login.lib.php 37 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815
  1. <?php
  2. use ChamiloSession as Session;
  3. /* For licensing terms, see /license.txt */
  4. /**
  5. * Code library for login process
  6. *
  7. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  8. * @author Julio Montoya <gugli100@gmail.com>
  9. * @package chamilo.login
  10. */
  11. /**
  12. * Class
  13. * @package chamilo.login
  14. */
  15. class Login
  16. {
  17. /**
  18. * Get user account list
  19. *
  20. * @param array $user array with keys: email, password, uid, loginName
  21. * @param boolean $reset
  22. * @param boolean $by_username
  23. * @return unknown
  24. */
  25. public static function get_user_account_list($user, $reset = false, $by_username = false)
  26. {
  27. $portal_url = api_get_path(WEB_PATH);
  28. if (api_is_multiple_url_enabled()) {
  29. $access_url_id = api_get_current_access_url_id();
  30. if ($access_url_id != -1) {
  31. $url = api_get_access_url($access_url_id);
  32. $portal_url = $url['url'];
  33. }
  34. }
  35. if ($reset) {
  36. if ($by_username) {
  37. $secret_word = self::get_secret_word($user['email']);
  38. if ($reset) {
  39. $reset_link = $portal_url . "main/auth/lostPassword.php?reset=" . $secret_word . "&id=" . $user['uid'];
  40. } else {
  41. $reset_link = get_lang('Pass') . " : $user[password]";
  42. }
  43. $user_account_list = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $user['loginName'] . "\n" . get_lang('ResetLink') . ' : ' . $reset_link . '';
  44. if ($user_account_list) {
  45. $user_account_list = "\n-----------------------------------------------\n" . $user_account_list;
  46. }
  47. } else {
  48. foreach ($user as $this_user) {
  49. $secret_word = self::get_secret_word($this_user['email']);
  50. if ($reset) {
  51. $reset_link = $portal_url . "main/auth/lostPassword.php?reset=" . $secret_word . "&id=" . $this_user['uid'];
  52. } else {
  53. $reset_link = get_lang('Pass') . " : $this_user[password]";
  54. }
  55. $user_account_list[] = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $this_user['loginName'] . "\n" . get_lang('ResetLink') . ' : ' . $reset_link . '';
  56. }
  57. if ($user_account_list) {
  58. $user_account_list = implode("\n-----------------------------------------------\n", $user_account_list);
  59. }
  60. }
  61. } else {
  62. if (!$by_username) {
  63. $user = $user[0];
  64. }
  65. $reset_link = get_lang('Pass') . " : $user[password]";
  66. $user_account_list = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $user['loginName'] . "\n" . $reset_link . '';
  67. }
  68. return $user_account_list;
  69. }
  70. /**
  71. * This function sends the actual password to the user
  72. *
  73. * @param int $user
  74. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  75. */
  76. public static function send_password_to_user($user, $by_username = false)
  77. {
  78. $email_subject = "[" . api_get_setting('siteName') . "] " . get_lang('LoginRequest'); // SUBJECT
  79. if ($by_username) { // Show only for lost password
  80. $user_account_list = self::get_user_account_list($user, false, $by_username); // BODY
  81. $email_to = $user['email'];
  82. } else {
  83. $user_account_list = self::get_user_account_list($user); // BODY
  84. $email_to = $user[0]['email'];
  85. }
  86. $portal_url = api_get_path(WEB_PATH);
  87. if (api_is_multiple_url_enabled()) {
  88. $access_url_id = api_get_current_access_url_id();
  89. if ($access_url_id != -1) {
  90. $url = api_get_access_url($access_url_id);
  91. $portal_url = $url['url'];
  92. }
  93. }
  94. $email_body = get_lang('YourAccountParam') . " " . $portal_url . "\n\n$user_account_list";
  95. // SEND MESSAGE
  96. $sender_name = api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname'), null, PERSON_NAME_EMAIL_ADDRESS);
  97. $email_admin = api_get_setting('emailAdministrator');
  98. if (api_mail_html('', $email_to, $email_subject, $email_body, $sender_name, $email_admin) == 1) {
  99. return get_lang('YourPasswordHasBeenReset');
  100. } else {
  101. $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));
  102. return sprintf(get_lang('ThisPlatformWasUnableToSendTheEmailPleaseContactXForMoreInformation'), $admin_email);
  103. }
  104. }
  105. /**
  106. * Handle encrypted password, send an email to a user with his password
  107. *
  108. * @param int user id
  109. * @param bool $by_username
  110. *
  111. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  112. */
  113. public static function handle_encrypted_password($user, $by_username = false) {
  114. $email_subject = "[" . api_get_setting('siteName') . "] " . get_lang('LoginRequest'); // SUBJECT
  115. if ($by_username) { // Show only for lost password
  116. $user_account_list = self::get_user_account_list($user, true, $by_username); // BODY
  117. $email_to = $user['email'];
  118. } else {
  119. $user_account_list = self::get_user_account_list($user, true); // BODY
  120. $email_to = $user[0]['email'];
  121. }
  122. $email_body = get_lang('DearUser') . " :\n" . get_lang('password_request') . "\n";
  123. $email_body .= $user_account_list . "\n-----------------------------------------------\n\n";
  124. $email_body .= get_lang('PasswordEncryptedForSecurity');
  125. $email_body .= "\n\n" . get_lang('SignatureFormula') . ",\n" . api_get_setting('administratorName') . " " . api_get_setting('administratorSurname') . "\n" . get_lang('PlataformAdmin') . " - " . api_get_setting('siteName');
  126. $sender_name = api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname'), null, PERSON_NAME_EMAIL_ADDRESS);
  127. $email_admin = api_get_setting('emailAdministrator');
  128. if (@api_mail_html('', $email_to, $email_subject, $email_body, $sender_name, $email_admin) == 1) {
  129. if (CustomPages::enabled()) {
  130. return get_lang('YourPasswordHasBeenEmailed');
  131. } else {
  132. Display::display_confirmation_message(get_lang('YourPasswordHasBeenEmailed'));
  133. }
  134. } else {
  135. $admin_email = Display :: encrypted_mailto_link(api_get_setting('emailAdministrator'), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname')));
  136. $message = sprintf(get_lang('ThisPlatformWasUnableToSendTheEmailPleaseContactXForMoreInformation'), $admin_email);
  137. if (CustomPages::enabled()) {
  138. return $message;
  139. } else {
  140. Display::display_error_message($message, false);
  141. }
  142. }
  143. }
  144. /**
  145. * Gets the secret word
  146. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  147. */
  148. public static function get_secret_word($add)
  149. {
  150. return $secret_word = sha1($add);
  151. }
  152. /**
  153. * Resets a password
  154. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  155. */
  156. public static function reset_password($secret, $id, $by_username = false)
  157. {
  158. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  159. $id = intval($id);
  160. $sql = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, username AS loginName, password, email FROM " . $tbl_user . " WHERE user_id=$id";
  161. $result = Database::query($sql);
  162. $num_rows = Database::num_rows($result);
  163. if ($result && $num_rows > 0) {
  164. $user = Database::fetch_array($result);
  165. } else {
  166. return get_lang('CouldNotResetPassword');
  167. }
  168. if (self::get_secret_word($user['email']) == $secret) {
  169. // OK, secret word is good. Now change password and mail it.
  170. $user['password'] = api_generate_password();
  171. $crypted = api_get_encrypted_password($user['password']);
  172. $sql = "UPDATE " . $tbl_user . " SET password='$crypted' WHERE user_id = $id";
  173. Database::query($sql);
  174. return self::send_password_to_user($user, $by_username);
  175. } else {
  176. return get_lang('NotAllowed');
  177. }
  178. }
  179. /**
  180. *
  181. * @global bool $is_platformAdmin
  182. * @global bool $is_allowedCreateCourse
  183. * @global object $_user
  184. */
  185. public static function init_user($user_id, $reset)
  186. {
  187. global $is_platformAdmin;
  188. global $is_allowedCreateCourse;
  189. global $_user;
  190. if (isset($reset) && $reset) { // session data refresh requested
  191. unset($_SESSION['_user']['uidReset']);
  192. $is_platformAdmin = false;
  193. $is_allowedCreateCourse = false;
  194. $_user['user_id'] = $user_id;
  195. if (isset($_user['user_id']) && $_user['user_id'] && !api_is_anonymous()) {
  196. // a uid is given (log in succeeded)
  197. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  198. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  199. $track_e_login = Database::get_main_table(TABLE_STATISTIC_TRACK_E_LOGIN);
  200. $sql = "SELECT user.*, a.user_id is_admin, UNIX_TIMESTAMP(login.login_date) login_date
  201. FROM $user_table
  202. LEFT JOIN $admin_table a
  203. ON user.user_id = a.user_id
  204. LEFT JOIN $track_e_login login
  205. ON user.user_id = login.login_user_id
  206. WHERE user.user_id = '" . $_user['user_id'] . "'
  207. ORDER BY login.login_date DESC LIMIT 1";
  208. $result = Database::query($sql);
  209. if (Database::num_rows($result) > 0) {
  210. // Extracting the user data
  211. $uData = Database::fetch_array($result);
  212. $_user['firstName'] = $uData['firstname'];
  213. $_user['lastName'] = $uData['lastname'];
  214. $_user['mail'] = $uData['email'];
  215. $_user['lastLogin'] = $uData['login_date'];
  216. $_user['official_code'] = $uData['official_code'];
  217. $_user['picture_uri'] = $uData['picture_uri'];
  218. $_user['user_id'] = $uData['user_id'];
  219. $_user['language'] = $uData['language'];
  220. $_user['auth_source'] = $uData['auth_source'];
  221. $_user['theme'] = $uData['theme'];
  222. $_user['status'] = $uData['status'];
  223. $is_platformAdmin = (bool) (!is_null($uData['is_admin']));
  224. $is_allowedCreateCourse = (bool) (($uData ['status'] == 1) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == 4));
  225. ConditionalLogin::check_conditions($uData);
  226. Session::write('_user', $_user);
  227. UserManager::update_extra_field_value($_user['user_id'], 'already_logged_in', 'true');
  228. Session::write('is_platformAdmin', $is_platformAdmin);
  229. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  230. //
  231. //
  232. // // If request_uri is setted we have to go further to have course permissions
  233. // if (empty($_SESSION['request_uri']) || !isset($_SESSION['request_uri'])) {
  234. // if (isset($_SESSION['noredirection'])) {
  235. // //If we just want to reset info without redirecting user
  236. // unset($_SESSION['noredirection']);
  237. // } else {
  238. // LoginRedirection::redirect();
  239. // }
  240. // }
  241. } else {
  242. header('location:' . api_get_path(WEB_PATH));
  243. //exit("WARNING UNDEFINED UID !! ");
  244. }
  245. } else { // no uid => logout or Anonymous
  246. Session::erase('_user');
  247. Session::erase('_uid');
  248. }
  249. Session::write('is_platformAdmin', $is_platformAdmin);
  250. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  251. } else { // continue with the previous values
  252. $_user = $_SESSION['_user'];
  253. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  254. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  255. }
  256. }
  257. /**
  258. *
  259. * @global bool $is_platformAdmin
  260. * @global bool $is_allowedCreateCourse
  261. * @global object $_user
  262. * @global int $_cid
  263. * @global array $_course
  264. * @global type $_real_cid
  265. * @global type $_courseUser
  266. * @global type $is_courseAdmin
  267. * @global type $is_courseTutor
  268. * @global type $is_courseCoach
  269. * @global type $is_courseMember
  270. * @global type $is_sessionAdmin
  271. * @global type $is_allowed_in_course
  272. *
  273. * @param type $course_id
  274. * @param type $reset
  275. */
  276. static function init_course($course_id, $reset)
  277. {
  278. global $_configuration;
  279. global $is_platformAdmin;
  280. global $is_allowedCreateCourse;
  281. global $_user;
  282. global $_cid;
  283. global $_course;
  284. global $_real_cid;
  285. global $is_courseAdmin; //course teacher
  286. global $is_courseTutor; //course teacher - some rights
  287. global $is_courseCoach; //course coach
  288. global $is_courseMember; //course student
  289. global $is_sessionAdmin;
  290. global $is_allowed_in_course;
  291. if ($reset) {
  292. // Course session data refresh requested or empty data
  293. if ($course_id) {
  294. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  295. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  296. $sql = "SELECT course.*, course_category.code faCode, course_category.name faName
  297. FROM $course_table
  298. LEFT JOIN $course_cat_table
  299. ON course.category_code = course_category.code
  300. WHERE course.code = '$course_id'";
  301. $result = Database::query($sql);
  302. if (Database::num_rows($result) > 0) {
  303. $course_data = Database::fetch_array($result);
  304. //@TODO real_cid should be cid, for working with numeric course id
  305. $_real_cid = $course_data['id'];
  306. $_cid = $course_data['code'];
  307. $_course = array();
  308. $_course['real_id'] = $course_data['id'];
  309. $_course['id'] = $course_data['code']; //auto-assigned integer
  310. $_course['code'] = $course_data['code'];
  311. $_course['name'] = $course_data['title'];
  312. $_course['title'] = $course_data['title'];
  313. $_course['official_code'] = $course_data['visual_code']; // use in echo
  314. $_course['sysCode'] = $course_data['code']; // use as key in db
  315. $_course['path'] = $course_data['directory']; // use as key in path
  316. $_course['dbName'] = $course_data['db_name']; // use as key in db list
  317. $_course['db_name'] = $course_data['db_name']; // not needed in Chamilo 1.9
  318. $_course['titular'] = $course_data['tutor_name']; // this should be deprecated and use the table course_rel_user
  319. $_course['language'] = $course_data['course_language'];
  320. $_course['extLink']['url'] = $course_data['department_url'];
  321. $_course['extLink']['name'] = $course_data['department_name'];
  322. $_course['categoryCode'] = $course_data['faCode'];
  323. $_course['categoryName'] = $course_data['faName'];
  324. $_course['visibility'] = $course_data['visibility'];
  325. $_course['subscribe_allowed'] = $course_data['subscribe'];
  326. $_course['unsubscribe'] = $course_data['unsubscribe'];
  327. $_course['activate_legal'] = $course_data['activate_legal'];
  328. $_course['show_score'] = $course_data['show_score']; //used in the work tool
  329. Session::write('_cid', $_cid);
  330. Session::write('_course', $_course);
  331. //@TODO real_cid should be cid, for working with numeric course id
  332. Session::write('_real_cid', $_real_cid);
  333. // if a session id has been given in url, we store the session
  334. // Database Table Definitions
  335. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  336. if (!empty($_GET['id_session'])) {
  337. $_SESSION['id_session'] = intval($_GET['id_session']);
  338. $sql = 'SELECT name FROM ' . $tbl_session . ' WHERE id="' . intval($_SESSION['id_session']) . '"';
  339. $rs = Database::query($sql);
  340. list($_SESSION['session_name']) = Database::fetch_array($rs);
  341. } else {
  342. Session::erase('session_name');
  343. Session::erase('id_session');
  344. }
  345. if (!isset($_SESSION['login_as'])) {
  346. //Course login
  347. if (isset($_user['user_id'])) {
  348. Event::event_course_login(api_get_course_int_id(), $_user['user_id'], api_get_session_id());
  349. }
  350. }
  351. } else {
  352. //exit("WARNING UNDEFINED CID !! ");
  353. header('location:' . api_get_path(WEB_PATH));
  354. }
  355. } else {
  356. Session::erase('_cid');
  357. Session::erase('_real_cid');
  358. Session::erase('_course');
  359. if (!empty($_SESSION)) {
  360. foreach ($_SESSION as $key => $session_item) {
  361. if (strpos($key, 'lp_autolunch_') === false) {
  362. continue;
  363. } else {
  364. if (isset($_SESSION[$key])) {
  365. Session::erase($key);
  366. }
  367. }
  368. }
  369. }
  370. //Deleting session info
  371. if (api_get_session_id()) {
  372. Session::erase('id_session');
  373. Session::erase('session_name');
  374. }
  375. }
  376. } else {
  377. // Continue with the previous values
  378. if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
  379. $_cid = -1; //set default values that will be caracteristic of being unset
  380. $_course = -1;
  381. } else {
  382. $_cid = $_SESSION['_cid'];
  383. $_course = $_SESSION['_course'];
  384. // these lines are usefull for tracking. Indeed we can have lost the id_session and not the cid.
  385. // Moreover, if we want to track a course with another session it can be usefull
  386. if (!empty($_GET['id_session'])) {
  387. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  388. $sql = 'SELECT name FROM ' . $tbl_session . ' WHERE id="' . intval($_SESSION['id_session']) . '"';
  389. $rs = Database::query($sql);
  390. list($_SESSION['session_name']) = Database::fetch_array($rs);
  391. $_SESSION['id_session'] = intval($_GET['id_session']);
  392. }
  393. if (!isset($_SESSION['login_as'])) {
  394. $save_course_access = true;
  395. //The value $_dont_save_user_course_access should be added before the call of global.inc.php see the main/inc/chat.ajax.php file
  396. //Disables the updates in the TRACK_E_COURSE_ACCESS table
  397. if (isset($_dont_save_user_course_access) && $_dont_save_user_course_access == true) {
  398. $save_course_access = false;
  399. }
  400. if ($save_course_access) {
  401. $course_tracking_table = Database :: get_main_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  402. /*
  403. * When $_configuration['session_lifetime'] is too big 100 hours (in order to let users take exercises with no problems)
  404. * the function Tracking::get_time_spent_on_the_course() returns big values (200h) due the condition:
  405. * login_course_date > now() - INTERVAL $session_lifetime SECOND
  406. *
  407. */
  408. /*
  409. if (isset($_configuration['session_lifetime'])) {
  410. $session_lifetime = $_configuration['session_lifetime'];
  411. } else {
  412. $session_lifetime = 3600; // 1 hour
  413. } */
  414. $session_lifetime = 3600; // 1 hour
  415. $course_code = $_course['sysCode'];
  416. $time = api_get_utc_datetime();
  417. if (isset($_user['user_id']) && !empty($_user['user_id'])) {
  418. //We select the last record for the current course in the course tracking table
  419. //But only if the login date is < than now + max_life_time
  420. $sql = "SELECT course_access_id FROM $course_tracking_table
  421. WHERE
  422. user_id = " . intval($_user ['user_id']) . " AND
  423. c_id = '".api_get_course_int_id()."' AND
  424. session_id = " . api_get_session_id() . " AND
  425. login_course_date > now() - INTERVAL $session_lifetime SECOND
  426. ORDER BY login_course_date DESC LIMIT 0,1";
  427. $result = Database::query($sql);
  428. if (Database::num_rows($result) > 0) {
  429. $i_course_access_id = Database::result($result, 0, 0);
  430. //We update the course tracking table
  431. $sql = "UPDATE $course_tracking_table SET logout_course_date = '$time', counter = counter+1
  432. WHERE course_access_id = " . intval($i_course_access_id) . " AND session_id = " . api_get_session_id();
  433. Database::query($sql);
  434. } else {
  435. $sql = "INSERT INTO $course_tracking_table (c_id, user_id, login_course_date, logout_course_date, counter, session_id)" .
  436. "VALUES('" . api_get_course_int_id() . "', '" . $_user['user_id'] . "', '$time', '$time', '1','" . api_get_session_id() . "')";
  437. Database::query($sql);
  438. }
  439. }
  440. }
  441. }
  442. }
  443. }
  444. /* COURSE / USER REL. INIT */
  445. $session_id = api_get_session_id();
  446. $user_id = isset($_user['user_id']) ? $_user['user_id'] : null;
  447. //Course permissions
  448. $is_courseAdmin = false; //course teacher
  449. $is_courseTutor = false; //course teacher - some rights
  450. $is_courseMember = false; //course student
  451. //Course - User permissions
  452. $is_sessionAdmin = false;
  453. if ($reset) {
  454. if (isset($user_id) && $user_id && isset($_cid) && $_cid) {
  455. //Check if user is subscribed in a course
  456. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  457. $sql = "SELECT * FROM $course_user_table
  458. WHERE
  459. user_id = '" . $user_id . "' AND
  460. relation_type <> " . COURSE_RELATION_TYPE_RRHH . " AND
  461. course_code = '$course_id'";
  462. $result = Database::query($sql);
  463. $cuData = null;
  464. if (Database::num_rows($result) > 0) {
  465. // this user have a recorded state for this course
  466. $cuData = Database::fetch_array($result, 'ASSOC');
  467. $is_courseAdmin = (bool) $cuData['status'] == 1;
  468. $is_courseTutor = (bool) $cuData['is_tutor'] == 1;
  469. $is_courseMember = true;
  470. // Checking if the user filled the course legal agreement
  471. if ($_course['activate_legal'] == 1 && !api_is_platform_admin()) {
  472. $user_is_subscribed = CourseManager::is_user_accepted_legal(
  473. $user_id,
  474. $_course['id'],
  475. $session_id
  476. );
  477. if (!$user_is_subscribed) {
  478. $url = api_get_path(WEB_CODE_PATH) . 'course_info/legal.php?course_code=' . $_course['code'] . '&session_id=' . $session_id;
  479. header('Location: ' . $url);
  480. exit;
  481. }
  482. }
  483. }
  484. //We are in a session course? Check session permissions
  485. if (!empty($session_id)) {
  486. //I'm not the teacher of the course
  487. if ($is_courseAdmin == false) {
  488. // this user has no status related to this course
  489. // The user is subscribed in a session? The user is a Session coach a Session admin ?
  490. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  491. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  492. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  493. //Session coach, session admin, course coach admin
  494. $sql = "SELECT session.id_coach, session_admin_id, session_rcru.user_id
  495. FROM $tbl_session session, $tbl_session_course_user session_rcru
  496. WHERE
  497. session_rcru.session_id = session.id AND
  498. session_rcru.c_id = '$_real_cid' AND
  499. session_rcru.user_id = '$user_id' AND
  500. session_rcru.session_id = $session_id AND
  501. session_rcru.status = 2";
  502. $result = Database::query($sql);
  503. $row = Database::store_result($result);
  504. //I'm a session admin?
  505. if (isset($row) && isset($row[0]) && $row[0]['session_admin_id'] == $user_id) {
  506. $is_courseMember = false;
  507. $is_courseTutor = false;
  508. $is_courseAdmin = false;
  509. $is_courseCoach = false;
  510. $is_sessionAdmin = true;
  511. } else {
  512. //Im a coach or a student?
  513. $sql = "SELECT user_id, status
  514. FROM " . $tbl_session_course_user . "
  515. WHERE
  516. c_id = '$_cid' AND
  517. user_id = '" . $user_id . "' AND
  518. session_id = '" . $session_id . "'
  519. LIMIT 1";
  520. $result = Database::query($sql);
  521. if (Database::num_rows($result)) {
  522. $row = Database::fetch_array($result, 'ASSOC');
  523. $session_course_status = $row['status'];
  524. switch ($session_course_status) {
  525. case '2': // coach - teacher
  526. $is_courseMember = true;
  527. $is_courseTutor = true;
  528. $is_courseCoach = true;
  529. $is_sessionAdmin = false;
  530. if (api_get_setting('extend_rights_for_coach') == 'true') {
  531. $is_courseAdmin = true;
  532. } else {
  533. $is_courseAdmin = false;
  534. }
  535. break;
  536. case '0': //student
  537. $is_courseMember = true;
  538. $is_courseTutor = false;
  539. $is_courseAdmin = false;
  540. $is_sessionAdmin = false;
  541. break;
  542. default:
  543. //unregister user
  544. $is_courseMember = false;
  545. $is_courseTutor = false;
  546. $is_courseAdmin = false;
  547. $is_sessionAdmin = false;
  548. break;
  549. }
  550. } else {
  551. //unregister user
  552. $is_courseMember = false;
  553. $is_courseTutor = false;
  554. $is_courseAdmin = false;
  555. $is_sessionAdmin = false;
  556. }
  557. }
  558. }
  559. //If I'm the admin platform i'm a teacher of the course
  560. if ($is_platformAdmin) {
  561. $is_courseAdmin = true;
  562. }
  563. }
  564. } else { // keys missing => not anymore in the course - user relation
  565. // course
  566. $is_courseMember = false;
  567. $is_courseAdmin = false;
  568. $is_courseTutor = false;
  569. $is_courseCoach = false;
  570. $is_sessionAdmin = false;
  571. }
  572. //Checking the course access
  573. $is_allowed_in_course = false;
  574. if (isset($_course)) {
  575. switch ($_course['visibility']) {
  576. case COURSE_VISIBILITY_OPEN_WORLD: //3
  577. $is_allowed_in_course = true;
  578. break;
  579. case COURSE_VISIBILITY_OPEN_PLATFORM : //2
  580. if (isset($user_id) && !api_is_anonymous($user_id)) {
  581. $is_allowed_in_course = true;
  582. }
  583. break;
  584. case COURSE_VISIBILITY_REGISTERED: //1
  585. if ($is_platformAdmin || $is_courseMember) {
  586. $is_allowed_in_course = true;
  587. }
  588. break;
  589. case COURSE_VISIBILITY_CLOSED: //0
  590. if ($is_platformAdmin || $is_courseAdmin) {
  591. $is_allowed_in_course = true;
  592. }
  593. break;
  594. case COURSE_VISIBILITY_HIDDEN: //4
  595. if ($is_platformAdmin) {
  596. $is_allowed_in_course = true;
  597. }
  598. break;
  599. }
  600. }
  601. // check the session visibility
  602. if ($is_allowed_in_course == true) {
  603. //if I'm in a session
  604. if ($session_id != 0) {
  605. if (!$is_platformAdmin) {
  606. // admin and session coach are *not* affected to the invisible session mode
  607. // the coach is not affected because he can log in some days after the end date of a session
  608. $session_visibility = api_get_session_visibility($session_id);
  609. switch ($session_visibility) {
  610. case SESSION_INVISIBLE:
  611. $is_allowed_in_course = false;
  612. break;
  613. }
  614. //checking date
  615. }
  616. }
  617. }
  618. // save the states
  619. Session::write('is_courseAdmin', $is_courseAdmin);
  620. Session::write('is_courseMember', $is_courseMember);
  621. Session::write('is_courseTutor', $is_courseTutor);
  622. Session::write('is_courseCoach', $is_courseCoach);
  623. Session::write('is_allowed_in_course', $is_allowed_in_course);
  624. Session::write('is_sessionAdmin', $is_sessionAdmin);
  625. } else {
  626. // continue with the previous values
  627. $is_courseAdmin = $_SESSION['is_courseAdmin'];
  628. $is_courseTutor = $_SESSION['is_courseTutor'];
  629. $is_courseCoach = $_SESSION['is_courseCoach'];
  630. $is_courseMember = $_SESSION['is_courseMember'];
  631. $is_allowed_in_course = $_SESSION['is_allowed_in_course'];
  632. }
  633. }
  634. /**
  635. *
  636. * @global int $_cid
  637. * @global array $_course
  638. * @global int $_gid
  639. *
  640. * @param int $group_id
  641. * @param bool $reset
  642. */
  643. static function init_group($group_id, $reset)
  644. {
  645. global $_cid;
  646. global $_course;
  647. global $_gid;
  648. if ($reset) { // session data refresh requested
  649. if ($group_id && $_cid && !empty($_course['real_id'])) { // have keys to search data
  650. $group_table = Database::get_course_table(TABLE_GROUP);
  651. $sql = "SELECT * FROM $group_table WHERE c_id = " . $_course['real_id'] . " AND id = '$group_id'";
  652. $result = Database::query($sql);
  653. if (Database::num_rows($result) > 0) { // This group has recorded status related to this course
  654. $gpData = Database::fetch_array($result);
  655. $_gid = $gpData ['id'];
  656. Session::write('_gid', $_gid);
  657. } else {
  658. Session::erase('_gid');
  659. }
  660. } elseif (isset($_SESSION['_gid']) or isset($_gid)) { // Keys missing => not anymore in the group - course relation
  661. Session::erase('_gid');
  662. }
  663. } elseif (isset($_SESSION['_gid'])) { // continue with the previous values
  664. $_gid = $_SESSION ['_gid'];
  665. } else { //if no previous value, assign caracteristic undefined value
  666. $_gid = -1;
  667. }
  668. //set variable according to student_view_enabled choices
  669. if (api_get_setting('student_view_enabled') == "true") {
  670. if (isset($_GET['isStudentView'])) {
  671. if ($_GET['isStudentView'] == 'true') {
  672. if (isset($_SESSION['studentview'])) {
  673. if (!empty($_SESSION['studentview'])) {
  674. // switching to studentview
  675. $_SESSION['studentview'] = 'studentview';
  676. }
  677. }
  678. } elseif ($_GET['isStudentView'] == 'false') {
  679. if (isset($_SESSION['studentview'])) {
  680. if (!empty($_SESSION['studentview'])) {
  681. // switching to teacherview
  682. $_SESSION['studentview'] = 'teacherview';
  683. }
  684. }
  685. }
  686. } elseif (!empty($_SESSION['studentview'])) {
  687. //all is fine, no change to that, obviously
  688. } elseif (empty($_SESSION['studentview'])) {
  689. // We are in teacherview here
  690. $_SESSION['studentview'] = 'teacherview';
  691. }
  692. }
  693. }
  694. /**
  695. * Returns true if user exists in the platform when asking the password
  696. *
  697. * @param string $username (email or username)
  698. * @return boolean
  699. */
  700. public static function get_user_accounts_by_username($username)
  701. {
  702. if (strpos($username,'@')){
  703. $username = api_strtolower($username);
  704. $email = true;
  705. } else {
  706. $username = api_strtolower($username);
  707. $email = false;
  708. }
  709. $condition = '';
  710. if ($email) {
  711. $condition = "LOWER(email) = '".Database::escape_string($username)."' ";
  712. } else {
  713. $condition = "LOWER(username) = '".Database::escape_string($username)."'";
  714. }
  715. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  716. $query = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, username AS loginName, password, email,
  717. status AS status, official_code, phone, picture_uri, creator_id
  718. FROM $tbl_user
  719. WHERE ( $condition AND active = 1) ";
  720. $result = Database::query($query);
  721. $num_rows = Database::num_rows($result);
  722. if ($result && $num_rows > 0) {
  723. return Database::store_result($result);
  724. }
  725. return false;
  726. }
  727. }