276 lines
8.6 KiB
PHP
276 lines
8.6 KiB
PHP
|
<?php defined('SYSPATH') or die('No direct access allowed.');
|
||
|
|
|
||
|
|
/**
|
||
|
|
* OSB Auth driver.
|
||
|
|
*
|
||
|
|
* @package OSB
|
||
|
|
* @category Helpers
|
||
|
|
* @author Deon George
|
||
|
|
* @copyright (c) 2009-2013 Open Source Billing
|
||
|
|
* @license http://dev.osbill.net/license.html
|
||
|
|
*/
|
||
|
|
class Auth_OSB extends Auth_ORM {
|
||
|
|
/**
|
||
|
|
* OSB authentication is controlled via database queries.
|
||
|
|
*
|
||
|
|
* This method can be used to test two situations:
|
||
|
|
* 1) Is the user logged in? ($role == FALSE)
|
||
|
|
* 2) Can the user run the current controller->action ($role == TRUE)
|
||
|
|
*
|
||
|
|
* @param boolean If authentication should be done for this module:method (ie: controller:action).
|
||
|
|
* @return boolean
|
||
|
|
*/
|
||
|
|
public function logged_in($role=NULL,$debug=NULL) {
|
||
|
|
$status = FALSE;
|
||
|
|
|
||
|
|
// Get the user from the session
|
||
|
|
$uo = $this->get_user();
|
||
|
|
|
||
|
|
// If we are not a valid user object, then we are not logged in
|
||
|
|
if (is_object($uo) AND ($uo instanceof Model_Account) AND $uo->loaded()) {
|
||
|
|
if (Config::sitemode() == Kohana::DEVELOPMENT)
|
||
|
|
SystemMessage::add(array('title'=>'Debug','type'=>'debug','body'=>Debug::vars(array('user'=>$uo->username,'r'=>$role))));
|
||
|
|
|
||
|
|
if (! empty($role)) {
|
||
|
|
// Get the module details
|
||
|
|
$mo = ORM::factory('Module',array('name'=>Request::current()->controller()));
|
||
|
|
if (! $mo->loaded() OR ! $mo->status) {
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>'Module is not defined or active in the Database',
|
||
|
|
'type'=>'warning',
|
||
|
|
'body'=>sprintf('Module not defined: %s',Request::current()->controller()),
|
||
|
|
));
|
||
|
|
|
||
|
|
} else {
|
||
|
|
if (Request::current()->directory())
|
||
|
|
$method_name = sprintf('%s_%s',Request::current()->directory(),Request::current()->action());
|
||
|
|
else
|
||
|
|
$method_name = Request::current()->action();
|
||
|
|
|
||
|
|
// Get the method number
|
||
|
|
$mmo = ORM::factory('Module_Method',array('module_id'=>$mo->id,'name'=>$method_name));
|
||
|
|
if (! $mmo->loaded()) {
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>'Method is not defined or active in the Database',
|
||
|
|
'type'=>'warning',
|
||
|
|
'body'=>sprintf('Method not defined: %s for %s',Request::current()->action(),$mo->name),
|
||
|
|
));
|
||
|
|
|
||
|
|
} else {
|
||
|
|
// If the role has the authorisation to run the method
|
||
|
|
$gmo = ORM::factory('Group_Method')
|
||
|
|
->where('method_id','=',$mmo->id);
|
||
|
|
|
||
|
|
$roles = '';
|
||
|
|
foreach ($gmo->find_all() as $gm) {
|
||
|
|
$roles .= ($roles ? '|' : '').$gm->group->name;
|
||
|
|
|
||
|
|
// $gm->group->id == 0 means all users.
|
||
|
|
if ($gm->group->id == 0 OR $uo->has_any('group',$gm->group->list_childgrps(TRUE))) {
|
||
|
|
$status = TRUE;
|
||
|
|
$roles = '';
|
||
|
|
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (! $status) {
|
||
|
|
if (Config::sitemode() == Kohana::DEVELOPMENT)
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>'User is not authorised in Database',
|
||
|
|
'type'=>'debug',
|
||
|
|
'body'=>sprintf('Role(s) checked: %s<br/>User: %s</br>Module: %s<br/>Method: %s',$roles,$uo->username,$mo->name,$mmo->name),
|
||
|
|
));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Config::sitemode() == Kohana::DEVELOPMENT)
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>'Debug',
|
||
|
|
'type'=>'debug',
|
||
|
|
'body'=>sprintf('User: <b>%s</b>, Module: <b>%s</b>, Method: <b>%s</b>, Role: <b>%s</b>, Status: <b>%s</b>, Data: <b>%s</b>',
|
||
|
|
$uo->username,Request::current()->controller(),Request::current()->action(),$role,$status,$debug)));
|
||
|
|
|
||
|
|
// There is no role, so the method should be allowed to run as anonymous
|
||
|
|
} else {
|
||
|
|
if (Config::sitemode() == Kohana::DEVELOPMENT)
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>'Debug',
|
||
|
|
'type'=>'debug',
|
||
|
|
'body'=>sprintf('User: <b>%s</b>, Module: <b>%s</b>, Method: <b>%s</b>, Status: <b>%s</b>, Data: <b>%s</b>',
|
||
|
|
$uo->username,Request::current()->controller(),Request::current()->action(),'No Role Default Access',$debug)));
|
||
|
|
|
||
|
|
$status = TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
} else {
|
||
|
|
if (Config::sitemode() == Kohana::DEVELOPMENT)
|
||
|
|
SystemMessage::add(array('title'=>'Debug','type'=>'debug','body'=>'No user logged in'));
|
||
|
|
}
|
||
|
|
|
||
|
|
return $status;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Gets the currently logged in user from the session.
|
||
|
|
* Returns NULL if no user is currently logged in.
|
||
|
|
*
|
||
|
|
* @param boolean Check token users too
|
||
|
|
* @return mixed
|
||
|
|
*/
|
||
|
|
public function get_user($default=NULL,$tokenuser=TRUE) {
|
||
|
|
// Get the current user
|
||
|
|
$uo = parent::get_user($default);
|
||
|
|
|
||
|
|
// If we are not logged in, see if there is token for the user
|
||
|
|
if (is_null($uo) AND $tokenuser AND ($token=Session::instance()->get('token')) OR (! empty($_REQUEST['token']) AND $token=$_REQUEST['token']))
|
||
|
|
$uo = $this->_get_token_user($token);
|
||
|
|
|
||
|
|
return $uo;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Get the user that a token applies to
|
||
|
|
*
|
||
|
|
* This will check that the token is valid (not expired and for the request)
|
||
|
|
*
|
||
|
|
* @param $token The token
|
||
|
|
* @return Model_Account|NULL The user that the token is valid for.
|
||
|
|
*/
|
||
|
|
private function _get_token_user($token) {
|
||
|
|
// This has been implemented, as we sometimes we seem to come here twice
|
||
|
|
static $uo = NULL;
|
||
|
|
|
||
|
|
if (! is_null($uo))
|
||
|
|
return $uo;
|
||
|
|
|
||
|
|
$mmto = ORM::factory('Module_Method_Token',array('token'=>$token));
|
||
|
|
|
||
|
|
// Ignore the token if it doesnt exist.
|
||
|
|
if ($mmto->loaded()) {
|
||
|
|
// Check that the token is for this URI
|
||
|
|
$mo = ORM::factory('Module',array('name'=>Request::current()->controller()));
|
||
|
|
$mmo = ORM::factory('Module_Method',array(
|
||
|
|
'module_id'=>$mo->id,
|
||
|
|
'name'=>Request::current()->directory() ? sprintf('%s_%s',Request::current()->directory(),Request::current()->action()) : Request::current()->action()
|
||
|
|
));
|
||
|
|
|
||
|
|
// Ignore the token if this is not the right method.
|
||
|
|
if ($mmo->id == $mmto->method_id) {
|
||
|
|
if (! is_null($mmto->date_expire) AND $mmto->date_expire < time()) {
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>_('Token Not Valid'),
|
||
|
|
'type'=>'warning',
|
||
|
|
'body'=>_('Token expired')));
|
||
|
|
|
||
|
|
// @todo Log the token deletion
|
||
|
|
Session::instance()->delete('token');
|
||
|
|
$mmto->delete();
|
||
|
|
|
||
|
|
} elseif (! is_null($mmto->uses) AND $mmto->uses < 1) {
|
||
|
|
SystemMessage::add(array(
|
||
|
|
'title'=>_('Token Not Valid'),
|
||
|
|
'type'=>'warning',
|
||
|
|
'body'=>_('Token expired')));
|
||
|
|
|
||
|
|
// @todo Log the token deletion
|
||
|
|
Session::instance()->delete('token');
|
||
|
|
$mmto->delete();
|
||
|
|
|
||
|
|
} else {
|
||
|
|
// If this is a usage count token, reduce the count.
|
||
|
|
if (! is_null($mmto->uses))
|
||
|
|
$mmto->uses -= 1;
|
||
|
|
|
||
|
|
// Record the date this token was used
|
||
|
|
$mmto->date_last = time();
|
||
|
|
$mmto->save();
|
||
|
|
|
||
|
|
Session::instance()->set('token',$token);
|
||
|
|
|
||
|
|
$uo = ORM::factory('Account',$mmto->account_id);
|
||
|
|
$uo->log(sprintf('Token %s used for method %s [%s]',$mmto->token,$mmto->module_method->name(),Request::current()->param('id')));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return $uo;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Logs a user in.
|
||
|
|
*
|
||
|
|
* @param string username
|
||
|
|
* @param string password
|
||
|
|
* @param boolean enable autologin
|
||
|
|
* @return boolean
|
||
|
|
*/
|
||
|
|
protected function _login($user,$password,$remember) {
|
||
|
|
if (! is_object($user)) {
|
||
|
|
$username = $user;
|
||
|
|
|
||
|
|
// Load the user
|
||
|
|
$user = ORM::factory('Account');
|
||
|
|
$user->where('username','=',$username)->find();
|
||
|
|
|
||
|
|
// If no user loaded, return
|
||
|
|
if (! $user->loaded())
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Create a hashed password
|
||
|
|
if (is_string($password))
|
||
|
|
$password = $this->hash($password);
|
||
|
|
|
||
|
|
// If the passwords match, perform a login
|
||
|
|
if ($user->status AND $user->has_any('group',ORM::factory('Group',array('name'=>'Registered Users'))->list_childgrps(TRUE)) AND $user->password === $password) {
|
||
|
|
|
||
|
|
// @todo This is not currently used.
|
||
|
|
if ($remember === TRUE) {
|
||
|
|
// Create a new autologin token
|
||
|
|
$token = ORM::factory('User_Token');
|
||
|
|
|
||
|
|
// Set token data
|
||
|
|
$token->user_id = $user->id;
|
||
|
|
$token->expires = time() + $this->_config['lifetime'];
|
||
|
|
$token->save();
|
||
|
|
|
||
|
|
// Set the autologin cookie
|
||
|
|
Cookie::set('authautologin', $token->token, $this->_config['lifetime']);
|
||
|
|
}
|
||
|
|
|
||
|
|
// Record our session ID, we may need to update our DB when we get a new ID
|
||
|
|
$oldsess = session_id();
|
||
|
|
|
||
|
|
// Finish the login
|
||
|
|
$this->complete_login($user);
|
||
|
|
|
||
|
|
// Do we need to update databases with our new sesion ID
|
||
|
|
$sct = Kohana::$config->load('config')->session_change_trigger;
|
||
|
|
if (session_id() != $oldsess AND count($sct))
|
||
|
|
foreach ($sct as $t => $c)
|
||
|
|
if (Config::module_exist($t))
|
||
|
|
foreach (ORM::factory(ucwords($t))->where($c,'=',$oldsess)->find_all() as $o)
|
||
|
|
$o->set('session_id',session_id())
|
||
|
|
->update();
|
||
|
|
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Login failed
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Determine if a user is authorised to view an account
|
||
|
|
*
|
||
|
|
* @param Model_Account Account Ojbect to validate if the current user has access
|
||
|
|
* @return boolean TRUE if authorised, FALSE if not.
|
||
|
|
*/
|
||
|
|
public function authorised(Model_Account $ao) {
|
||
|
|
return (($uo = $this->get_user()) AND $uo->loaded() AND ($uo == $ao OR in_array($ao->id,$uo->RTM->customers($uo->RTM))));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
?>
|