local.inc.php 51 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2009 Dokeos SPRL
  6. Copyright (c) 2003-2005 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Hugues Peeters
  9. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  10. Copyright (c) Patrick Cool
  11. Copyright (c) Julio Montoya Armas
  12. Copyright (c) Isaac flores paz
  13. For a full list of contributors, see "credits.txt".
  14. The full license can be read in "license.txt".
  15. This program is free software; you can redistribute it and/or
  16. modify it under the terms of the GNU General Public License
  17. as published by the Free Software Foundation; either version 2
  18. of the License, or (at your option) any later version.
  19. See the GNU General Public License for more details.
  20. Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
  21. Mail: info@dokeos.com
  22. ==============================================================================
  23. */
  24. /**
  25. ==============================================================================
  26. *
  27. * SCRIPT PURPOSE
  28. *
  29. * This script initializes and manages Dokeos session information. It
  30. * keeps available session information up to date.
  31. *
  32. * You can request a course id. It will check if the course Id requested is the
  33. * same as the current one. If it isn't it will update session information from
  34. * the database. You can also force the course reset if you want ($cidReset).
  35. *
  36. * All the course information is stored in the $_course array.
  37. *
  38. * You can request a group id. The script will check if the group id requested is the
  39. * same as the current one. If it isn't it will update session information from
  40. * the database. You can also force the course reset if you want ($gidReset).
  41. *
  42. The course id is stored in $_cid session variable.
  43. * The group id is stored in $_gid session variable.
  44. *
  45. *
  46. * VARIABLES AFFECTING THE SCRIPT BEHAVIOR
  47. *
  48. * string $login
  49. * string $password
  50. * boolean $logout
  51. *
  52. * string $cidReq : course id requested
  53. * boolean $cidReset : ask for a course Reset, if no $cidReq is provided in the
  54. * same time, all course informations is removed from the
  55. * current session
  56. *
  57. * int $gidReq : group Id requested
  58. * boolean $gidReset : ask for a group Reset, if no $gidReq is provided in the
  59. * same time, all group informations is removed from the
  60. * current session
  61. *
  62. *
  63. * VARIABLES SET AND RETURNED BY THE SCRIPT
  64. *
  65. * All the variables below are set and returned by this script.
  66. *
  67. * USER VARIABLES
  68. *
  69. * string $_user ['firstName' ]
  70. * string $_user ['lastName' ]
  71. * string $_user ['mail' ]
  72. * string $_user ['lastLogin' ]
  73. * string $_user ['official_code']
  74. * string $_user ['picture_uri' ]
  75. * string $_user['user_id']
  76. *
  77. * boolean $is_platformAdmin
  78. * boolean $is_allowedCreateCourse
  79. *
  80. * COURSE VARIABLES
  81. *
  82. * string $_cid (the course id)
  83. *
  84. * int $_course['id' ] - auto-assigned integer
  85. * string $_course['name' ] - the title of the course
  86. * string $_course['official_code'] - the visual / fake / official code
  87. * string $_course['sysCode' ]
  88. * string $_course['path' ]
  89. * string $_course['dbName' ]
  90. * string $_course['dbNameGlu' ]
  91. * string $_course['titular' ]
  92. * string $_course['language' ]
  93. * string $_course['extLink' ]['url' ]
  94. * string $_course['extLink' ]['name']
  95. * string $_course['categoryCode']
  96. * string $_course['categoryName']
  97. * boolean $is_courseMember
  98. * boolean $is_courseTutor
  99. * boolean $is_courseAdmin
  100. *
  101. *
  102. * GROUP VARIABLES
  103. *
  104. * int $_gid (the group id)
  105. *
  106. *
  107. * IMPORTANT ADVICE FOR DEVELOPERS
  108. *
  109. * We strongly encourage developers to use a connection layer at the top of
  110. * their scripts rather than use these variables, as they are, inside the core
  111. * of their scripts. It will make code maintenance much easier.
  112. *
  113. * Many if the functions you need you can already find in the
  114. * main_api.lib.php
  115. *
  116. * We encourage you to use functions to access these global "kernel" variables.
  117. * You can add them to e.g. the main API library.
  118. *
  119. *
  120. * SCRIPT STRUCTURE
  121. *
  122. * 1. The script determines if there is an authentication attempt. This part
  123. * only chek if the login name and password are valid. Afterwards, it set the
  124. * $_user['user_id'] (user id) and the $uidReset flag. Other user informations are retrieved
  125. * later. It's also in this section that optional external authentication
  126. * devices step in.
  127. *
  128. * 2. The script determines what other session informations have to be set or
  129. * reset, setting correctly $cidReset (for course) and $gidReset (for group).
  130. *
  131. * 3. If needed, the script retrieves the other user informations (first name,
  132. * last name, ...) and stores them in session.
  133. *
  134. * 4. If needed, the script retrieves the course information and stores them
  135. * in session
  136. *
  137. * 5. The script initializes the user permission status and permission for the
  138. * course level
  139. *
  140. * 6. If needed, the script retrieves group informations an store them in
  141. * session.
  142. *
  143. * 7. The script initializes the user status and permission for the group level.
  144. *
  145. * @package dokeos.include
  146. ==============================================================================
  147. */
  148. /*
  149. ==============================================================================
  150. INIT SECTION
  151. variables should be initialised here
  152. ==============================================================================
  153. */
  154. // verified if exists the username and password in session current
  155. if (isset($_SESSION['info_current_user'][1]) && isset($_SESSION['info_current_user'][2])) {
  156. require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
  157. require_once (api_get_path(LIBRARY_PATH).'legal.lib.php');
  158. }
  159. // parameters passed via GET
  160. $logout = isset($_GET["logout"]) ? $_GET["logout"] : '';
  161. $gidReq = isset($_GET["gidReq"]) ? Database::escape_string($_GET["gidReq"]) : '';
  162. //this fixes some problems with generic functionalities like
  163. //My Agenda & What's New icons linking to courses
  164. // $cidReq can be set in the index.php file of a course-area
  165. $cidReq = isset($cidReq) ? Database::escape_string($cidReq) : '';
  166. // $cidReq can be set in URL-parameter
  167. $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $cidReq;
  168. $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
  169. // $cidReset can be set in URL-parameter
  170. $cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq']!=$_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
  171. // $cDir is a special url param sent by courses/.htaccess
  172. $cDir = (!empty($_GET['cDir']) ? $_GET['cDir'] : null);
  173. $gidReset = isset($gidReset) ? $gidReset : '';
  174. // $gidReset can be set in URL-parameter
  175. // parameters passed via POST
  176. $login = isset($_POST["login"]) ? $_POST["login"] : '';
  177. // passed through other means
  178. //$cidReq -- passed from course folder index.php
  179. /*
  180. ==============================================================================
  181. MAIN CODE
  182. ==============================================================================
  183. */
  184. if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout)) {
  185. // uid is in session => login already done, continue with this value
  186. $_user['user_id'] = $_SESSION['_user']['user_id'];
  187. } else {
  188. if (isset($_user['user_id'])) {
  189. unset($_user['user_id']);
  190. }
  191. //$_SESSION['info_current_user'][1] is user name
  192. //$_SESSION['info_current_user'][2] is current password encrypted
  193. //$_SESSION['update_term_and_condition'][1] is current user id, of user in session
  194. if (api_get_setting('allow_terms_conditions')=='true') {
  195. if (isset($_POST['login']) && isset($_POST['password']) && isset($_SESSION['update_term_and_condition'][1])) {
  196. $user_id=$_SESSION['update_term_and_condition'][1]; // user id
  197. // update the terms & conditions
  198. //verify type of terms and conditions
  199. $info_legal = explode(':',$_POST['legal_info']);
  200. $legal_type=LegalManager::get_type_of_terms_and_conditions($info_legal[0],$info_legal[1]);
  201. //is necessary verify check
  202. if ($legal_type==1) {
  203. if ((isset($_POST['legal_accept']) && $_POST['legal_accept']=='1')) {
  204. $legal_option=true;
  205. } else {
  206. $legal_option=false;
  207. }
  208. }
  209. //no is check option
  210. if ($legal_type==0) {
  211. $legal_option=true;
  212. }
  213. if (isset($_POST['legal_accept_type']) && $legal_option===true) {
  214. $cond_array = explode(':',$_POST['legal_accept_type']);
  215. if (!empty($cond_array[0]) && !empty($cond_array[1])){
  216. $time = time();
  217. $condition_to_save = intval($cond_array[0]).':'.intval($cond_array[1]).':'.$time;
  218. UserManager::update_extra_field_value($user_id,'legal_accept',$condition_to_save);
  219. }
  220. }
  221. }
  222. }
  223. if ((isset($_POST['login']) && isset($_POST['password']))) {
  224. // $login && $password are given to log in
  225. $login = $_POST['login'];
  226. $password = $_POST['password'];
  227. //lookup the user in the main database
  228. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  229. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  230. FROM $user_table
  231. WHERE username = '".trim(addslashes($login))."'";
  232. $result = Database::query($sql,__FILE__,__LINE__);
  233. if (Database::num_rows($result) > 0) {
  234. $uData = Database::fetch_array($result);
  235. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  236. //the authentification of this user is managed by Dokeos itself
  237. $password = trim(stripslashes($password));
  238. // determine if the password needs to be encrypted before checking
  239. // $userPasswordCrypted is set in an external configuration file
  240. /*if ($userPasswordCrypted) {
  241. $password = md5($password);
  242. } */
  243. if (api_get_setting('allow_terms_conditions')=='true') {
  244. if (isset($_POST['password']) && isset($_SESSION['info_current_user'][2]) && $_POST['password']==$_SESSION['info_current_user'][2]) {
  245. $password=$_POST['password'];
  246. } else {
  247. $password = api_get_encrypted_password($password);
  248. }
  249. } else {
  250. $password = api_get_encrypted_password($password);
  251. }
  252. if (api_get_setting('allow_terms_conditions')=='true') {
  253. if ($password == $uData['password'] AND (trim($login) == $uData['username'])) {
  254. $temp_user_id = $uData['user_id'];
  255. $term_and_condition_status=api_check_term_condition($temp_user_id);//false or true
  256. if ($term_and_condition_status===false) {
  257. $_SESSION['update_term_and_condition']=array(true,$temp_user_id);
  258. $_SESSION['info_current_user']=array(true,$login,$password);
  259. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php');
  260. exit;
  261. } else {
  262. unset($_SESSION['update_term_and_condition']);
  263. unset($_SESSION['info_current_user']);
  264. }
  265. }
  266. }
  267. // check the user's password
  268. if ($password == $uData['password'] AND (trim($login) == $uData['username'])) {
  269. // check if the account is active (not locked)
  270. if ($uData['active']=='1') {
  271. // check if the expiration date has not been reached
  272. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  273. global $_configuration;
  274. if ($_configuration['multiple_access_urls']==true) {
  275. //check the access_url configuration setting if the user is registered in the access_url_rel_user table
  276. //getting the current access_url_id of the platform
  277. $current_access_url_id = api_get_current_access_url_id();
  278. // my user is subscribed in these sites => $my_url_list
  279. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  280. if (is_array($my_url_list) && count($my_url_list)>0 ){
  281. // the user have the permissions to enter at this site
  282. if (in_array($current_access_url_id, $my_url_list)) {
  283. $_user['user_id'] = $uData['user_id'];
  284. api_session_register('_user');
  285. event_login();
  286. } else {
  287. $loginFailed = true;
  288. api_session_unregister('_uid');
  289. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  290. exit;
  291. }
  292. } else {
  293. $loginFailed = true;
  294. api_session_unregister('_uid');
  295. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  296. exit;
  297. }
  298. } else {
  299. $_user['user_id'] = $uData['user_id'];
  300. api_session_register('_user');
  301. event_login();
  302. }
  303. } else {
  304. $loginFailed = true;
  305. api_session_unregister('_uid');
  306. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  307. exit;
  308. }
  309. } else {
  310. $loginFailed = true;
  311. api_session_unregister('_uid');
  312. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  313. exit;
  314. }
  315. } else {
  316. // login failed: username or password incorrect
  317. $loginFailed = true;
  318. api_session_unregister('_uid');
  319. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
  320. exit;
  321. }
  322. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id']) {
  323. //first login for a not self registred
  324. //e.g. registered by a teacher
  325. //do nothing (code may be added later)
  326. }
  327. } elseif (!empty($extAuthSource[$uData['auth_source']]['login']) && file_exists($extAuthSource[$uData['auth_source']]['login'])) {
  328. /*
  329. * Process external authentication
  330. * on the basis of the given login name
  331. */
  332. $loginFailed = true; // Default initialisation. It could
  333. // change after the external authentication
  334. $key = $uData['auth_source']; //'ldap','shibboleth'...
  335. /* >>>>>>>> External authentication modules <<<<<<<<< */
  336. // see configuration.php to define these
  337. include_once($extAuthSource[$key]['login']);
  338. /* >>>>>>>> External authentication modules <<<<<<<<< */
  339. } else // no standard Dokeos login - try external authentification
  340. {
  341. //huh... nothing to do... we shouldn't get here
  342. error_log('Dokeos Authentication file '. $extAuthSource[$uData['auth_source']]['login']. ' could not be found - this might prevent your system from doing the corresponding authentication process',0);
  343. }
  344. if (!empty($_SESSION['request_uri'])) {
  345. $req = $_SESSION['request_uri'];
  346. unset($_SESSION['request_uri']);
  347. header('location: '.$req);
  348. } else {
  349. if (isset($param)) {
  350. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login').$param);
  351. } else {
  352. // here is the main redirect of a *normal* login page in Dokeos
  353. header('location: '.api_get_path(WEB_PATH).api_get_setting('page_after_login'));
  354. }
  355. }
  356. } else {
  357. // login failed, Database::num_rows($result) <= 0
  358. $loginFailed = true; // Default initialisation. It could
  359. // change after the external authentication
  360. /*
  361. * In this section:
  362. * there is no entry for the $login user in the Dokeos
  363. * database. This also means there is no auth_source for the user.
  364. * We let all external procedures attempt to add him/her
  365. * to the system.
  366. *
  367. * Process external login on the basis
  368. * of the authentication source list
  369. * provided by the configuration settings.
  370. * If the login succeeds, for going further,
  371. * Dokeos needs the $_user['user_id'] variable to be
  372. * set and registered in the session. It's the
  373. * responsability of the external login script
  374. * to provide this $_user['user_id'].
  375. */
  376. if (isset($extAuthSource) && is_array($extAuthSource)) {
  377. foreach($extAuthSource as $thisAuthSource) {
  378. if (!empty($thisAuthSource['newUser']) && file_exists($thisAuthSource['newUser'])) {
  379. include_once($thisAuthSource['newUser']);
  380. } else {
  381. error_log('Dokeos Authentication file '. $thisAuthSource['newUser']. ' could not be found - this might prevent your system from using the authentication process in the user creation process',0);
  382. }
  383. }
  384. } //end if is_array($extAuthSource)
  385. } //end else login failed
  386. } elseif(api_get_setting('sso_authentication')==='true' && !in_array('webservices', explode('/', $_SERVER['REQUEST_URI']))) {
  387. /**
  388. * TODO:
  389. * - Implement user interface for api_get_setting('sso_authentication')
  390. * } elseif (api_get_setting('sso_authentication')=='true') {
  391. * - Work on a better validation for webservices paths. Current is very poor and exit
  392. * - $master variable should be recovered from dokeos settings.
  393. */
  394. $master = array(
  395. 'domain' => api_get_setting('sso_authentication_domain'), // 'localhost/project/drupal5',
  396. 'auth_uri' => api_get_setting('sso_authentication_auth_uri'), // '/?q=user',
  397. 'deauth_uri' => api_get_setting('sso_authentication_unauth_uri'), // '/?q=logout',
  398. 'protocol' => api_get_setting('sso_authentication_protocol') // 'http://',
  399. );
  400. $referer = $master['protocol'] . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
  401. if (isset($_SESSION['_user']['user_id'])) {
  402. if ($logout) {
  403. // Library needed by index.php
  404. include_once api_get_path(LIBRARY_PATH) . 'online.inc.php';
  405. include_once (api_get_path(LIBRARY_PATH).'course.lib.php');
  406. // Prevent index.php to redirect
  407. global $logout_no_redirect;
  408. $logout_no_redirect = TRUE;
  409. // Make custom redirect after logout
  410. online_logout();
  411. header('Location: '. $master['protocol'] . $master['domain'] . $master['deauth_uri']);
  412. exit;
  413. }
  414. } elseif(!$logout) {
  415. $master_url = $master['domain'] . $master['auth_uri'];
  416. // Handle cookie comming from Master Server
  417. if (!isset($_GET['sso_referer']) && !isset($_GET['loginFailed'])) {
  418. // Target to redirect after success SSO
  419. $target = api_get_path(WEB_PATH);
  420. // Redirect to master server
  421. header('Location: ' . $master['protocol'] . $master_url . '&sso_referer=' . urlencode($referer) . '&sso_target=' . urlencode($target));
  422. exit;
  423. } elseif (isset($_GET['sso_cookie'])) {
  424. if (isset($_GET['sso_referer']) ? $_GET['sso_referer'] === $master['protocol']. $master_url : FALSE) {
  425. $sso = unserialize(base64_decode($_GET['sso_cookie']));
  426. //lookup the user in the main database
  427. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  428. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  429. FROM $user_table
  430. WHERE username = '".trim(addslashes($sso['username']))."'";
  431. $result = Database::query($sql,__FILE__,__LINE__);
  432. if (Database::num_rows($result) > 0) {
  433. $uData = Database::fetch_array($result);
  434. // check the user's password
  435. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  436. // Make sure password is encrypted with md5
  437. if (!$userPasswordCrypted) {
  438. $uData['password'] = md5($uData['password']);
  439. }
  440. //the authentification of this user is managed by Dokeos itself// check the user's password
  441. // password hash comes into a sha1
  442. if ($sso['secret'] === sha1($uData['password']) && ($sso['username'] == $uData['username'])) {
  443. // check if the account is active (not locked)
  444. if ($uData['active']=='1') {
  445. // check if the expiration date has not been reached
  446. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  447. global $_configuration;
  448. if ($_configuration['multiple_access_urls']==true) {
  449. //check the access_url configuration setting if the user is registered in the access_url_rel_user table
  450. //getting the current access_url_id of the platform
  451. $current_access_url_id = api_get_current_access_url_id();
  452. // my user is subscribed in these sites => $my_url_list
  453. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  454. if (is_array($my_url_list) && count($my_url_list)>0 ) {
  455. if (in_array($current_access_url_id, $my_url_list)) {
  456. // the user has permission to enter at this site
  457. $_user['user_id'] = $uData['user_id'];
  458. api_session_register('_user');
  459. event_login();
  460. // Redirect to homepage
  461. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  462. header('Location: '. $sso_target);
  463. } else {
  464. // user does not have permission for this site
  465. $loginFailed = true;
  466. api_session_unregister('_uid');
  467. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  468. exit;
  469. }
  470. } else {
  471. // there is no URL in the multiple urls list for this user
  472. $loginFailed = true;
  473. api_session_unregister('_uid');
  474. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  475. exit;
  476. }
  477. } else {
  478. //single URL access
  479. $_user['user_id'] = $uData['user_id'];
  480. api_session_register('_user');
  481. event_login();
  482. // Redirect to homepage
  483. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  484. header('Location: '. $sso_target);
  485. }
  486. } else {
  487. // user account expired
  488. $loginFailed = true;
  489. api_session_unregister('_uid');
  490. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  491. exit;
  492. }
  493. } else {
  494. //user not active
  495. $loginFailed = true;
  496. api_session_unregister('_uid');
  497. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  498. exit;
  499. }
  500. } else {
  501. //sha1 of password is wrong
  502. $loginFailed = true;
  503. api_session_unregister('_uid');
  504. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  505. exit;
  506. }
  507. } else {
  508. //auth_source is wrong
  509. $loginFailed = true;
  510. api_session_unregister('_uid');
  511. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  512. exit;
  513. }
  514. } else {
  515. //no user by that login
  516. $loginFailed = true;
  517. api_session_unregister('_uid');
  518. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  519. exit;
  520. }
  521. } else {
  522. //request comes from unknown source
  523. $loginFailed = true;
  524. api_session_unregister('_uid');
  525. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  526. exit;
  527. }
  528. }
  529. }
  530. } elseif (api_get_setting('openid_authentication')=='true') {
  531. if (!empty($_POST['openid_url'])) {
  532. include('main/auth/openid/login.php');
  533. openid_begin(trim($_POST['openid_url']),api_get_path(WEB_PATH).'index.php');
  534. //this last function should trigger a redirect, so we can die here safely
  535. die('Openid login redirection should be in progress');
  536. } elseif (!empty($_GET['openid_identity']))
  537. { //it's usual for PHP to replace '.' (dot) by '_' (underscore) in URL parameters
  538. include('main/auth/openid/login.php');
  539. $res = openid_complete($_GET);
  540. if ($res['status'] == 'success') {
  541. $id1 = Database::escape_string($res['openid.identity']);
  542. //have another id with or without the final '/'
  543. $id2 = (substr($id1,-1,1)=='/'?substr($id1,0,-1):$id1.'/');
  544. //lookup the user in the main database
  545. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  546. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  547. FROM $user_table
  548. WHERE openid = '$id1'
  549. OR openid = '$id2' ";
  550. $result = Database::query($sql);
  551. if ($result !== false) {
  552. if (Database::num_rows($result)>0) {
  553. //$row = Database::fetch_array($res);
  554. $uData = Database::fetch_array($result);
  555. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  556. //the authentification of this user is managed by Dokeos itself
  557. // check if the account is active (not locked)
  558. if ($uData['active']=='1') {
  559. // check if the expiration date has not been reached
  560. if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  561. $_user['user_id'] = $uData['user_id'];
  562. api_session_register('_user');
  563. event_login();
  564. } else {
  565. $loginFailed = true;
  566. api_session_unregister('_uid');
  567. header('Location: index.php?loginFailed=1&error=account_expired');
  568. exit;
  569. }
  570. } else {
  571. $loginFailed = true;
  572. api_session_unregister('_uid');
  573. header('Location: index.php?loginFailed=1&error=account_inactive');
  574. exit;
  575. }
  576. if (isset($uData['creator_id']) && $_user['user_id'] != $uData['creator_id'])
  577. {
  578. //first login for a not self registred
  579. //e.g. registered by a teacher
  580. //do nothing (code may be added later)
  581. }
  582. }
  583. } else {
  584. //Redirect to the subscription form
  585. header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php?username='.$res['openid.sreg.nickname'].'&email='.$res['openid.sreg.email'].'&openid='.$res['openid.identity'].'&openid_msg=idnotfound');
  586. //$loginFailed = true;
  587. }
  588. } else {
  589. $loginFailed = true;
  590. }
  591. } else {
  592. $loginFailed = true;
  593. }
  594. }
  595. }
  596. // else {} => continue as anonymous user
  597. $uidReset = true;
  598. // $cidReset = true;
  599. // $gidReset = true;
  600. }
  601. //Now check for anonymous user mode
  602. if (isset($use_anonymous) && $use_anonymous == true) {
  603. //if anonymous mode is set, then try to set the current user as anonymous
  604. //if he doesn't have a login yet
  605. api_set_anonymous();
  606. } else {
  607. //if anonymous mode is not set, then check if this user is anonymous. If it
  608. //is, clean it from being anonymous (make him a nobody :-))
  609. api_clear_anonymous();
  610. }
  611. // if there is a cDir parameter in the URL (coming from courses/.htaccess redirection)
  612. if (!empty($cDir)) {
  613. require_once api_get_path(LIBRARY_PATH).'course.lib.php';
  614. $c = CourseManager::get_course_id_from_path($cDir);
  615. if ($c != false) { $cidReq = $c; }
  616. }
  617. // if the requested course is different from the course in session
  618. if (!empty($cidReq) && (!isset($_SESSION['_cid']) or (isset($_SESSION['_cid']) && $cidReq != $_SESSION['_cid']))) {
  619. $cidReset = true;
  620. $gidReset = true; // As groups depend from courses, group id is reset
  621. }
  622. // if the requested group is different from the group in session
  623. $gid = isset($_SESSION['_gid'])?$_SESSION['_gid']:'';
  624. if ($gidReq && $gidReq != $gid) {
  625. $gidReset = true;
  626. }
  627. //////////////////////////////////////////////////////////////////////////////
  628. // USER INIT
  629. //////////////////////////////////////////////////////////////////////////////
  630. if (isset($uidReset) && $uidReset) // session data refresh requested
  631. {
  632. $is_platformAdmin = false; $is_allowedCreateCourse = false;
  633. if (isset($_user['user_id']) && $_user['user_id']) // a uid is given (log in succeeded)
  634. {
  635. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  636. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  637. if ($_configuration['tracking_enabled']) {
  638. $sql = "SELECT user.*, a.user_id is_admin,
  639. UNIX_TIMESTAMP(login.login_date) login_date
  640. FROM $user_table
  641. LEFT JOIN $admin_table a
  642. ON user.user_id = a.user_id
  643. LEFT JOIN ".$_configuration['statistics_database'].".track_e_login login
  644. ON user.user_id = login.login_user_id
  645. WHERE user.user_id = '".$_user['user_id']."'
  646. ORDER BY login.login_date DESC LIMIT 1";
  647. } else {
  648. $sql = "SELECT user.*, a.user_id is_admin
  649. FROM $user_table
  650. LEFT JOIN $admin_table a
  651. ON user.user_id = a.user_id
  652. WHERE user.user_id = '".$_user['user_id']."'";
  653. }
  654. $result = Database::query($sql,__FILE__,__LINE__);
  655. if (Database::num_rows($result) > 0) {
  656. // Extracting the user data
  657. $uData = Database::fetch_array($result);
  658. $_user ['firstName'] = $uData ['firstname' ];
  659. $_user ['lastName' ] = $uData ['lastname' ];
  660. $_user ['mail' ] = $uData ['email' ];
  661. $_user ['lastLogin'] = $uData ['login_date'];
  662. $_user ['official_code'] = $uData ['official_code'];
  663. $_user ['picture_uri'] = $uData ['picture_uri'];
  664. $_user ['user_id'] = $uData ['user_id'];
  665. $_user ['language'] = $uData ['language'];
  666. $_user ['auth_source'] = $uData ['auth_source'];
  667. $_user ['theme'] = $uData ['theme'];
  668. $_user ['status'] = $uData ['status'];
  669. $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
  670. $is_allowedCreateCourse = (bool) (($uData ['status'] == 1) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == 4));
  671. api_session_register('_user');
  672. } else {
  673. header('location:'.api_get_path(WEB_PATH));
  674. //exit("WARNING UNDEFINED UID !! ");
  675. }
  676. } else { // no uid => logout or Anonymous
  677. api_session_unregister('_user');
  678. api_session_unregister('_uid');
  679. }
  680. api_session_register('is_platformAdmin');
  681. api_session_register('is_allowedCreateCourse');
  682. } else { // continue with the previous values
  683. $_user = $_SESSION['_user'];
  684. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  685. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  686. }
  687. //////////////////////////////////////////////////////////////////////////////
  688. // COURSE INIT
  689. //////////////////////////////////////////////////////////////////////////////
  690. if (isset($cidReset) && $cidReset) { // course session data refresh requested or empty data
  691. if ($cidReq) {
  692. $course_table = Database::get_main_table(TABLE_MAIN_COURSE);
  693. $course_cat_table = Database::get_main_table(TABLE_MAIN_CATEGORY);
  694. $sql = "SELECT course.*, course_category.code faCode, course_category.name faName
  695. FROM $course_table
  696. LEFT JOIN $course_cat_table
  697. ON course.category_code = course_category.code
  698. WHERE course.code = '$cidReq'";
  699. $result = Database::query($sql,__FILE__,__LINE__);
  700. if (Database::num_rows($result)>0) {
  701. $cData = Database::fetch_array($result);
  702. $_cid = $cData['code' ];
  703. $_course = array();
  704. $_course['id' ] = $cData['code' ]; //auto-assigned integer
  705. $_course['name' ] = $cData['title' ];
  706. $_course['official_code'] = $cData['visual_code' ]; // use in echo
  707. $_course['sysCode' ] = $cData['code' ]; // use as key in db
  708. $_course['path' ] = $cData['directory' ]; // use as key in path
  709. $_course['dbName' ] = $cData['db_name' ]; // use as key in db list
  710. $_course['dbNameGlu' ] = $_configuration['table_prefix'] . $cData['db_name'] . $_configuration['db_glue']; // use in all queries
  711. $_course['titular' ] = $cData['tutor_name' ];
  712. $_course['language' ] = $cData['course_language' ];
  713. $_course['extLink' ]['url' ] = $cData['department_url' ];
  714. $_course['extLink' ]['name'] = $cData['department_name'];
  715. $_course['categoryCode'] = $cData['faCode' ];
  716. $_course['categoryName'] = $cData['faName' ];
  717. $_course['visibility' ] = $cData['visibility'];
  718. $_course['subscribe_allowed'] = $cData['subscribe'];
  719. $_course['unubscribe_allowed'] = $cData['unsubscribe'];
  720. api_session_register('_cid');
  721. api_session_register('_course');
  722. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  723. //We add a new record in the course tracking table
  724. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  725. $time = api_get_datetime();
  726. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  727. "VALUES('".$_course['sysCode']."', '".$_user['user_id']."', '$time', '$time', '1')";
  728. Database::query($sql,__FILE__,__LINE__);
  729. }
  730. // if a session id has been given in url, we store the session
  731. if (api_get_setting('use_session_mode')=='true') {
  732. // Database Table Definitions
  733. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  734. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  735. $tbl_session_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
  736. $tbl_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  737. if (!empty($_GET['id_session'])) {
  738. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  739. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.intval($_SESSION['id_session']) . '"';
  740. $rs = Database::query($sql,__FILE__,__LINE__);
  741. list($_SESSION['session_name']) = Database::fetch_array($rs);
  742. } else {
  743. api_session_unregister('session_name');
  744. api_session_unregister('id_session');
  745. }
  746. }
  747. } else {
  748. //exit("WARNING UNDEFINED CID !! ");
  749. header('location:'.api_get_path(WEB_PATH));
  750. }
  751. } else {
  752. api_session_unregister('_cid');
  753. api_session_unregister('_course');
  754. }
  755. } else { // continue with the previous values
  756. if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
  757. $_cid = -1; //set default values that will be caracteristic of being unset
  758. $_course = -1;
  759. } else {
  760. $_cid = $_SESSION['_cid' ];
  761. $_course = $_SESSION['_course'];
  762. // these lines are usefull for tracking. Indeed we can have lost the id_session and not the cid.
  763. // Moreover, if we want to track a course with another session it can be usefull
  764. if (!empty($_GET['id_session'])) {
  765. $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION);
  766. $_SESSION['id_session'] = Database::escape_string($_GET['id_session']);
  767. $sql = 'SELECT name FROM '.$tbl_session . ' WHERE id="'.intval($_SESSION['id_session']). '"';
  768. $rs = Database::query($sql,__FILE__,__LINE__);
  769. list($_SESSION['session_name']) = Database::fetch_array($rs);
  770. }
  771. if ($_configuration['tracking_enabled'] && !isset($_SESSION['login_as'])) {
  772. $course_tracking_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
  773. $time = api_get_datetime();
  774. //We select the last record for the current course in the course tracking table
  775. $sql="SELECT course_access_id FROM $course_tracking_table WHERE user_id=".intval($_user ['user_id'])." ORDER BY login_course_date DESC LIMIT 0,1";
  776. $result=Database::query($sql,__FILE__,__LINE__);
  777. if (Database::num_rows($result)>0) {
  778. $i_course_access_id = Database::result($result,0,0);
  779. //We update the course tracking table
  780. $sql="UPDATE $course_tracking_table " .
  781. "SET logout_course_date = '$time', " .
  782. "counter = counter+1 " .
  783. "WHERE course_access_id=".intval($i_course_access_id);
  784. Database::query($sql,__FILE__,__LINE__);
  785. } else {
  786. $sql="INSERT INTO $course_tracking_table(course_code, user_id, login_course_date, logout_course_date, counter)" .
  787. "VALUES('".$_course['sysCode']."', '".$_user['user_id']."', '$time', '$time', '1')";
  788. Database::query($sql,__FILE__,__LINE__);
  789. }
  790. }
  791. }
  792. }
  793. //////////////////////////////////////////////////////////////////////////////
  794. // COURSE / USER REL. INIT
  795. //////////////////////////////////////////////////////////////////////////////
  796. if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  797. if (isset($_user['user_id']) && $_user['user_id'] && isset($_cid) && $_cid) { // have keys to search data
  798. if (api_get_setting('use_session_mode') != 'true') {
  799. $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  800. $sql = "SELECT * FROM $course_user_table
  801. WHERE user_id = '".$_user['user_id']."'
  802. AND course_code = '$cidReq'";
  803. $result = Database::query($sql,__FILE__,__LINE__);
  804. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  805. $cuData = Database::fetch_array($result);
  806. $is_courseMember = true;
  807. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  808. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  809. api_session_register('_courseUser');
  810. } else { // this user has no status related to this course
  811. $is_courseMember = false;
  812. $is_courseAdmin = false;
  813. $is_courseTutor = false;
  814. }
  815. $is_courseAdmin = (bool) ($is_courseAdmin || $is_platformAdmin);
  816. } else {
  817. $tbl_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  818. $sql = "SELECT * FROM ".$tbl_course_user."
  819. WHERE user_id = '".$_user['user_id']."'
  820. AND course_code = '$cidReq'";
  821. $result = Database::query($sql,__FILE__,__LINE__);
  822. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  823. $cuData = Database::fetch_array($result);
  824. $_courseUser['role'] = $cuData['role' ];
  825. $is_courseMember = true;
  826. $is_courseTutor = (bool) ($cuData['tutor_id' ] == 1 );
  827. $is_courseAdmin = (bool) ($cuData['status'] == 1 );
  828. api_session_register('_courseUser');
  829. }
  830. if (empty($is_courseAdmin)) { // this user has no status related to this course
  831. // is it the session coach or the session admin ?
  832. $tbl_session = Database :: get_main_table(TABLE_MAIN_SESSION);
  833. $tbl_session_course = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE);
  834. $tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
  835. $sql = " SELECT session.id_coach, session_admin_id FROM $tbl_session session,$tbl_session_course_user session_rcru
  836. WHERE session_rcru.id_session = session.id AND session_rcru.course_code = '$_cid' AND session_rcru.id_user='{$_user['user_id']}' AND session_rcru.status = 2";
  837. /*$sql = "SELECT session.id_coach, session_admin_id
  838. FROM ".$tbl_session." as session
  839. INNER JOIN ".$tbl_session_course_user."
  840. ON session_rel_course.id_session = session.id
  841. AND session_rel_course.course_code='$_cid'";
  842. */
  843. $result = Database::query($sql,__FILE__,__LINE__);
  844. $row = Database::store_result($result);
  845. if ($row[0]['id_coach']==$_user['user_id']) {
  846. $_courseUser['role'] = 'Professor';
  847. $is_courseMember = true;
  848. $is_courseTutor = true;
  849. $is_courseCoach = true;
  850. $is_sessionAdmin = false;
  851. if (api_get_setting('extend_rights_for_coach')=='true') {
  852. $is_courseAdmin = true;
  853. } else {
  854. $is_courseAdmin = false;
  855. }
  856. api_session_register('_courseUser');
  857. } elseif ($row[0]['session_admin_id']==$_user['user_id']) {
  858. $_courseUser['role'] = 'Professor';
  859. $is_courseMember = false;
  860. $is_courseTutor = false;
  861. $is_courseAdmin = false;
  862. $is_courseCoach = false;
  863. $is_sessionAdmin = true;
  864. } else {
  865. // Check if the current user is the course coach
  866. $sql = "SELECT 1
  867. FROM ".$tbl_session_course_user."
  868. WHERE course_code='$_cid'
  869. AND id_user = '".$_user['user_id']."'
  870. AND id_session = '".api_get_session_id()."'
  871. AND status = 2";
  872. $result = Database::query($sql,__FILE__,__LINE__);
  873. if ($row = Database::fetch_array($result)) {
  874. $_courseUser['role'] = 'Professor';
  875. $is_courseMember = true;
  876. $is_courseTutor = true;
  877. $is_courseCoach = true;
  878. $is_sessionAdmin = false;
  879. if (api_get_setting('extend_rights_for_coach')=='true') {
  880. $is_courseAdmin = true;
  881. } else {
  882. $is_courseAdmin = false;
  883. }
  884. api_session_register('_courseUser');
  885. } else {
  886. if (api_get_session_id() != 0) {
  887. // Check if the user is a student is this session
  888. $sql = "SELECT * FROM ".$tbl_session_course_user."
  889. WHERE id_user = '".$_user['user_id']."'
  890. AND id_session = '".api_get_session_id()."'
  891. AND course_code = '$cidReq' AND status NOT IN(2)";
  892. $result = Database::query($sql,__FILE__,__LINE__);
  893. if (Database::num_rows($result) > 0) { // this user have a recorded state for this course
  894. while($row = Database::fetch_array($result)){
  895. $is_courseMember = true;
  896. $is_courseTutor = false;
  897. $is_courseAdmin = false;
  898. $is_sessionAdmin = false;
  899. api_session_register('_courseUser');
  900. }
  901. }
  902. } else {
  903. //unregister user
  904. $is_courseMember = false;
  905. $is_courseTutor = false;
  906. $is_courseAdmin = false;
  907. $is_sessionAdmin = false;
  908. api_session_unregister('_courseUser');
  909. //$_course['visibility'] = 0; this depends the
  910. }
  911. }
  912. }
  913. }
  914. }
  915. } else { // keys missing => not anymore in the course - user relation
  916. //// course
  917. $is_courseMember = false;
  918. $is_courseAdmin = false;
  919. $is_courseTutor = false;
  920. $is_courseCoach = false;
  921. $is_sessionAdmin = false;
  922. api_session_unregister('_courseUser');
  923. }
  924. //DEPRECATED
  925. //$is_courseAllowed=($_cid && ($_course['visibility'] || $is_courseMember || $is_platformAdmin))?true:false;
  926. //NEW
  927. if (isset($_course)) {
  928. if ($_course['visibility'] == COURSE_VISIBILITY_OPEN_WORLD)
  929. $is_allowed_in_course = true;
  930. elseif ($_course['visibility'] == COURSE_VISIBILITY_OPEN_PLATFORM && isset($_user['user_id']) && !api_is_anonymous($_user['user_id']))
  931. $is_allowed_in_course = true;
  932. elseif ($_course['visibility'] == COURSE_VISIBILITY_REGISTERED && ($is_platformAdmin || $is_courseMember))
  933. $is_allowed_in_course = true;
  934. elseif ($_course['visibility'] == COURSE_VISIBILITY_CLOSED && ($is_platformAdmin || $is_courseAdmin))
  935. $is_allowed_in_course = true;
  936. else $is_allowed_in_course = false;
  937. }
  938. // requires testing!!!
  939. // check the session visibility
  940. if ($is_allowed_in_course) {
  941. $my_session_id = api_get_session_id();
  942. //if I'm in a session
  943. //var_dump($is_platformAdmin, $is_courseTutor,api_is_coach());
  944. if ($my_session_id!=0)
  945. if (!$is_platformAdmin) {
  946. // admin and session coach are *not* affected to the invisible session mode
  947. // the coach is not affected because he can log in some days after the end date of a session
  948. $session_visibility = api_get_session_visibility($my_session_id);
  949. if ($session_visibility==SESSION_INVISIBLE)
  950. $is_allowed_in_course =false;
  951. }
  952. }
  953. // save the states
  954. api_session_register('is_courseMember');
  955. api_session_register('is_courseAdmin');
  956. //api_session_register('is_courseAllowed'); //deprecated old permission var
  957. api_session_register('is_courseTutor');
  958. api_session_register('is_allowed_in_course'); //new permission var
  959. api_session_register('is_courseCoach');
  960. api_session_register('is_sessionAdmin');
  961. } else { // continue with the previous values
  962. if (isset($_SESSION ['_courseUser'])) {
  963. $_courseUser = $_SESSION ['_courseUser'];
  964. }
  965. $is_courseMember = $_SESSION ['is_courseMember' ];
  966. $is_courseAdmin = $_SESSION ['is_courseAdmin' ];
  967. //$is_courseAllowed = $_SESSION ['is_courseAllowed']; //deprecated
  968. $is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
  969. $is_courseTutor = $_SESSION ['is_courseTutor' ];
  970. $is_courseCoach = $_SESSION ['is_courseCoach' ];
  971. }
  972. //////////////////////////////////////////////////////////////////////////////
  973. // GROUP INIT
  974. //////////////////////////////////////////////////////////////////////////////
  975. if ((isset($gidReset) && $gidReset) || (isset($cidReset) && $cidReset)) { // session data refresh requested
  976. if ($gidReq && $_cid ) { // have keys to search data
  977. $group_table = Database::get_course_table(TABLE_GROUP);
  978. $sql = "SELECT * FROM $group_table WHERE id = '$gidReq'";
  979. $result = Database::query($sql,__FILE__,__LINE__);
  980. if (Database::num_rows($result) > 0) { // This group has recorded status related to this course
  981. $gpData = Database::fetch_array($result);
  982. $_gid = $gpData ['id' ];
  983. api_session_register('_gid');
  984. } else {
  985. exit("WARNING UNDEFINED GID !! ");
  986. }
  987. } elseif (isset($_SESSION['_gid']) or isset($_gid)) { // Keys missing => not anymore in the group - course relation
  988. api_session_unregister('_gid');
  989. }
  990. } elseif (isset($_SESSION['_gid'])) { // continue with the previous values
  991. $_gid = $_SESSION ['_gid' ];
  992. } else { //if no previous value, assign caracteristic undefined value
  993. $_gid = -1;
  994. }
  995. //set variable according to student_view_enabled choices
  996. if (api_get_setting('student_view_enabled') == "true") {
  997. if (isset($_GET['isStudentView'])) {
  998. if ($_GET['isStudentView'] == 'true') {
  999. if (isset($_SESSION['studentview'])) {
  1000. if (!empty($_SESSION['studentview'])) {
  1001. // switching to studentview
  1002. $_SESSION['studentview'] = 'studentview';
  1003. }
  1004. }
  1005. } elseif ($_GET['isStudentView'] == 'false') {
  1006. if (isset($_SESSION['studentview'])) {
  1007. if (!empty($_SESSION['studentview'])) {
  1008. // switching to teacherview
  1009. $_SESSION['studentview'] = 'teacherview';
  1010. }
  1011. }
  1012. }
  1013. } elseif (!empty($_SESSION['studentview'])) {
  1014. //all is fine, no change to that, obviously
  1015. } elseif (empty($_SESSION['studentview'])) {
  1016. // We are in teacherview here
  1017. $_SESSION['studentview'] = 'teacherview';
  1018. }
  1019. }
  1020. if (isset($_cid)) {
  1021. $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
  1022. $time = api_get_datetime();
  1023. $sql="UPDATE $tbl_course SET last_visit= '$time' WHERE code='$_cid'";
  1024. Database::query($sql,__FILE__,__LINE__);
  1025. }