local.inc.php 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2005 Dokeos S.A.
  6. Copyright (c) 2003-2005 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Hugues Peeters
  9. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  10. Copyright (c) Patrick Cool
  11. For a full list of contributors, see "credits.txt".
  12. The full license can be read in "license.txt".
  13. This program is free software; you can redistribute it and/or
  14. modify it under the terms of the GNU General Public License
  15. as published by the Free Software Foundation; either version 2
  16. of the License, or (at your option) any later version.
  17. See the GNU General Public License for more details.
  18. Contact address: Dokeos, 44 rue des palais, B-1030 Brussels, Belgium
  19. Mail: info@dokeos.com
  20. ==============================================================================
  21. */
  22. /**
  23. ==============================================================================
  24. *
  25. * SCRIPT PURPOSE
  26. *
  27. * This script initializes and manages Dokeos session information. It
  28. * keeps available session information up to date.
  29. *
  30. * You can request a course id. It will check if the course Id requested is the
  31. * same as the current one. If it isn't it will update session information from
  32. * the database. You can also force the course reset if you want ($cidReset).
  33. *
  34. * All the course information is stored in the $_course array.
  35. *
  36. * You can request a group id. The script will check if the group id requested is the
  37. * same as the current one. If it isn't it will update session information from
  38. * the database. You can also force the course reset if you want ($gidReset).
  39. *
  40. The course id is stored in $_cid session variable.
  41. * The group id is stored in $_gid session variable.
  42. *
  43. *
  44. * VARIABLES AFFECTING THE SCRIPT BEHAVIOR
  45. *
  46. * string $login
  47. * string $password
  48. * boolean $logout
  49. *
  50. * string $cidReq : course id requested
  51. * boolean $cidReset : ask for a course Reset, if no $cidReq is provided in the
  52. * same time, all course informations is removed from the
  53. * current session
  54. *
  55. * int $gidReq : group Id requested
  56. * boolean $gidReset : ask for a group Reset, if no $gidReq is provided in the
  57. * same time, all group informations is removed from the
  58. * current session
  59. *
  60. *
  61. * VARIABLES SET AND RETURNED BY THE SCRIPT
  62. *
  63. * All the variables below are set and returned by this script.
  64. *
  65. * USER VARIABLES
  66. *
  67. * string $_user ['firstName' ]
  68. * string $_user ['lastName' ]
  69. * string $_user ['mail' ]
  70. * string $_user ['lastLogin' ]
  71. * string $_user ['official_code']
  72. * string $_user ['picture_uri' ]
  73. * string $_user['user_id']
  74. *
  75. * boolean $is_platformAdmin
  76. * boolean $is_allowedCreateCourse
  77. *
  78. * COURSE VARIABLES
  79. *
  80. * string $_cid (the course id)
  81. *
  82. * int $_course['id' ] - auto-assigned integer
  83. * string $_course['name' ] - the title of the course
  84. * string $_course['official_code'] - the visual / fake / official code
  85. * string $_course['sysCode' ]
  86. * string $_course['path' ]
  87. * string $_course['dbName' ]
  88. * string $_course['dbNameGlu' ]
  89. * string $_course['titular' ]
  90. * string $_course['language' ]
  91. * string $_course['extLink' ]['url' ]
  92. * string $_course['extLink' ]['name']
  93. * string $_course['categoryCode']
  94. * string $_course['categoryName']
  95. * boolean $is_courseMember
  96. * boolean $is_courseTutor
  97. * boolean $is_courseAdmin
  98. *
  99. *
  100. * GROUP VARIABLES
  101. *
  102. * int $_gid (the group id)
  103. *
  104. *
  105. * IMPORTANT ADVICE FOR DEVELOPERS
  106. *
  107. * We strongly encourage developers to use a connection layer at the top of
  108. * their scripts rather than use these variables, as they are, inside the core
  109. * of their scripts. It will make code maintenance much easier.
  110. *
  111. * Many if the functions you need you can already find in the
  112. * main_api.lib.php
  113. *
  114. * We encourage you to use functions to access these global "kernel" variables.
  115. * You can add them to e.g. the main API library.
  116. *
  117. *
  118. * SCRIPT STRUCTURE
  119. *
  120. * 1. The script determines if there is an authentication attempt. This part
  121. * only chek if the login name and password are valid. Afterwards, it set the
  122. * $_user['user_id'] (user id) and the $uidReset flag. Other user informations are retrieved
  123. * later. It's also in this section that optional external authentication
  124. * devices step in.
  125. *
  126. * 2. The script determines what other session informations have to be set or
  127. * reset, setting correctly $cidReset (for course) and $gidReset (for group).
  128. *
  129. * 3. If needed, the script retrieves the other user informations (first name,
  130. * last name, ...) and stores them in session.
  131. *
  132. * 4. If needed, the script retrieves the course information and stores them
  133. * in session
  134. *
  135. * 5. The script initializes the user permission status and permission for the
  136. * course level
  137. *
  138. * 6. If needed, the script retrieves group informations an store them in
  139. * session.
  140. *
  141. * 7. The script initializes the user status and permission for the group level.
  142. *
  143. * @package dokeos.include
  144. ==============================================================================
  145. */
  146. /*
  147. ==============================================================================
  148. INIT SECTION
  149. variables should be initialised here
  150. ==============================================================================
  151. */
  152. // parameters passed via GET
  153. $logout = isset($_GET["logout"]) ? $_GET["logout"] : '';
  154. $gidReq = isset($_GET["gidReq"]) ? $_GET["gidReq"] : '';
  155. //this fixes some problems with generic functionalities like
  156. //My Agenda & What's New icons linking to courses
  157. // $cidReq can be set in the index.php file of a course-area
  158. $cidReq = isset($cidReq) ? $cidReq : '';
  159. // $cidReq can be set in URL-parameter
  160. $cidReq = isset($_GET["cidReq"]) ? $_GET["cidReq"] : $cidReq;
  161. $cidReset = isset($cidReset) ? $cidReset : '';
  162. // $cidReset can be set in URL-parameter
  163. $cidReset = isset($_GET["cidReq"]) ? $_GET["cidReq"] : $cidReset;
  164. $gidReset = isset($gidReset) ? $gidReset : '';
  165. // $gidReset can be set in URL-parameter
  166. $gidReset = isset($_GET["cidReq"]) ? $_GET["cidReq"] : $gidReset;
  167. // parameters passed via POST
  168. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  169. // passed through other means
  170. //$cidReq -- passed from course folder index.php
  171. /*
  172. ==============================================================================
  173. MAIN CODE
  174. ==============================================================================
  175. */
  176. if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout))
  177. {
  178. // uid is in session => login already done, continue with this value
  179. $_user['user_id'] = $_SESSION['_user']['user_id'];
  180. }
  181. else
  182. {
  183. unset($_user['user_id']); // uid not in session ? prevent any hacking
  184. if(isset($_POST['login']) && isset($_POST['password'])) // $login && $password are given to log in
  185. {
  186. $login = $_POST['login'];
  187. $password = $_POST['password'];
  188. //lookup the user in the main database
  189. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  190. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  191. FROM $user_table
  192. WHERE username = '".trim(addslashes($login))."'";
  193. $result = api_sql_query($sql,__FILE__,__LINE__);
  194. if (mysql_num_rows($result) > 0)
  195. {
  196. $uData = mysql_fetch_array($result);
  197. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE)
  198. {
  199. //the authentification of this user is managed by Dokeos itself
  200. $password = trim(stripslashes($password));
  201. // determine if the password needs to be encrypted before checking
  202. // $userPasswordCrypted is set in an external configuration file
  203. if ($userPasswordCrypted)
  204. {
  205. $password = md5($password);
  206. }
  207. // check the user's password
  208. if ($password == $uData['password'] AND (trim($login) == $uData['username']))
  209. {
  210. // check if the account is active (not locked)
  211. if ($uData['active']=='1')
  212. {
  213. // check if the expiration date has not been reached
  214. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00')
  215. {
  216. $_user['user_id'] = $uData['user_id'];
  217. api_session_register('_user');
  218. if(!function_exists('event_login')){
  219. include(api_get_path(LIBRARY_PATH)."events.lib.inc.php");
  220. event_login();
  221. }
  222. }
  223. else
  224. {
  225. $loginFailed = true;
  226. api_session_unregister('_uid');
  227. header('Location: index.php?loginFailed=1&error=account_expired');
  228. exit;
  229. }
  230. }
  231. else
  232. {
  233. $loginFailed = true;
  234. api_session_unregister('_uid');
  235. header('Location: index.php?loginFailed=1&error=account_inactive');
  236. exit;
  237. }
  238. }
  239. else // login failed: username or password incorrect
  240. {
  241. $loginFailed = true;
  242. api_session_unregister('_uid');
  243. header('Location: index.php?loginFailed=1&error=user_password_incorrect');
  244. exit;
  245. }
  246. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id'])
  247. {
  248. //first login for a not self registred
  249. //e.g. registered by a teacher
  250. //do nothing (code may be added later)
  251. }
  252. }
  253. else // no standard Dokeos login - try external authentification
  254. {
  255. /*
  256. * Process external authentication
  257. * on the basis of the given login name
  258. */
  259. $loginFailed = true; // Default initialisation. It could
  260. // change after the external authentication
  261. $key = $uData['auth_source'];
  262. /* >>>>>>>>>>>>>>>> External authentication modules <<<<<<<<<<<<<<<< */
  263. // see configuration.php to define these
  264. include_once($extAuthSource[$key]['login']);
  265. /* >>>>>>>>>>>>>>>> External authentication modules <<<<<<<<<<<<<<<<<< */
  266. }
  267. if(!empty($_SESSION['request_uri']))
  268. {
  269. $req = $_SESSION['request_uri'];
  270. unset($_SESSION['request_uri']);
  271. header('location: '.$req);
  272. }
  273. else
  274. {
  275. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login').$param);
  276. }
  277. }
  278. else // login failed, mysql_num_rows($result) <= 0
  279. {
  280. $loginFailed = true; // Default initialisation. It could
  281. // change after the external authentication
  282. /*
  283. * In this section:
  284. * there is no entry for the $login user in the Dokeos
  285. * database. This also means there is no auth_source for the user.
  286. * We let all external procedures attempt to add him/her
  287. * to the system.
  288. *
  289. * Process external login on the basis
  290. * of the authentication source list
  291. * provided by the configuration settings.
  292. * If the login succeeds, for going further,
  293. * Dokeos needs the $_user['user_id'] variable to be
  294. * set and registered in the session. It's the
  295. * responsability of the external login script
  296. * to provide this $_user['user_id'].
  297. */
  298. if (is_array($extAuthSource))
  299. {
  300. foreach($extAuthSource as $thisAuthSource)
  301. {
  302. include_once($thisAuthSource['newUser']);
  303. }
  304. } //end if is_array($extAuthSource)
  305. } //end else login failed
  306. }
  307. // else {} => continue as anonymous user
  308. $uidReset = true;
  309. // $cidReset = true;
  310. // $gidReset = true;
  311. }
  312. // if the requested course is different from the course in session
  313. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid'])))
  314. {
  315. $cidReset = true;
  316. $gidReset = true; // As groups depend from courses, group id is reset
  317. }
  318. // if the requested group is different from the group in session
  319. if ($gidReq && $gidReq != $_SESSION['_gid'])
  320. {
  321. $gidReset = true;
  322. }
  323. //////////////////////////////////////////////////////////////////////////////
  324. // USER INIT
  325. //////////////////////////////////////////////////////////////////////////////
  326. if (isset($uidReset) && $uidReset) // session data refresh requested
  327. {
  328. $is_platformAdmin = false; $is_allowedCreateCourse = false;
  329. if (isset($_user['user_id']) && $_user['user_id']) // a uid is given (log in succeeded)
  330. {
  331. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  332. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  333. if ($_configuration['tracking_enabled'])
  334. {
  335. $sql = "SELECT `user`.*, `a`.`user_id` `is_admin`,
  336. UNIX_TIMESTAMP(`login`.`login_date`) `login_date`
  337. FROM $user_table
  338. LEFT JOIN $admin_table `a`
  339. ON `user`.`user_id` = `a`.`user_id`
  340. LEFT JOIN `".$_configuration['statistics_database']."`.`track_e_login` `login`
  341. ON `user`.`user_id` = `login`.`login_user_id`
  342. WHERE `user`.`user_id` = '".$_user['user_id']."'
  343. ORDER BY `login`.`login_date` DESC LIMIT 1";
  344. }
  345. else
  346. {
  347. $sql = "SELECT `user`.*, `a`.`user_id` `is_admin`
  348. FROM $user_table
  349. LEFT JOIN $admin_table `a`
  350. ON `user`.`user_id` = `a`.`user_id`
  351. WHERE `user`.`user_id` = '".$_user['user_id']."'";
  352. }
  353. $result = api_sql_query($sql,__FILE__,__LINE__);
  354. if (mysql_num_rows($result) > 0)
  355. {
  356. // Extracting the user data
  357. $uData = mysql_fetch_array($result);
  358. $_user ['firstName'] = $uData ['firstname' ];
  359. $_user ['lastName' ] = $uData ['lastname' ];
  360. $_user ['mail' ] = $uData ['email' ];
  361. $_user ['lastLogin'] = $uData ['login_date'];
  362. $_user ['official_code'] = $uData ['official_code'];
  363. $_user ['picture_uri'] = $uData ['picture_uri'];
  364. $_user ['user_id'] = $uData ['user_id'];
  365. $_user ['language'] = $uData ['language'];
  366. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  367. $is_allowedCreateCourse = (bool) ($uData ['status'] == 1);
  368. api_session_register('_user');
  369. }
  370. else
  371. {
  372. exit("WARNING UNDEFINED UID !! ");
  373. }
  374. }
  375. else // no uid => logout or Anonymous
  376. {
  377. api_session_unregister('_user');
  378. api_session_unregister('_uid');
  379. }
  380. api_session_register('is_platformAdmin');
  381. api_session_register('is_allowedCreateCourse');
  382. }
  383. else // continue with the previous values
  384. {
  385. $_user = $_SESSION['_user'];
  386. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  387. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  388. }
  389. //////////////////////////////////////////////////////////////////////////////
  390. // COURSE INIT
  391. //////////////////////////////////////////////////////////////////////////////
  392. if (isset($cidReset) && $cidReset) // course session data refresh requested or empty data
  393. {
  394. api_session_unregister('id_session');
  395. api_session_unregister('session_name');
  396. if ($cidReq)
  397. {
  398. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  399. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  400. $sql = "SELECT `course`.*, `course_category`.`code` `faCode`, `course_category`.`name` `faName`
  401. FROM $course_table
  402. LEFT JOIN $course_cat_table
  403. ON `course`.`category_code` = `course_category`.`code`
  404. WHERE `course`.`code` = '$cidReq'";
  405. $result = api_sql_query($sql,__FILE__,__LINE__);
  406. if (mysql_num_rows($result)>0)
  407. {
  408. $cData = mysql_fetch_array($result);
  409. $_cid = $cData['code' ];
  410. $_course = array();
  411. $_course['id' ] = $cData['code' ]; //auto-assigned integer
  412. $_course['name' ] = $cData['title' ];
  413. $_course['official_code'] = $cData['visual_code' ]; // use in echo
  414. $_course['sysCode' ] = $cData['code' ]; // use as key in db
  415. $_course['path' ] = $cData['directory' ]; // use as key in path
  416. $_course['dbName' ] = $cData['db_name' ]; // use as key in db list
  417. $_course['dbNameGlu' ] = $_configuration['table_prefix'] . $cData['db_name'] . $_configuration['db_glue']; // use in all queries
  418. $_course['titular' ] = $cData['tutor_name' ];
  419. $_course['language' ] = $cData['course_language' ];
  420. $_course['extLink' ]['url' ] = $cData['department_url' ];
  421. $_course['extLink' ]['name'] = $cData['department_name'];
  422. $_course['categoryCode'] = $cData['faCode' ];
  423. $_course['categoryName'] = $cData['faName' ];
  424. $_course['visibility' ] = $cData['visibility'];
  425. $_course['subscribe_allowed'] = $cData['subscribe'];
  426. $_course['unubscribe_allowed'] = $cData['unsubscribe'];
  427. api_session_register('_cid');
  428. api_session_register('_course');
  429. //We add a new record in the course tracking table
  430. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  431. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  432. "VALUES('".$_course['official_code']."', '".$_user['user_id']."', NOW(), NOW(), '1')";
  433. api_sql_query($sql,__FILE__,__LINE__);
  434. }
  435. else
  436. {
  437. exit("WARNING UNDEFINED CID !! ");
  438. }
  439. }
  440. else
  441. {
  442. api_session_unregister('_cid');
  443. api_session_unregister('_course');
  444. }
  445. }
  446. else // continue with the previous values
  447. {
  448. if(empty($_SESSION['_course']) OR empty($_SESSION['_cid']))
  449. { //no previous values...
  450. $_cid = -1; //set default values that will be caracteristic of being unset
  451. $_course = -1;
  452. }
  453. else
  454. {
  455. $_cid = $_SESSION['_cid' ];
  456. $_course = $_SESSION['_course'];
  457. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  458. //We select the last record for the current course in the course tracking table
  459. $sql="SELECT course_access_id FROM $course_tracking_table WHERE user_id='".$_user ['user_id']."' ORDER BY login_course_date DESC LIMIT 0,1";
  460. $result=api_sql_query($sql,__FILE__,__LINE__);
  461. $i_course_access_id = mysql_result($result,0,0);
  462. //We update the course tracking table
  463. $sql="UPDATE $course_tracking_table " .
  464. "SET logout_course_date = NOW(), " .
  465. "counter = counter+1 " .
  466. "WHERE course_access_id='$i_course_access_id'";
  467. api_sql_query($sql,__FILE__,__LINE__);
  468. }
  469. }
  470. //////////////////////////////////////////////////////////////////////////////
  471. // COURSE / USER REL. INIT
  472. //////////////////////////////////////////////////////////////////////////////
  473. if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) // session data refresh requested
  474. {
  475. if (isset($_user['user_id']) && $_user['user_id'] && isset($_cid) && $_cid) // have keys to search data
  476. {
  477. if(api_get_setting('use_session_mode') != 'true')
  478. {
  479. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  480. $sql = "SELECT * FROM $course_user_table
  481. WHERE `user_id` = '".$_user['user_id']."'
  482. AND `course_code` = '$cidReq'";
  483. $result = api_sql_query($sql,__FILE__,__LINE__);
  484. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  485. {
  486. $cuData = mysql_fetch_array($result);
  487. $is_courseMember = true;
  488. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  489. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  490. api_session_register('_courseUser');
  491. }
  492. else // this user has no status related to this course
  493. {
  494. $is_courseMember = false;
  495. $is_courseAdmin = false;
  496. $is_courseTutor = false;
  497. }
  498. $is_courseAdmin = (bool) ($is_courseAdmin || $is_platformAdmin);
  499. }
  500. else
  501. {
  502. $tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  503. $sql = "SELECT * FROM ".$tbl_course_user."
  504. WHERE `user_id` = '".$_user['user_id']."'
  505. AND `course_code` = '$cidReq'";
  506. $result = api_sql_query($sql,__FILE__,__LINE__);
  507. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  508. {
  509. $cuData = mysql_fetch_array($result);
  510. $_courseUser['role'] = $cuData['role' ];
  511. $is_courseMember = true;
  512. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  513. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  514. api_session_register('_courseUser');
  515. }
  516. else // this user has no status related to this course
  517. {
  518. // is it the session coach ?
  519. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  520. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  521. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  522. $sql = "SELECT 1
  523. FROM ".$tbl_session."
  524. INNER JOIN ".$tbl_session_course."
  525. ON session_rel_course.id_session = session.id
  526. AND session_rel_course.course_code='$_cid'
  527. WHERE session.id_coach = '".$_user['user_id']."'";
  528. $result = api_sql_query($sql,__FILE__,__LINE__);
  529. if($row = mysql_fetch_array($result)){
  530. $_courseUser['role'] = 'Professor';
  531. $is_courseMember = true;
  532. $is_courseTutor = true;
  533. $is_courseAdmin = true;
  534. api_session_register('_courseUser');
  535. }
  536. else
  537. {
  538. // vérifier que c pas le coach du cours
  539. $sql = "SELECT 1
  540. FROM ".$tbl_session_course."
  541. WHERE session_rel_course.course_code='$_cid'
  542. AND session_rel_course.id_coach = '".$_user['user_id']."'";
  543. $result = api_sql_query($sql,__FILE__,__LINE__);
  544. if($row = mysql_fetch_array($result))
  545. {
  546. $_courseUser['role'] = 'Professor';
  547. $is_courseMember = true;
  548. $is_courseTutor = true;
  549. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  550. $sql="SELECT status FROM ".$tbl_user." WHERE user_id = ".$_user['user_id']."";
  551. $result=api_sql_query($sql);
  552. if(mysql_result($result,0,0)==1){
  553. $is_courseAdmin = true;
  554. }
  555. else{
  556. $is_courseAdmin = false;
  557. }
  558. api_session_register('_courseUser');
  559. }
  560. else
  561. {
  562. // vérifier que c pas un élève de la session
  563. $sql = "SELECT * FROM ".$tbl_session_course_user."
  564. WHERE `id_user` = '".$_user['user_id']."'
  565. AND `course_code` = '$cidReq'";
  566. $result = api_sql_query($sql,__FILE__,__LINE__);
  567. if (mysql_num_rows($result) > 0) // this user have a recorded state for this course
  568. {
  569. while($row = mysql_fetch_array($result)){
  570. $is_courseMember = true;
  571. $is_courseTutor = false;
  572. $is_courseAdmin = false;
  573. api_session_register('_courseUser');
  574. }
  575. }
  576. }
  577. }
  578. }
  579. }
  580. }
  581. else // keys missing => not anymore in the course - user relation
  582. {
  583. //// course
  584. $is_courseMember = false;
  585. $is_courseAdmin = false;
  586. $is_courseTutor = false;
  587. api_session_unregister('_courseUser');
  588. }
  589. //DEPRECATED
  590. //$is_courseAllowed=($_cid && ($_course['visibility'] || $is_courseMember || $is_platformAdmin))?true:false;
  591. //NEW
  592. if (isset($_course))
  593. {
  594. if ($_course['visibility'] == COURSE_VISIBILITY_OPEN_WORLD)
  595. $is_allowed_in_course = true;
  596. elseif ($_course['visibility'] == COURSE_VISIBILITY_OPEN_PLATFORM && isset($_user['user_id']) )
  597. $is_allowed_in_course = true;
  598. elseif ($_course['visibility'] == COURSE_VISIBILITY_REGISTERED && ($is_platformAdmin || $is_courseMember))
  599. $is_allowed_in_course = true;
  600. elseif ($_course['visibility'] == COURSE_VISIBILITY_CLOSED && ($is_platformAdmin || $is_courseAdmin))
  601. $is_allowed_in_course = true;
  602. else $is_allowed_in_course = false;
  603. }
  604. // save the states
  605. api_session_register('is_courseMember');
  606. api_session_register('is_courseAdmin');
  607. //api_session_register('is_courseAllowed'); //deprecated old permission var
  608. api_session_register('is_courseTutor');
  609. api_session_register('is_allowed_in_course'); //new permission var
  610. }
  611. else // continue with the previous values
  612. {
  613. $_courseUser = $_SESSION ['_courseUser' ];
  614. $is_courseMember = $_SESSION ['is_courseMember' ];
  615. $is_courseAdmin = $_SESSION ['is_courseAdmin' ];
  616. //$is_courseAllowed = $_SESSION ['is_courseAllowed']; //deprecated
  617. $is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
  618. $is_courseTutor = $_SESSION ['is_courseTutor' ];
  619. }
  620. //////////////////////////////////////////////////////////////////////////////
  621. // GROUP INIT
  622. //////////////////////////////////////////////////////////////////////////////
  623. if ((isset($gidReset) && $gidReset) || (isset($cidReset) && $cidReset)) // session data refresh requested
  624. {
  625. if ($gidReq && $_cid ) // have keys to search data
  626. {
  627. $group_table = Database::get_course_table(TABLE_GROUP);
  628. $sql = "SELECT * FROM $group_table WHERE `id` = '$gidReq'";
  629. $result = api_sql_query($sql,__FILE__,__LINE__);
  630. if (mysql_num_rows($result) > 0) // This group has recorded status related to this course
  631. {
  632. $gpData = mysql_fetch_array($result);
  633. $_gid = $gpData ['id' ];
  634. api_session_register('_gid');
  635. }
  636. else
  637. {
  638. exit("WARNING UNDEFINED GID !! ");
  639. }
  640. }
  641. elseif(isset($_SESSION['_gid']) or isset($_gid)) // Keys missing => not anymore in the group - course relation
  642. {
  643. api_session_unregister('_gid');
  644. }
  645. }
  646. elseif(isset($_SESSION['_gid'])) // continue with the previous values
  647. {
  648. $_gid = $_SESSION ['_gid' ];
  649. }
  650. else
  651. { //if no previous value, assign caracteristic undefined value
  652. $_gid = -1;
  653. }
  654. if(isset($_cid))
  655. {
  656. $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
  657. $sql="UPDATE $tbl_course SET last_visit=NOW() WHERE code='$_cid'";
  658. api_sql_query($sql,__FILE__,__LINE__);
  659. }
  660. ?>