login.lib.php 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use Chamilo\UserBundle\Entity\User;
  4. use ChamiloSession as Session;
  5. /**
  6. * Class Login.
  7. *
  8. * @deprecated
  9. *
  10. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  11. * @author Julio Montoya <gugli100@gmail.com>
  12. *
  13. * @package chamilo.login
  14. */
  15. class Login
  16. {
  17. /**
  18. * Get user account list.
  19. *
  20. * @param array $user array with keys: email, password, uid, loginName
  21. * @param bool $reset
  22. * @param bool $by_username
  23. *
  24. * @return string
  25. */
  26. public static function get_user_account_list($user, $reset = false, $by_username = false)
  27. {
  28. $portal_url = api_get_path(WEB_PATH);
  29. if (api_is_multiple_url_enabled()) {
  30. $access_url_id = api_get_current_access_url_id();
  31. if ($access_url_id != -1) {
  32. $url = api_get_access_url($access_url_id);
  33. $portal_url = $url['url'];
  34. }
  35. }
  36. if ($reset) {
  37. if ($by_username) {
  38. $secret_word = self::get_secret_word($user['email']);
  39. if ($reset) {
  40. $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secret_word."&id=".$user['uid'];
  41. $reset_link = Display::url($reset_link, $reset_link);
  42. } else {
  43. $reset_link = get_lang('Pass')." : $user[password]";
  44. }
  45. $user_account_list = get_lang('Your registration data')." : \n".
  46. get_lang('Username').' : '.$user['loginName']."\n".
  47. get_lang('Click here to recover your password').' : '.$reset_link;
  48. if ($user_account_list) {
  49. $user_account_list = "\n-----------------------------------------------\n".$user_account_list;
  50. }
  51. } else {
  52. foreach ($user as $this_user) {
  53. $secret_word = self::get_secret_word($this_user['email']);
  54. if ($reset) {
  55. $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secret_word."&id=".$this_user['uid'];
  56. $reset_link = Display::url($reset_link, $reset_link);
  57. } else {
  58. $reset_link = get_lang('Pass')." : $this_user[password]";
  59. }
  60. $user_account_list[] =
  61. get_lang('Your registration data')." : \n".
  62. get_lang('Username').' : '.$this_user['loginName']."\n".
  63. get_lang('Click here to recover your password').' : '.$reset_link;
  64. }
  65. if ($user_account_list) {
  66. $user_account_list = implode("\n-----------------------------------------------\n", $user_account_list);
  67. }
  68. }
  69. } else {
  70. if (!$by_username) {
  71. $user = $user[0];
  72. }
  73. $reset_link = get_lang('Pass')." : $user[password]";
  74. $user_account_list =
  75. get_lang('Your registration data')." : \n".
  76. get_lang('Username').' : '.$user['loginName']."\n".
  77. $reset_link.'';
  78. }
  79. return $user_account_list;
  80. }
  81. /**
  82. * This function sends the actual password to the user.
  83. *
  84. * @param int $user
  85. *
  86. * @return string
  87. *
  88. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  89. */
  90. public static function send_password_to_user($user, $by_username = false)
  91. {
  92. $email_subject = "[".api_get_setting('siteName')."] ".get_lang('Login request'); // SUBJECT
  93. if ($by_username) { // Show only for lost password
  94. $user_account_list = self::get_user_account_list($user, false, $by_username); // BODY
  95. $email_to = $user['email'];
  96. } else {
  97. $user_account_list = self::get_user_account_list($user); // BODY
  98. $email_to = $user[0]['email'];
  99. }
  100. $portal_url = api_get_path(WEB_PATH);
  101. if (api_is_multiple_url_enabled()) {
  102. $access_url_id = api_get_current_access_url_id();
  103. if ($access_url_id != -1) {
  104. $url = api_get_access_url($access_url_id);
  105. $portal_url = $url['url'];
  106. }
  107. }
  108. $email_body = get_lang('This is your information to connect to')." ".$portal_url."\n\n$user_account_list";
  109. // SEND MESSAGE
  110. $sender_name = api_get_person_name(
  111. api_get_setting('administratorName'),
  112. api_get_setting('administratorSurname'),
  113. null,
  114. PERSON_NAME_EMAIL_ADDRESS
  115. );
  116. $email_admin = api_get_setting('emailAdministrator');
  117. if (api_mail_html('', $email_to, $email_subject, $email_body, $sender_name, $email_admin) == 1) {
  118. return get_lang('Your password has been reset');
  119. } else {
  120. $admin_email = Display:: encrypted_mailto_link(
  121. api_get_setting('emailAdministrator'),
  122. api_get_person_name(
  123. api_get_setting('administratorName'),
  124. api_get_setting('administratorSurname')
  125. )
  126. );
  127. return sprintf(
  128. get_lang('This platform was unable to send the email. Please contact %s for more information.'),
  129. $admin_email
  130. );
  131. }
  132. }
  133. /**
  134. * Handle encrypted password, send an email to a user with his password.
  135. *
  136. * @param int user id
  137. * @param bool $by_username
  138. *
  139. * @return string
  140. *
  141. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  142. */
  143. public static function handle_encrypted_password($user, $by_username = false)
  144. {
  145. $email_subject = "[".api_get_setting('siteName')."] ".get_lang('Login request'); // SUBJECT
  146. if ($by_username) {
  147. // Show only for lost password
  148. $user_account_list = self::get_user_account_list($user, true, $by_username); // BODY
  149. $email_to = $user['email'];
  150. } else {
  151. $user_account_list = self::get_user_account_list($user, true); // BODY
  152. $email_to = $user[0]['email'];
  153. }
  154. $email_body = get_lang('Dear user')." :\n".get_lang('You have asked to reset your password. If you did not ask, then ignore this mail.')."\n";
  155. $email_body .= $user_account_list."\n-----------------------------------------------\n\n";
  156. $email_body .= get_lang('Your password is encrypted for security reasons. Thus, after pressing the link an e-mail will be sent to you again with your password.');
  157. $email_body .= "\n\n".
  158. get_lang('Sincerely').",\n".
  159. api_get_setting('administratorName')." ".
  160. api_get_setting('administratorSurname')."\n".
  161. get_lang('Portal Admin')." - ".
  162. api_get_setting('siteName');
  163. $sender_name = api_get_person_name(
  164. api_get_setting('administratorName'),
  165. api_get_setting('administratorSurname'),
  166. null,
  167. PERSON_NAME_EMAIL_ADDRESS
  168. );
  169. $email_admin = api_get_setting('emailAdministrator');
  170. $email_body = nl2br($email_body);
  171. $result = @api_mail_html(
  172. '',
  173. $email_to,
  174. $email_subject,
  175. $email_body,
  176. $sender_name,
  177. $email_admin
  178. );
  179. if ($result == 1) {
  180. return get_lang('Your password has been emailed to you.');
  181. } else {
  182. $admin_email = Display:: encrypted_mailto_link(
  183. api_get_setting('emailAdministrator'),
  184. api_get_person_name(
  185. api_get_setting('administratorName'),
  186. api_get_setting('administratorSurname')
  187. )
  188. );
  189. $message = sprintf(
  190. get_lang('This platform was unable to send the email. Please contact %s for more information.'),
  191. $admin_email
  192. );
  193. return $message;
  194. }
  195. }
  196. /**
  197. * @param User $user
  198. */
  199. public static function sendResetEmail(User $user)
  200. {
  201. $uniqueId = api_get_unique_id();
  202. $user->setConfirmationToken($uniqueId);
  203. $user->setPasswordRequestedAt(new \DateTime());
  204. Database::getManager()->persist($user);
  205. Database::getManager()->flush();
  206. $url = api_get_path(WEB_CODE_PATH).'auth/reset.php?token='.$uniqueId;
  207. $mailSubject = get_lang('Instructions for the password change procedure');
  208. $mailBody = sprintf(
  209. get_lang('You are receiving this message because you (or someone pretending to be you) have requested a new password to be generated for you.<br/>'),
  210. $url
  211. );
  212. api_mail_html(
  213. UserManager::formatUserFullName($user),
  214. $user->getEmail(),
  215. $mailSubject,
  216. $mailBody
  217. );
  218. Display::addFlash(Display::return_message(get_lang('Check your e-mail and follow the instructions.')));
  219. }
  220. /**
  221. * Gets the secret word.
  222. *
  223. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  224. */
  225. public static function get_secret_word($add)
  226. {
  227. return $secret_word = sha1($add);
  228. }
  229. /**
  230. * Resets a password.
  231. *
  232. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  233. */
  234. public static function reset_password($secret, $id, $by_username = false)
  235. {
  236. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  237. $id = intval($id);
  238. $sql = "SELECT
  239. user_id AS uid,
  240. lastname AS lastName,
  241. firstname AS firstName,
  242. username AS loginName,
  243. password,
  244. email,
  245. auth_source
  246. FROM ".$tbl_user."
  247. WHERE user_id = $id";
  248. $result = Database::query($sql);
  249. $num_rows = Database::num_rows($result);
  250. if ($result && $num_rows > 0) {
  251. $user = Database::fetch_array($result);
  252. if ($user['auth_source'] == 'extldap') {
  253. return get_lang('Could not reset password');
  254. }
  255. } else {
  256. return get_lang('Could not reset password');
  257. }
  258. if (self::get_secret_word($user['email']) == $secret) {
  259. // OK, secret word is good. Now change password and mail it.
  260. $user['password'] = api_generate_password();
  261. UserManager::updatePassword($id, $user['password']);
  262. return self::send_password_to_user($user, $by_username);
  263. } else {
  264. return get_lang('You are not allowed to see this page. Either your connection has expired or you are trying to access a page for which you do not have the sufficient privileges.');
  265. }
  266. }
  267. /**
  268. * @global bool $is_platformAdmin
  269. * @global bool $is_allowedCreateCourse
  270. * @global object $_user
  271. *
  272. * @param bool $reset
  273. */
  274. public static function init_user($user_id, $reset)
  275. {
  276. global $is_platformAdmin;
  277. global $is_allowedCreateCourse;
  278. global $_user;
  279. if (isset($reset) && $reset) { // session data refresh requested
  280. unset($_SESSION['_user']['uidReset']);
  281. $is_platformAdmin = false;
  282. $is_allowedCreateCourse = false;
  283. $_user['user_id'] = $user_id;
  284. if (isset($_user['user_id']) && $_user['user_id'] && !api_is_anonymous()) {
  285. // a uid is given (log in succeeded)
  286. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  287. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  288. $track_e_login = Database::get_main_table(TABLE_STATISTIC_TRACK_E_LOGIN);
  289. $sql = "SELECT user.*, a.user_id is_admin, UNIX_TIMESTAMP(login.login_date) login_date
  290. FROM $user_table
  291. LEFT JOIN $admin_table a
  292. ON user.user_id = a.user_id
  293. LEFT JOIN $track_e_login login
  294. ON user.user_id = login.login_user_id
  295. WHERE user.user_id = '".$_user['user_id']."'
  296. ORDER BY login.login_date DESC LIMIT 1";
  297. $result = Database::query($sql);
  298. if (Database::num_rows($result) > 0) {
  299. // Extracting the user data
  300. $uData = Database::fetch_array($result);
  301. $_user['firstName'] = $uData['firstname'];
  302. $_user['lastName'] = $uData['lastname'];
  303. $_user['mail'] = $uData['email'];
  304. $_user['official_code'] = $uData['official_code'];
  305. $_user['picture_uri'] = $uData['picture_uri'];
  306. $_user['user_id'] = $uData['user_id'];
  307. $_user['language'] = $uData['language'];
  308. $_user['auth_source'] = $uData['auth_source'];
  309. $_user['theme'] = $uData['theme'];
  310. $_user['status'] = $uData['status'];
  311. $is_platformAdmin = (bool) (!is_null($uData['is_admin']));
  312. $is_allowedCreateCourse = (bool) (($uData['status'] == 1) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == 4));
  313. ConditionalLogin::check_conditions($uData);
  314. Session::write('_user', $_user);
  315. UserManager::update_extra_field_value($_user['user_id'], 'already_logged_in', 'true');
  316. Session::write('is_platformAdmin', $is_platformAdmin);
  317. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  318. } else {
  319. header('location:'.api_get_path(WEB_PATH));
  320. //exit("WARNING UNDEFINED UID !! ");
  321. }
  322. } else { // no uid => logout or Anonymous
  323. Session::erase('_user');
  324. Session::erase('_uid');
  325. }
  326. Session::write('is_platformAdmin', $is_platformAdmin);
  327. Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
  328. } else { // continue with the previous values
  329. $_user = $_SESSION['_user'];
  330. $is_platformAdmin = $_SESSION['is_platformAdmin'];
  331. $is_allowedCreateCourse = $_SESSION['is_allowedCreateCourse'];
  332. }
  333. }
  334. /**
  335. * Returns true if user exists in the platform when asking the password.
  336. *
  337. * @param string $username (email or username)
  338. *
  339. * @return array|bool
  340. */
  341. public static function get_user_accounts_by_username($username)
  342. {
  343. if (strpos($username, '@')) {
  344. $username = api_strtolower($username);
  345. $email = true;
  346. } else {
  347. $username = api_strtolower($username);
  348. $email = false;
  349. }
  350. if ($email) {
  351. $condition = "LOWER(email) = '".Database::escape_string($username)."' ";
  352. } else {
  353. $condition = "LOWER(username) = '".Database::escape_string($username)."'";
  354. }
  355. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  356. $query = "SELECT
  357. user_id AS uid,
  358. lastname AS lastName,
  359. firstname AS firstName,
  360. username AS loginName,
  361. password,
  362. email,
  363. status AS status,
  364. official_code,
  365. phone,
  366. picture_uri,
  367. creator_id,
  368. auth_source
  369. FROM $tbl_user
  370. WHERE ( $condition AND active = 1) ";
  371. $result = Database::query($query);
  372. $num_rows = Database::num_rows($result);
  373. if ($result && $num_rows > 0) {
  374. return Database::fetch_assoc($result);
  375. }
  376. return false;
  377. }
  378. }