353. * to the system.
  354. *
  355. * Process external login on the basis
  356. * of the authentication source list
  357. * provided by the configuration settings.
  358. * If the login succeeds, for going further,
  359. * Dokeos needs the $_user['user_id'] variable to be
  360. * set and registered in the session. It's the
  361. * responsability of the external login script
  362. * to provide this $_user['user_id'].
  363. */
  364. if (isset($extAuthSource) && is_array($extAuthSource)) {
  365. foreach($extAuthSource as $thisAuthSource) {
  366. if (!empty($thisAuthSource['newUser']) && file_exists($thisAuthSource['newUser'])) {
  367. include_once($thisAuthSource['newUser']);
  368. } else {
  369. error_log('Dokeos Authentication file '. $thisAuthSource['newUser']. ' could not be found - this might prevent your system from using the authentication process in the user creation process',0);
  370. }
  371. }
  372. } //end if is_array($extAuthSource)
  373. } //end else login failed
  374. } elseif(api_get_setting('sso_authentication')==='true' && !in_array('webservices', explode('/', $_SERVER['REQUEST_URI']))) {
  375. /**
  376. * TODO:
  377. * - Implement user interface for api_get_setting('sso_authentication')
  378. * } elseif (api_get_setting('sso_authentication')=='true') {
  379. * - Work on a better validation for webservices paths. Current is very poor and exit
  380. * - $master variable should be recovered from dokeos settings.
  381. */
  382. $master = array(
  383. 'domain' => api_get_setting('sso_authentication_domain'), // 'localhost/project/drupal5',
  384. 'auth_uri' => api_get_setting('sso_authentication_auth_uri'), // '/?q=user',
  385. 'deauth_uri' => api_get_setting('sso_authentication_unauth_uri'), // '/?q=logout',
  386. 'protocol' => api_get_setting('sso_authentication_protocol') // 'http://',
  387. );
  388. $referer = $master['protocol'] . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
  389. if (isset($_SESSION['_user']['user_id'])) {
  390. if ($logout) {
  391. // Library needed by index.php
  392. include_once api_get_path(LIBRARY_PATH) . 'online.inc.php';
  393. include_once (api_get_path(LIBRARY_PATH).'course.lib.php');
  394. // Prevent index.php to redirect
  395. global $logout_no_redirect;
  396. $logout_no_redirect = TRUE;
  397. // Make custom redirect after logout
  398. online_logout();
  399. header('Location: '. $master['protocol'] . $master['domain'] . $master['deauth_uri']);
  400. exit;
  401. }
  402. } elseif(!$logout) {
  403. $master_url = $master['domain'] . $master['auth_uri'];
  404. // Handle cookie comming from Master Server
  405. if (!isset($_GET['sso_referer']) && !isset($_GET['loginFailed'])) {
  406. // Target to redirect after success SSO
  407. $target = api_get_path(WEB_PATH);
  408. // Redirect to master server
  409. header('Location: ' . $master['protocol'] . $master_url . '&sso_referer=' . urlencode($referer) . '&sso_target=' . urlencode($target));
  410. exit;
  411. } elseif (isset($_GET['sso_cookie'])) {
  412. if (isset($_GET['sso_referer']) ? $_GET['sso_referer'] === $master['protocol']. $master_url : FALSE) {
  413. $sso = unserialize(base64_decode($_GET['sso_cookie']));
  414. //lookup the user in the main database
  415. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  416. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  417. FROM $user_table
  418. WHERE username = '".trim(addslashes($sso['username']))."'";
  419. $result = api_sql_query($sql,__FILE__,__LINE__);
  420. if (Database::num_rows($result) > 0) {
  421. $uData = Database::fetch_array($result);
  422. // check the user's password
  423. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  424. // Make sure password is encrypted with md5
  425. if (!$userPasswordCrypted) {
  426. $uData['password'] = md5($uData['password']);
  427. }
  428. //the authentification of this user is managed by Dokeos itself// check the user's password
  429. // password hash comes into a sha1
  430. if ($sso['secret'] === sha1($uData['password']) && ($sso['username'] == $uData['username'])) {
  431. // check if the account is active (not locked)
  432. if ($uData['active']=='1') {
  433. // check if the expiration date has not been reached
  434. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  435. global $_configuration;
  436. if ($_configuration['multiple_access_urls']==true) {
  437. //check the access_url configuration setting if the user is registered in the access_url_rel_user table
  438. //getting the current access_url_id of the platform
  439. $current_access_url_id = api_get_current_access_url_id();
  440. // my user is subscribed in these sites => $my_url_list
  441. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  442. if (is_array($my_url_list) && count($my_url_list)>0 ) {
  443. if (in_array($current_access_url_id, $my_url_list)) {
  444. // the user has permission to enter at this site
  445. $_user['user_id'] = $uData['user_id'];
  446. api_session_register('_user');
  447. event_login();
  448. // Redirect to homepage
  449. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  450. header('Location: '. $sso_target);
  451. } else {
  452. // user does not have permission for this site
  453. $loginFailed = true;
  454. api_session_unregister('_uid');
  455. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  456. exit;
  457. }
  458. } else {
  459. // there is no URL in the multiple urls list for this user
  460. $loginFailed = true;
  461. api_session_unregister('_uid');
  462. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  463. exit;
  464. }
  465. } else {
  466. //single URL access
  467. $_user['user_id'] = $uData['user_id'];
  468. api_session_register('_user');
  469. event_login();
  470. // Redirect to homepage
  471. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  472. header('Location: '. $sso_target);
  473. }
  474. } else {
  475. // user account expired
  476. $loginFailed = true;
  477. api_session_unregister('_uid');
  478. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  479. exit;
  480. }
  481. } else {
  482. //user not active
  483. $loginFailed = true;
  484. api_session_unregister('_uid');
  485. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  486. exit;
  487. }
  488. } else {
  489. //sha1 of password is wrong
  490. $loginFailed = true;
  491. api_session_unregister('_uid');
  492. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  493. exit;
  494. }
  495. } else {
  496. //auth_source is wrong
  497. $loginFailed = true;
  498. api_session_unregister('_uid');
  499. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  500. exit;
  501. }
  502. } else {
  503. //no user by that login
  504. $loginFailed = true;
  505. api_session_unregister('_uid');
  506. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  507. exit;
  508. }
  509. } else {
  510. //request comes from unknown source
  511. $loginFailed = true;
  512. api_session_unregister('_uid');
  513. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  514. exit;
  515. }
  516. }
  517. }
  518. } elseif (api_get_setting('openid_authentication')=='true') {
  519. if (!empty($_POST['openid_url'])) {
  520. include('main/auth/openid/login.php');
  521. openid_begin(trim($_POST['openid_url']),api_get_path(WEB_PATH).'index.php');
  522. //this last function should trigger a redirect, so we can die here safely
  523. die('Openid login redirection should be in progress');
  524. } elseif (!empty($_GET['openid_identity']))
  525. { //it's usual for PHP to replace '.' (dot) by '_' (underscore) in URL parameters
  526. include('main/auth/openid/login.php');
  527. $res = openid_complete($_GET);
  528. if ($res['status'] == 'success') {
  529. $id1 = Database::escape_string($res['openid.identity']);
  530. //have another id with or without the final '/'
  531. $id2 = (substr($id1,-1,1)=='/'?substr($id1,0,-1):$id1.'/');
  532. //lookup the user in the main database
  533. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  534. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  535. FROM $user_table
  536. WHERE openid = '$id1'
  537. OR openid = '$id2' ";
  538. $result = api_sql_query($sql);
  539. if ($result !== false) {
  540. if (Database::num_rows($result)>0) {
  541. //$row = Database::fetch_array($res);
  542. $uData = Database::fetch_array($result);
  543. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  544. //the authentification of this user is managed by Dokeos itself
  545. // check if the account is active (not locked)
  546. if ($uData['active']=='1') {
  547. // check if the expiration date has not been reached
  548. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  549. $_user['user_id'] = $uData['user_id'];
  550. api_session_register('_user');
  551. event_login();
  552. } else {
  553. $loginFailed = true;
  554. api_session_unregister('_uid');
  555. header('Location: index.php?loginFailed=1&error=account_expired');
  556. exit;
  557. }
  558. } else {
  559. $loginFailed = true;
  560. api_session_unregister('_uid');
  561. header('Location: index.php?loginFailed=1&error=account_inactive');
  562. exit;
  563. }
  564. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id'])
  565. {
  566. //first login for a not self registred
  567. //e.g. registered by a teacher
  568. //do nothing (code may be added later)
  569. }
  570. }
  571. } else {
  572. //Redirect to the subscription form
  573. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php?username='.$res['openid.sreg.nickname'].'&email='.$res['openid.sreg.email'].'&openid='.$res['openid.identity'].'&openid_msg=idnotfound');
  574. //$loginFailed = true;
  575. }
  576. } else {
  577. $loginFailed = true;
  578. }
  579. } else {
  580. $loginFailed = true;
  581. }
  582. }
  583. }
  584. // else {} => continue as anonymous user
  585. $uidReset = true;
  586. // $cidReset = true;
  587. // $gidReset = true;
  588. }
  589. //Now check for anonymous user mode
  590. if (isset($use_anonymous) && $use_anonymous == true) {
  591. //if anonymous mode is set, then try to set the current user as anonymous
  592. //if he doesn't have a login yet
  593. api_set_anonymous();
  594. } else {
  595. //if anonymous mode is not set, then check if this user is anonymous. If it
  596. //is, clean it from being anonymous (make him a nobody :-))
  597. api_clear_anonymous();
  598. }
  599. // if there is a cDir parameter in the URL (coming from courses/.htaccess redirection)
  600. if (!empty($cDir)) {
  601. require_once api_get_path(LIBRARY_PATH).'course.lib.php';
  602. $c = CourseManager::get_course_id_from_path($cDir);
  603. if ($c != false) { $cidReq = $c; }
  604. }
  605. // if the requested course is different from the course in session
  606. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid']))) {
  607. $cidReset = true;
  608. $gidReset = true; // As groups depend from courses, group id is reset
  609. }
  610. // if the requested group is different from the group in session
  611. $gid = isset($_SESSION['_gid'])?$_SESSION['_gid']:'';
  612. if ($gidReq && $gidReq != $gid) {
  613. $gidReset = true;
  614. }
  615. //////////////////////////////////////////////////////////////////////////////
  616. // USER INIT
  617. //////////////////////////////////////////////////////////////////////////////
  618. if (isset($uidReset) && $uidReset) // session data refresh requested
  619. {
  620. $is_platformAdmin = false; $is_allowedCreateCourse = false;
  621. if (isset($_user['user_id']) && $_user['user_id']) // a uid is given (log in succeeded)
  622. {
  623. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  624. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  625. if ($_configuration['tracking_enabled']) {
  626. $sql = "SELECT user.*, a.user_id is_admin,
  627. UNIX_TIMESTAMP(login.login_date) login_date
  628. FROM $user_table
  629. LEFT JOIN $admin_table a
  630. ON user.user_id = a.user_id
  631. LEFT JOIN ".$_configuration['statistics_database'].".track_e_login login
  632. ON user.user_id = login.login_user_id
  633. WHERE user.user_id = '".$_user['user_id']."'
  634. ORDER BY login.login_date DESC LIMIT 1";
  635. } else {
  636. $sql = "SELECT user.*, a.user_id is_admin
  637. FROM $user_table
  638. LEFT JOIN $admin_table a
  639. ON user.user_id = a.user_id
  640. WHERE user.user_id = '".$_user['user_id']."'";
  641. }
  642. $result = api_sql_query($sql,__FILE__,__LINE__);
  643. if (Database::num_rows($result) > 0) {
  644. // Extracting the user data
  645. $uData = Database::fetch_array($result);
  646. $_user ['firstName'] = $uData ['firstname' ];
  647. $_user ['lastName' ] = $uData ['lastname' ];
  648. $_user ['mail' ] = $uData ['email' ];
  649. $_user ['lastLogin'] = $uData ['login_date'];
  650. $_user ['official_code'] = $uData ['official_code'];
  651. $_user ['picture_uri'] = $uData ['picture_uri'];
  652. $_user ['user_id'] = $uData ['user_id'];
  653. $_user ['language'] = $uData ['language'];
  654. $_user ['auth_source'] = $uData ['auth_source'];
  655. $_user ['theme'] = $uData ['theme'];
  656. $_user ['status'] = $uData ['status'];
  657. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  658. $is_allowedCreateCourse = (bool) (($uData ['status'] == 1) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == 4));
  659. api_session_register('_user');
  660. } else {
  661. header('location:'.api_get_path(WEB_PATH));
  662. //exit("WARNING UNDEFINED UID !! ");
  663. }
  664. } else { // no uid => logout or Anonymous
  665. api_session_unregister('_user');
  666. api_session_unregister('_uid');
  667. }
  668. api_session_register('is_platformAdmin');
  669. api_session_register('is_allowedCreateCourse');
  670. } else { // continue with the previous values
  671. $_user = $_SESSION['_user'];
  672. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  673. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  674. }
  675. //////////////////////////////////////////////////////////////////////////////
  676. // COURSE INIT
  677. //////////////////////////////////////////////////////////////////////////////
  678. if (isset($cidReset) && $cidReset) { // course session data refresh requested or empty data
  679. if ($cidReq) {
  680. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  681. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  682. $sql = "SELECT course.*, course_category.code faCode, course_category.name faName
  683. FROM $course_table
  684. LEFT JOIN $course_cat_table
  685. ON course.category_code = course_category.code
  686. WHERE course.code = '$cidReq'";
  687. $result = api_sql_query($sql,__FILE__,__LINE__);
  688. if (Database::num_rows($result)>0) {
  689. $cData = Database::fetch_array($result);
  690. $_cid = $cData['code' ];
  691. $_course = array();
  692. $_course['id' ] = $cData['code' ]; //auto-assigned integer
  693. $_course['name' ] = $cData['title' ];
  694. $_course['official_code'] = $cData['visual_code' ]; // use in echo
  695. $_course['sysCode' ] = $cData['code' ]; // use as key in db
  696. $_course['path' ] = $cData['directory' ]; // use as key in path
  697. $_course['dbName' ] = $cData['db_name' ]; // use as key in db list
  698. $_course['dbNameGlu' ] = $_configuration['table_prefix'] . $cData['db_name'] . $_configuration['db_glue']; // use in all queries
  699. $_course['titular' ] = $cData['tutor_name' ];
  700. $_course['language' ] = $cData['course_language' ];
  701. $_course['extLink' ]['url' ] = $cData['department_url' ];
  702. $_course['extLink' ]['name'] = $cData['department_name'];
  703. $_course['categoryCode'] = $cData['faCode' ];
  704. $_course['categoryName'] = $cData['faName' ];
  705. $_course['visibility' ] = $cData['visibility'];
  706. $_course['subscribe_allowed'] = $cData['subscribe'];
  707. $_course['unubscribe_allowed'] = $cData['unsubscribe'];
  708. api_session_register('_cid');
  709. api_session_register('_course');
  710. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  711. //We add a new record in the course tracking table
  712. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  713. $time = api_get_datetime();
  714. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  715. "VALUES('".$_course['sysCode']."', '".$_user['user_id']."', '$time', '$time', '1')";
  716. api_sql_query($sql,__FILE__,__LINE__);
  717. }
  718. // if a session id has been given in url, we store the session
  719. if (api_get_setting('use_session_mode')=='true') {
  720. // Database Table Definitions
  721. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  722. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  723. $tbl_session_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
  724. $tbl_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  725. if (!empty($_GET['id_session'])) {
  726. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  727. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.$_SESSION['id_session'] . '"';
  728. $rs = api_sql_query($sql,__FILE__,__LINE__);
  729. list($_SESSION['session_name']) = Database::fetch_array($rs);
  730. } else {
  731. api_session_unregister('session_name');
  732. api_session_unregister('id_session');
  733. }
  734. }
  735. } else {
  736. //exit("WARNING UNDEFINED CID !! ");
  737. header('location:'.api_get_path(WEB_PATH));
  738. }
  739. } else {
  740. api_session_unregister('_cid');
  741. api_session_unregister('_course');
  742. }
  743. } else { // continue with the previous values
  744. if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
  745. $_cid = -1; //set default values that will be caracteristic of being unset
  746. $_course = -1;
  747. } else {
  748. $_cid = $_SESSION['_cid' ];
  749. $_course = $_SESSION['_course'];
  750. // these lines are usefull for tracking. Indeed we can have lost the id_session and not the cid.
  751. // Moreover, if we want to track a course with another session it can be usefull
  752. if (!empty($_GET['id_session'])) {
  753. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  754. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  755. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.$_SESSION['id_session'] . '"';
  756. $rs = api_sql_query($sql,__FILE__,__LINE__);
  757. list($_SESSION['session_name']) = Database::fetch_array($rs);
  758. }
  759. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  760. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  761. $time = api_get_datetime();
  762. //We select the last record for the current course in the course tracking table
  763. $sql="SELECT course_access_id FROM $course_tracking_table WHERE user_id=".intval($_user ['user_id'])." ORDER BY login_course_date DESC LIMIT 0,1";
  764. $result=api_sql_query($sql,__FILE__,__LINE__);
  765. if (Database::num_rows($result)>0) {
  766. $i_course_access_id = Database::result($result,0,0);
  767. //We update the course tracking table
  768. $sql="UPDATE $course_tracking_table " .
  769. "SET logout_course_date = '$time', " .
  770. "counter = counter+1 " .
  771. "WHERE course_access_id=".intval($i_course_access_id);
  772. api_sql_query($sql,__FILE__,__LINE__);
  773. } else {
  774. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  775. "VALUES('".$_course['sysCode']."', '".$_user['user_id']."', '$time', '$time', '1')";
  776. api_sql_query($sql,__FILE__,__LINE__);
  777. }
  778. }
  779. }
  780. }
  781. //////////////////////////////////////////////////////////////////////////////
  782. // COURSE / USER REL. INIT
  783. //////////////////////////////////////////////////////////////////////////////
  784. if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  785. if (isset($_user['user_id']) && $_user['user_id'] && isset($_cid) && $_cid) { // have keys to search data
  786. if (api_get_setting('use_session_mode') != 'true') {
  787. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  788. $sql = "SELECT * FROM $course_user_table
  789. WHERE user_id = '".$_user['user_id']."'
  790. AND course_code = '$cidReq'";
  791. $result = api_sql_query($sql,__FILE__,__LINE__);
  792. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  793. $cuData = Database::fetch_array($result);
  794. $is_courseMember = true;
  795. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  796. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  797. api_session_register('_courseUser');
  798. } else { // this user has no status related to this course
  799. $is_courseMember = false;
  800. $is_courseAdmin = false;
  801. $is_courseTutor = false;
  802. }
  803. $is_courseAdmin = (bool) ($is_courseAdmin || $is_platformAdmin);
  804. } else {
  805. $tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  806. $sql = "SELECT * FROM ".$tbl_course_user."
  807. WHERE user_id = '".$_user['user_id']."'
  808. AND course_code = '$cidReq'";
  809. $result = api_sql_query($sql,__FILE__,__LINE__);
  810. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  811. $cuData = Database::fetch_array($result);
  812. $_courseUser['role'] = $cuData['role' ];
  813. $is_courseMember = true;
  814. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  815. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  816. api_session_register('_courseUser');
  817. }
  818. if (empty($is_courseAdmin)) { // this user has no status related to this course
  819. // is it the session coach or the session admin ?
  820. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  821. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  822. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  823. $sql = "SELECT session.id_coach, session_admin_id
  824. FROM ".$tbl_session." as session
  825. INNER JOIN ".$tbl_session_course."
  826. ON session_rel_course.id_session = session.id
  827. AND session_rel_course.course_code='$_cid'";
  828. $result = api_sql_query($sql,__FILE__,__LINE__);
  829. $row = api_store_result($result);
  830. if ($row[0]['id_coach']==$_user['user_id']) {
  831. $_courseUser['role'] = 'Professor';
  832. $is_courseMember = true;
  833. $is_courseTutor = true;
  834. $is_courseCoach = true;
  835. $is_sessionAdmin = false;
  836. if (api_get_setting('extend_rights_for_coach')=='true') {
  837. $is_courseAdmin = true;
  838. } else {
  839. $is_courseAdmin = false;
  840. }
  841. api_session_register('_courseUser');
  842. } elseif ($row[0]['session_admin_id']==$_user['user_id']) {
  843. $_courseUser['role'] = 'Professor';
  844. $is_courseMember = false;
  845. $is_courseTutor = false;
  846. $is_courseAdmin = false;
  847. $is_courseCoach = false;
  848. $is_sessionAdmin = true;
  849. } else {
  850. // Check if the current user is the course coach
  851. $sql = "SELECT 1
  852. FROM ".$tbl_session_course."
  853. WHERE session_rel_course.course_code='$_cid'
  854. AND session_rel_course.id_coach = '".$_user['user_id']."'";
  855. $result = api_sql_query($sql,__FILE__,__LINE__);
  856. if ($row = Database::fetch_array($result)) {
  857. $_courseUser['role'] = 'Professor';
  858. $is_courseMember = true;
  859. $is_courseTutor = true;
  860. $is_courseCoach = true;
  861. $is_sessionAdmin = false;
  862. if (api_get_setting('extend_rights_for_coach')=='true') {
  863. $is_courseAdmin = true;
  864. } else {
  865. $is_courseAdmin = false;
  866. }
  867. api_session_register('_courseUser');
  868. } else {
  869. // Check if the user is a student is this session
  870. $sql = "SELECT * FROM ".$tbl_session_course_user."
  871. WHERE id_user = '".$_user['user_id']."'
  872. AND course_code = '$cidReq'";
  873. $result = api_sql_query($sql,__FILE__,__LINE__);
  874. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  875. while($row = Database::fetch_array($result)){
  876. $is_courseMember = true;
  877. $is_courseTutor = false;
  878. $is_courseAdmin = false;
  879. $is_sessionAdmin = false;
  880. api_session_register('_courseUser');
  881. }
  882. }
  883. }
  884. }
  885. }
  886. }
  887. } else { // keys missing => not anymore in the course - user relation
  888. //// course
  889. $is_courseMember = false;
  890. $is_courseAdmin = false;
  891. $is_courseTutor = false;
  892. $is_courseCoach = false;
  893. $is_sessionAdmin = false;
  894. api_session_unregister('_courseUser');
  895. }
  896. //DEPRECATED
  897. //$is_courseAllowed=($_cid && ($_course['visibility'] || $is_courseMember || $is_platformAdmin))?true:false;
  898. //NEW
  899. if (isset($_course)) {
  900. if ($_course['visibility'] == COURSE_VISIBILITY_OPEN_WORLD)
  901. $is_allowed_in_course = true;
  902. elseif ($_course['visibility'] == COURSE_VISIBILITY_OPEN_PLATFORM && isset($_user['user_id']) && !api_is_anonymous($_user['user_id']))
  903. $is_allowed_in_course = true;
  904. elseif ($_course['visibility'] == COURSE_VISIBILITY_REGISTERED && ($is_platformAdmin || $is_courseMember))
  905. $is_allowed_in_course = true;
  906. elseif ($_course['visibility'] == COURSE_VISIBILITY_CLOSED && ($is_platformAdmin || $is_courseAdmin))
  907. $is_allowed_in_course = true;
  908. else $is_allowed_in_course = false;
  909. }
  910. // save the states
  911. api_session_register('is_courseMember');
  912. api_session_register('is_courseAdmin');
  913. //api_session_register('is_courseAllowed'); //deprecated old permission var
  914. api_session_register('is_courseTutor');
  915. api_session_register('is_allowed_in_course'); //new permission var
  916. api_session_register('is_courseCoach');
  917. api_session_register('is_sessionAdmin');
  918. } else { // continue with the previous values
  919. if (isset($_SESSION ['_courseUser'])) {
  920. $_courseUser = $_SESSION ['_courseUser'];
  921. }
  922. $is_courseMember = $_SESSION ['is_courseMember' ];
  923. $is_courseAdmin = $_SESSION ['is_courseAdmin' ];
  924. //$is_courseAllowed = $_SESSION ['is_courseAllowed']; //deprecated
  925. $is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
  926. $is_courseTutor = $_SESSION ['is_courseTutor' ];
  927. $is_courseCoach = $_SESSION ['is_courseCoach' ];
  928. }
  929. //////////////////////////////////////////////////////////////////////////////
  930. // GROUP INIT
  931. //////////////////////////////////////////////////////////////////////////////
  932. if ((isset($gidReset) && $gidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  933. if ($gidReq && $_cid ) { // have keys to search data
  934. $group_table = Database::get_course_table(TABLE_GROUP);
  935. $sql = "SELECT * FROM $group_table WHERE id = '$gidReq'";
  936. $result = api_sql_query($sql,__FILE__,__LINE__);
  937. if (Database::num_rows($result) > 0) { // This group has recorded status related to this course
  938. $gpData = Database::fetch_array($result);
  939. $_gid = $gpData ['id' ];
  940. api_session_register('_gid');
  941. } else {
  942. exit("WARNING UNDEFINED GID !! ");
  943. }
  944. } elseif (isset($_SESSION['_gid']) or isset($_gid)) { // Keys missing => not anymore in the group - course relation
  945. api_session_unregister('_gid');
  946. }
  947. } elseif (isset($_SESSION['_gid'])) { // continue with the previous values
  948. $_gid = $_SESSION ['_gid' ];
  949. } else { //if no previous value, assign caracteristic undefined value
  950. $_gid = -1;
  951. }
  952. //set variable according to student_view_enabled choices
  953. if (api_get_setting('student_view_enabled') == "true") {
  954. if (isset($_GET['isStudentView'])) {
  955. if ($_GET['isStudentView'] == 'true') {
  956. if (isset($_SESSION['studentview'])) {
  957. if (!empty($_SESSION['studentview'])) {
  958. // switching to studentview
  959. $_SESSION['studentview'] = 'studentview';
  960. }
  961. }
  962. } elseif ($_GET['isStudentView'] == 'false') {
  963. if (isset($_SESSION['studentview'])) {
  964. if (!empty($_SESSION['studentview'])) {
  965. // switching to teacherview
  966. $_SESSION['studentview'] = 'teacherview';
  967. }
  968. }
  969. }
  970. } elseif (!empty($_SESSION['studentview'])) {
  971. //all is fine, no change to that, obviously
  972. } elseif (empty($_SESSION['studentview'])) {
  973. // We are in teacherview here
  974. $_SESSION['studentview'] = 'teacherview';
  975. }
  976. }
  977. if (isset($_cid)) {
  978. $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
  979. $time = api_get_datetime();
  980. $sql="UPDATE $tbl_course SET last_visit= '$time' WHERE code='$_cid'";
  981. api_sql_query($sql,__FILE__,__LINE__);
  982. }