local.inc.php 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624
  1. <?php
  2. /** @deprecated */
  3. exit;
  4. /* For licensing terms, see /license.txt */
  5. /**
  6. *
  7. * SCRIPT PURPOSE
  8. *
  9. *
  10. * You can request a course id. It will check if the course Id requested is the
  11. * same as the current one. If it isn't it will update session information from
  12. * the database. You can also force the course reset if you want ($cidReset).
  13. *
  14. * All the course information is stored in the $_course array.
  15. *
  16. * You can request a group id. The script will check if the group id requested is the
  17. * same as the current one. If it isn't it will update session information from
  18. * the database. You can also force the course reset if you want ($gidReset).
  19. *
  20. * The course id is stored in $_cid session variable.
  21. * The group id is stored in $_gid session variable.
  22. *
  23. * @package chamilo.include
  24. */
  25. // verified if exists the username and password in session current
  26. use \ChamiloSession as Session;
  27. // Conditional login
  28. /*
  29. * Disabling for now
  30. if (isset($_SESSION['conditional_login']['uid']) && $_SESSION['conditional_login']['can_login']=== true) {
  31. $uData = UserManager::get_user_info_by_id($_SESSION['conditional_login']['uid']);
  32. ConditionalLogin::check_conditions($uData);
  33. $_user['user_id'] = $_SESSION['conditional_login']['uid'];
  34. $_user['status'] = $uData['status'];
  35. Session::write('_user', $_user);
  36. Session::erase('conditional_login');
  37. $uidReset=true;
  38. }*/
  39. // parameters passed via GET
  40. $gidReq = isset($_GET["gidReq"]) ? Database::escape_string($_GET["gidReq"]) : null;
  41. //this fixes some problems with generic functionalities like
  42. //My Agenda & What's New icons linking to courses
  43. // $cidReq can be set in the session
  44. $cidReq = isset($_SESSION['_cid']) ? Database::escape_string($_SESSION['_cid']) : null;
  45. // $cidReq can be set in URL-parameter
  46. $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $cidReq;
  47. $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
  48. // $cidReset can be set in URL-parameter
  49. $cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq'] != $_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
  50. // $gidReset can be set in URL-parameter
  51. $gidReset = isset($gidReset) ? $gidReset : '';
  52. // parameters passed via POST
  53. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  54. // register if the user is just logging in, in order to redirect him
  55. $logging_in = false;
  56. /* MAIN CODE */
  57. $errorMessage = null;
  58. $loginFailed = true;
  59. if (!empty($_SESSION['_user']['user_id']) && !$login) {
  60. // uid is in session => login already done, continue with this value
  61. $_user['user_id'] = $_SESSION['_user']['user_id'];
  62. //Check if we have to reset user data
  63. //This param can be used to reload user data if user has been logged by external script
  64. if (isset($_SESSION['_user']['uidReset']) && $_SESSION['_user']['uidReset']) {
  65. $uidReset = true;
  66. }
  67. } else {
  68. if (isset($_user['user_id'])) {
  69. unset($_user['user_id']);
  70. }
  71. //Platform legal terms and conditions
  72. if (api_get_setting('allow_terms_conditions') == 'true') {
  73. if (isset($_POST['login']) && isset($_POST['password']) && isset($_SESSION['term_and_condition']['user_id'])) {
  74. $user_id = $_SESSION['term_and_condition']['user_id']; // user id
  75. // Update the terms & conditions
  76. $legal_type = null;
  77. //verify type of terms and conditions
  78. if (isset($_POST['legal_info'])) {
  79. $info_legal = explode(':', $_POST['legal_info']);
  80. $legal_type = LegalManager::get_type_of_terms_and_conditions($info_legal[0], $info_legal[1]);
  81. }
  82. //is necessary verify check
  83. if ($legal_type == 1) {
  84. if ((isset($_POST['legal_accept']) && $_POST['legal_accept']=='1')) {
  85. $legal_option = true;
  86. } else {
  87. $legal_option = false;
  88. }
  89. }
  90. //no is check option
  91. if ($legal_type == 0) {
  92. $legal_option=true;
  93. }
  94. if (isset($_POST['legal_accept_type']) && $legal_option===true) {
  95. $cond_array = explode(':', $_POST['legal_accept_type']);
  96. if (!empty($cond_array[0]) && !empty($cond_array[1])){
  97. $time = time();
  98. $condition_to_save = intval($cond_array[0]).':'.intval($cond_array[1]).':'.$time;
  99. UserManager::update_extra_field_value($user_id,'legal_accept',$condition_to_save);
  100. }
  101. }
  102. }
  103. }
  104. //IF cas is activated and user isn't logged in
  105. if (api_get_setting('cas_activate') == 'true') {
  106. $cas_activated = true;
  107. } else {
  108. $cas_activated = false;
  109. }
  110. $cas_login = false;
  111. if ($cas_activated AND !isset($_user['user_id']) AND !isset($_POST['login'])) {
  112. require_once api_get_path(SYS_PATH).'main/auth/cas/authcas.php';
  113. $cas_login = cas_is_authenticated();
  114. }
  115. if ((isset($_POST['login']) AND isset($_POST['password']) ) OR ($cas_login)) {
  116. // $login && $password are given to log in
  117. if ( $cas_login && empty($_POST['login']) ) {
  118. $login = $cas_login;
  119. } else {
  120. $login = $_POST['login'];
  121. $password = $_POST['password'];
  122. }
  123. //Lookup the user in the main database
  124. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  125. $sql = "SELECT user_id, username, auth_source, password FROM $user_table
  126. WHERE username = '".Database::escape_string($login)."'";
  127. $result = Database::query($sql);
  128. // @todo use a UserProvider
  129. if (Database::num_rows($result) > 0) {
  130. $uData = Database::fetch_array($result);
  131. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE || $uData['auth_source'] == CAS_AUTH_SOURCE) {
  132. //The authentification of this user is managed by Chamilo itself
  133. $password = api_get_encrypted_password(trim(stripslashes($password)));
  134. // Check the user's password
  135. if (($password == $uData['password'] or $cas_login) and (trim($login) == $uData['username'])) {
  136. $uData = api_get_user_info($uData['user_id'], false, false, true);
  137. $extraFields = $uData['extra_fields'];
  138. // $update_type = UserManager::get_extra_user_data_by_field($uData['user_id'], 'update_type');
  139. $update_type = isset($extraFields['extra_update_type']) ? $extraFields['extra_update_type'] : null;
  140. if (!empty($extAuthSource[$update_type]['updateUser']) && file_exists($extAuthSource[$update_type]['updateUser'])) {
  141. include_once $extAuthSource[$update_type]['updateUser'];
  142. }
  143. // Check if the account is active (not locked)
  144. if ($uData['active'] == '1') {
  145. // Check if the expiration date has not been reached
  146. if ($uData['expiration_date'] > date('Y-m-d H:i:s') OR $uData['expiration_date'] == '0000-00-00 00:00:00') {
  147. global $_configuration;
  148. if (isset($_configuration['multiple_access_urls']) && $_configuration['multiple_access_urls']) {
  149. //Check if user is an admin
  150. $my_user_is_admin = UserManager::is_admin($uData['user_id']);
  151. // This user is subscribed in these sites => $my_url_list
  152. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  153. //Check the access_url configuration setting if the user is registered in the access_url_rel_user table
  154. //Getting the current access_url_id of the platform
  155. $current_access_url_id = api_get_current_access_url_id();
  156. if ($my_user_is_admin === false) {
  157. if (is_array($my_url_list) && count($my_url_list) > 0) {
  158. // the user have the permissions to enter at this site
  159. if (in_array($current_access_url_id, $my_url_list)) {
  160. ConditionalLogin::check_conditions($uData);
  161. Session::write('_user', $uData);
  162. $logging_in = true;
  163. } else {
  164. $loginFailed = true;
  165. Session::erase('_uid');
  166. $errorMessage = 'access_url_inactive';
  167. }
  168. } else {
  169. $loginFailed = true;
  170. Session::erase('_uid');
  171. $errorMessage = 'access_url_inactive';
  172. }
  173. } else {
  174. //Only admins of the "main" (first) Chamilo portal can login wherever they want
  175. //Check if this admin have the access_url_id = 1 which means the principal
  176. if (in_array(1, $my_url_list)) {
  177. ConditionalLogin::check_conditions($uData);
  178. Session::write('_user', $uData);
  179. } else {
  180. //This means a secondary admin wants to login so we check as he's a normal user
  181. if (in_array($current_access_url_id, $my_url_list)) {
  182. Session::write('_user', $uData);
  183. } else {
  184. $loginFailed = true;
  185. Session::erase('_uid');
  186. $errorMessage = 'access_url_inactive';
  187. }
  188. }
  189. }
  190. } else {
  191. ConditionalLogin::check_conditions($uData);
  192. Session::write('_user', $uData);
  193. $logging_in = true;
  194. }
  195. } else {
  196. $loginFailed = true;
  197. Session::erase('_uid');
  198. $errorMessage = 'account_expired';
  199. }
  200. } else {
  201. $loginFailed = true;
  202. Session::erase('_uid');
  203. $errorMessage = 'account_inactive';
  204. }
  205. } else {
  206. // login failed: username or password incorrect
  207. $loginFailed = true;
  208. Session::erase('_uid');
  209. $errorMessage = 'user_password_incorrect';
  210. }
  211. if (isset($uData['creator_id']) && isset($_user) && $_user['user_id'] != $uData['creator_id']) {
  212. //first login for a not self registred
  213. //e.g. registered by a teacher
  214. //do nothing (code may be added later)
  215. }
  216. } elseif (!empty($extAuthSource[$uData['auth_source']]['login']) && file_exists($extAuthSource[$uData['auth_source']]['login'])) {
  217. /*
  218. * Process external authentication
  219. * on the basis of the given login name
  220. */
  221. $loginFailed = true; // Default initialisation. It could
  222. // change after the external authentication
  223. $key = $uData['auth_source']; //'ldap','shibboleth'...
  224. /* >>>>>>>> External authentication modules <<<<<<<<< */
  225. // see configuration.php to define these
  226. include_once($extAuthSource[$key]['login']);
  227. /* >>>>>>>> External authentication modules <<<<<<<<< */
  228. } else { // no standard Chamilo login - try external authentification
  229. //huh... nothing to do... we shouldn't get here
  230. error_log('Chamilo Authentication file '. $extAuthSource[$uData['auth_source']]['login']. ' could not be found - this might prevent your system from doing the corresponding authentication process',0);
  231. }
  232. } else {
  233. // login failed, Database::num_rows($result) <= 0
  234. $loginFailed = true; // Default initialisation. It could
  235. // change after the external authentication
  236. /*
  237. * In this section:
  238. * there is no entry for the $login user in the Chamilo
  239. * database. This also means there is no auth_source for the user.
  240. * We let all external procedures attempt to add him/her
  241. * to the system.
  242. *
  243. * Process external login on the basis
  244. * of the authentication source list
  245. * provided by the configuration settings.
  246. * If the login succeeds, for going further,
  247. * Chamilo needs the $_user['user_id'] variable to be
  248. * set and registered in the session. It's the
  249. * responsability of the external login script
  250. * to provide this $_user['user_id'].
  251. */
  252. if (isset($extAuthSource) && is_array($extAuthSource)) {
  253. foreach($extAuthSource as $thisAuthSource) {
  254. if (!empty($thisAuthSource['newUser']) && file_exists($thisAuthSource['newUser'])) {
  255. include_once($thisAuthSource['newUser']);
  256. } else {
  257. error_log('Chamilo Authentication file '. $thisAuthSource['newUser']. ' could not be found - this might prevent your system from using the authentication process in the user creation process',0);
  258. }
  259. }
  260. } //end if is_array($extAuthSource)
  261. if ($loginFailed) { //If we are here username given is wrong
  262. //header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
  263. $errorMessage = 'user_password_incorrect';
  264. }
  265. } //end else login failed
  266. } elseif (api_get_setting('sso_authentication') === 'true' && !in_array('webservices', explode('/', $_SERVER['REQUEST_URI']))) {
  267. /**
  268. * TODO:
  269. * - Work on a better validation for webservices paths. Current is very poor and exit
  270. */
  271. $subsso = api_get_setting('sso_authentication_subclass');
  272. if (!empty($subsso)) {
  273. require_once api_get_path(SYS_CODE_PATH).'auth/sso/sso.'.$subsso.'.class.php';
  274. $subsso = 'sso'.$subsso;
  275. $osso = new $subsso(); //load the subclass
  276. } else {
  277. $osso = new sso();
  278. }
  279. if (isset($_SESSION['_user']['user_id'])) {
  280. } else {
  281. // Handle cookie comming from Master Server
  282. if (!isset($_GET['sso_referer']) && !isset($_GET['loginFailed']) && isset($_GET['sso_cookie'])) {
  283. // Redirect to master server
  284. $osso->ask_master();
  285. } elseif (isset($_GET['sso_cookie'])) {
  286. // Here we are going to check the origin of
  287. // what the call says should be used for
  288. // authentication, and ensure we know it
  289. $matches_domain = false;
  290. if (isset($_GET['sso_referer'])) {
  291. $protocol = api_get_setting('sso_authentication_protocol');
  292. // sso_authentication_domain can list
  293. // several, comma-separated, domains
  294. $master_urls = split(',',api_get_setting('sso_authentication_domain'));
  295. if (!empty($master_urls)) {
  296. $master_auth_uri = api_get_setting('sso_authentication_auth_uri');
  297. foreach ($master_urls as $mu) {
  298. if (empty($mu)) { continue; }
  299. // for each URL, check until we find *one* that matches the $_GET['sso_referer'], then skip the rest
  300. if ($protocol.trim($mu).$master_auth_uri === $_GET['sso_referer']) {
  301. $matches_domain = true;
  302. break;
  303. }
  304. }
  305. } else {
  306. error_log('Your sso_authentication_master param is empty. Check the platform configuration, security section. It can be a list of comma-separated domains');
  307. }
  308. }
  309. if ($matches_domain) {
  310. //make all the process of checking
  311. //if the user exists (delegated to the sso class)
  312. $osso->check_user();
  313. } else {
  314. error_log('Check the sso_referer URL in your script, it doesn\'t match any of the possibilities');
  315. //Request comes from unknown source
  316. $loginFailed = true;
  317. Session::erase('_uid');
  318. $errorMessage = 'unrecognize_sso_origin';
  319. }
  320. }
  321. }//end logout ... else ... login
  322. } elseif (api_get_setting('openid_authentication') == 'true') {
  323. if (!empty($_POST['openid_url'])) {
  324. include api_get_path(SYS_CODE_PATH).'auth/openid/login.php';
  325. openid_begin(trim($_POST['openid_url']), api_get_path(WEB_PATH).'index.php');
  326. //this last function should trigger a redirect, so we can die here safely
  327. die('Openid login redirection should be in progress');
  328. } elseif (!empty($_GET['openid_identity'])) {
  329. //it's usual for PHP to replace '.' (dot) by '_' (underscore) in URL parameters
  330. include(api_get_path(SYS_CODE_PATH).'auth/openid/login.php');
  331. $res = openid_complete($_GET);
  332. if ($res['status'] == 'success') {
  333. $id1 = Database::escape_string($res['openid.identity']);
  334. //have another id with or without the final '/'
  335. $id2 = (substr($id1,-1,1)=='/'?substr($id1,0,-1):$id1.'/');
  336. //lookup the user in the main database
  337. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  338. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  339. FROM $user_table
  340. WHERE openid = '$id1'
  341. OR openid = '$id2' ";
  342. $result = Database::query($sql);
  343. if ($result !== false) {
  344. if (Database::num_rows($result)>0) {
  345. //$row = Database::fetch_array($res);
  346. $uData = Database::fetch_array($result);
  347. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  348. // the authentification of this user is managed by Chamilo itself
  349. // check if the account is active (not locked)
  350. if ($uData['active']=='1') {
  351. // check if the expiration date has not been reached
  352. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  353. $_user['user_id'] = $uData['user_id'];
  354. $_user['status'] = $uData['status'];
  355. Session::write('_user', $_user);
  356. } else {
  357. $loginFailed = true;
  358. Session::erase('_uid');
  359. $errorMessage = 'account_expired';
  360. }
  361. } else {
  362. $loginFailed = true;
  363. Session::erase('_uid');
  364. $errorMessage = 'account_inactive';
  365. }
  366. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id']) {
  367. //first login for a not self registred
  368. //e.g. registered by a teacher
  369. //do nothing (code may be added later)
  370. }
  371. }
  372. } else {
  373. //Redirect to the subscription form
  374. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php?username='.$res['openid.sreg.nickname'].'&email='.$res['openid.sreg.email'].'&openid='.$res['openid.identity'].'&openid_msg=idnotfound');
  375. //$loginFailed = true;
  376. }
  377. } else {
  378. $loginFailed = true;
  379. }
  380. } else {
  381. $loginFailed = true;
  382. }
  383. }
  384. } elseif (KeyAuth::is_enabled()) {
  385. $success = KeyAuth::instance()->login();
  386. if ($success) {
  387. $use_anonymous = false;
  388. }
  389. }
  390. $uidReset = true;
  391. } // end
  392. if ($loginFailed == true && !empty($errorMessage)) {
  393. header('Location: '.api_get_path(WEB_PUBLIC_PATH).'index?error='.$errorMessage);
  394. exit;
  395. }
  396. //Now check for anonymous user mode
  397. if (isset($use_anonymous) && $use_anonymous) {
  398. //if anonymous mode is set, then try to set the current user as anonymous
  399. //if he doesn't have a login yet
  400. api_set_anonymous();
  401. } else {
  402. //if anonymous mode is not set, then check if this user is anonymous. If it
  403. //is, clean it from being anonymous (make him a nobody :-))
  404. api_clear_anonymous();
  405. }
  406. // if the requested course is different from the course in session
  407. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid']))) {
  408. $cidReset = true;
  409. $gidReset = true; // As groups depend from courses, group id is reset
  410. }
  411. // Setting app user variable
  412. $_user = Session::read('_user');
  413. if ($_user && !isset($_user['complete_name'])) {
  414. $_user = api_get_user_info(api_get_user_id(), false, false, true);
  415. Session::write('_user', $_user);
  416. }
  417. $app['current_user'] = $_user;
  418. /* USER INIT */
  419. if (isset($uidReset) && $uidReset) { // session data refresh requested
  420. unset($_SESSION['_user']['uidReset']);
  421. $is_platformAdmin = false;
  422. $is_allowedCreateCourse = false;
  423. if (isset($_user['user_id']) && $_user['user_id'] && !api_is_anonymous()) {
  424. // a uid is given (log in succeeded)
  425. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  426. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  427. $track_e_login = Database::get_main_table(TABLE_STATISTIC_TRACK_E_LOGIN);
  428. $sql = "SELECT user.*, a.user_id is_admin, login.login_date
  429. FROM $user_table
  430. LEFT JOIN $admin_table a
  431. ON user.user_id = a.user_id
  432. LEFT JOIN $track_e_login login
  433. ON user.user_id = login.login_user_id
  434. WHERE user.user_id = '".$_user['user_id']."'
  435. ORDER BY login.login_date DESC LIMIT 1";
  436. $result = Database::query($sql);
  437. if (Database::num_rows($result) > 0) {
  438. // Extracting the user data
  439. $uData = Database::fetch_array($result);
  440. $_user = api_format_user($uData, false);
  441. $_user['lastLogin'] = api_strtotime($uData['login_date'], 'UTC');
  442. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  443. $is_allowedCreateCourse = (bool) (($uData ['status'] == COURSEMANAGER) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == DRH));
  444. ConditionalLogin::check_conditions($uData);
  445. Session::write('_user', $_user);
  446. UserManager::update_extra_field_value($_user['user_id'], 'already_logged_in', 'true');
  447. Session::write('is_platformAdmin', $is_platformAdmin);
  448. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  449. } else {
  450. header('location:'.api_get_path(WEB_PATH));
  451. exit;
  452. }
  453. } else { // no uid => logout or Anonymous
  454. Session::erase('_user');
  455. Session::erase('_uid');
  456. }
  457. Session::write('is_platformAdmin', $is_platformAdmin);
  458. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  459. } else { // continue with the previous values
  460. $_user = isset($_SESSION['_user']) ? $_SESSION['_user'] : null;
  461. $is_platformAdmin = isset($_SESSION['is_platformAdmin']) ? $_SESSION['is_platformAdmin'] : false;
  462. $is_allowedCreateCourse = isset($_SESSION['is_allowedCreateCourse']) ? $_SESSION['is_allowedCreateCourse'] : false;
  463. }
  464. if (!isset($_SESSION['login_as'])) {
  465. $save_course_access = true;
  466. //The value $_dont_save_user_course_access should be added before the call of global.inc.php see the main/inc/chat.ajax.php file
  467. //Disables the updates in the TRACK_E_COURSE_ACCESS table
  468. if (isset($_dont_save_user_course_access) && $_dont_save_user_course_access == true) {
  469. $save_course_access = false;
  470. }
  471. if ($save_course_access) {
  472. $course_tracking_table = Database :: get_main_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  473. /*
  474. * When $_configuration['session_lifetime'] is too big 100 hours (in order to let users take exercises with no problems)
  475. * the function Tracking::get_time_spent_on_the_course() returns big values (200h) due the condition:
  476. * login_course_date > now() - INTERVAL $session_lifetime SECOND
  477. *
  478. */
  479. /*
  480. if (isset($_configuration['session_lifetime'])) {
  481. $session_lifetime = $_configuration['session_lifetime'];
  482. } else {
  483. $session_lifetime = 3600; // 1 hour
  484. }*/
  485. $session_lifetime = 3600; // 1 hour
  486. $course_code = api_get_course_id();
  487. $courseId = api_get_course_int_id();
  488. $time = api_get_datetime();
  489. if (isset($_user['user_id']) && !empty($_user['user_id']) && !empty($courseId)) {
  490. //We select the last record for the current course in the course tracking table
  491. //But only if the login date is < than now + max_life_time
  492. $sql = "SELECT course_access_id FROM $course_tracking_table
  493. WHERE user_id = ".intval($_user ['user_id'])." AND
  494. c_id = '$courseId' AND
  495. session_id = ".api_get_session_id()." AND
  496. login_course_date > now() - INTERVAL $session_lifetime SECOND
  497. ORDER BY login_course_date DESC LIMIT 0,1";
  498. $result = Database::query($sql);
  499. if (Database::num_rows($result) > 0) {
  500. $i_course_access_id = Database::result($result,0,0);
  501. //We update the course tracking table
  502. $sql = "UPDATE $course_tracking_table SET logout_course_date = '$time', counter = counter+1
  503. WHERE course_access_id = ".intval($i_course_access_id)." AND session_id = ".api_get_session_id();
  504. Database::query($sql);
  505. } else {
  506. $sql="INSERT INTO $course_tracking_table (c_id, user_id, login_course_date, logout_course_date, counter, session_id)" .
  507. "VALUES('".$courseId."', '".$_user['user_id']."', '$time', '$time', '1','".api_get_session_id()."')";
  508. Database::query($sql);
  509. }
  510. }
  511. }
  512. }
  513. /* COURSE / USER REL. INIT */
  514. $user_id = isset($_user['user_id']) ? $_user['user_id'] : null;
  515. //Course permissions
  516. $is_courseAdmin = false; //course teacher
  517. $is_courseTutor = false; //course teacher - some rights
  518. $is_courseMember = false; //course student
  519. $is_courseCoach = false; //course coach
  520. //Course - User permissions
  521. $is_sessionAdmin = false;
  522. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  523. //set variable according to student_view_enabled choices
  524. if (api_get_setting('student_view_enabled') == "true") {
  525. if (isset($_GET['isStudentView'])) {
  526. if ($_GET['isStudentView'] == 'true') {
  527. if (isset($_SESSION['studentview'])) {
  528. if (!empty($_SESSION['studentview'])) {
  529. // switching to studentview
  530. $_SESSION['studentview'] = 'studentview';
  531. }
  532. }
  533. } elseif ($_GET['isStudentView'] == 'false') {
  534. if (isset($_SESSION['studentview'])) {
  535. if (!empty($_SESSION['studentview'])) {
  536. // switching to teacherview
  537. $_SESSION['studentview'] = 'teacherview';
  538. }
  539. }
  540. }
  541. } elseif (!empty($_SESSION['studentview'])) {
  542. //all is fine, no change to that, obviously
  543. } elseif (empty($_SESSION['studentview'])) {
  544. // We are in teacherview here
  545. $_SESSION['studentview'] = 'teacherview';
  546. }
  547. }
  548. //Redirect::session_request_uri($logging_in, $user_id);