root/FreakAuth/tags/1.1/www/system/application/libraries/Freakauth_light.php

<?php if (!defined('BASEPATH')) exit('No direct script access allowed');
/**
 * FreakAuth_light Class
 * Security handler that provides functionality to handle login, logout,
 * registration, and reset password requests.
 * It also can verify the logged in status of 3 user classes
 *
 * => superadmin (has permissions on everything and can also create other admin)
 * => admin      (you can choose what to let him manage)
 * => user       (it is a registered user, and you can decide to give in rights
 *               to access some specific areas (controllers) of your application
 *
 * The class requires the use of
 *
 * => Database CI official library
 * => Db_session, FAL_validation and the FAL_front library (included in the download)
 * => URL, FORM and FreakAuth_light (included in the download) helpers
 *
 * The FreakAuth_light library should be auto loaded in the core classes section
 * of the autoloader.
 *
 * Passwords are encripted with md5 algorithm by the method _encode($password)
 *
 * -----------------------------------------------------------------------------
 * Copyright (C) 2007  Daniel Vecchiato (4webby.com)
 * -----------------------------------------------------------------------------
 *This library is free software; you can redistribute it and/or
 *modify it under the terms of the GNU Lesser General Public
 *License as published by the Free Software Foundation; either
 *version 2.1 of the License, or (at your option) any later version.
 *
 *This library is distributed in the hope that it will be useful,
 *but WITHOUT ANY WARRANTY; without even the implied warranty of
 *MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 *Lesser General Public License for more details.
 *
 *You should have received a copy of the GNU Lesser General Public
 *License along with this library; if not, write to the Free Software
 *Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 *------------------------------------------------------------------------------
 * @package     FreakAuth_light
 * @subpackage  Libraries
 * @category    Authentication
 * @author      Daniel Vecchiato (danfreak) & Christophe Gragnic (grahack)
 * @copyright   Copyright (c) 2007, 4webby.com
 * @license        http://www.gnu.org/licenses/lgpl.html
 * @link         http://4webby.com/freakauth
 * @version     1.1
 *
 */

// ------------------------------------------------------------------------

/**
 * Security handler that provides functionality to handle logins and logout
 * requests.  It also can verify the logged in status of a user and permissions.
 * The class requires the use of the Database and Encrypt CI libraries and the
 * URL, and CI helper.  It also requires the use of the 3rd party DB_Session
 * library.  The Auth library should be auto loaded in the core classes section
 * of the autoloader.
 *
 * Passwords are encripted with md5 algorithm.
 */
class Freakauth_light
{
    // --------------------------------------------------------------------
    
    /**
    * Function FreakAuth inizialises the class loading the right libraries,
    * helpers and models
    *
    * @uses libraries (encrypt, db_session)
    * @uses helpers (form, url, FreakAuth)
    * @uses modules (usermodel)
    */
    function Freakauth_light()
    {
        $this->CI=& get_instance();

        log_message('debug', "FreakAuth Class Initialized");

        $this->CI->load->library('db_session');
        $this->CI->load->helper('form');
        $this->CI->load->helper('url');
        $this->CI->load->helper('freakauth_light');
        $this->CI->load->model('FreakAuth_light/usertemp', 'UserTemp');
        $this->CI->load->model('usermodel', 'usermodel');
        if($this->CI->config->item('FAL_create_user_profile'))
            $this->CI->load->model('Userprofile', 'userprofile');

        $this->_init();
    }

    // --------------------------------------------------------------------
    
    /**
     * Initializes the security settings and checks for autologin
     *
     * @return boolean
     */
    function _init()
    {
        // checks if the Freakauth system is turned on
        if (!$this->CI->config->item('FAL'))
        {
            // preparing the message
            $this->CI->lang->load('freakauth');
            $website_name = $this->CI->config->item('FAL_website_name');
            $message = sprintf(
                $this->CI->lang->line('FAL_turned_off_message'),
                $website_name
            );
            $data['website_name'] = $website_name;
            $data['message'] = $message;
            echo $this->CI->load->view($this->CI->config->item('FAL_template_dir').'content/turned_off', $data, true);
            exit;
        }

    }

    // --------------------------------------------------------------------
       
    /**
     * Method used to restrict access to controllers or methods of controllers
     * to the specified category of users.
     * It requires 2 optional parameters:
     *  - the first parameter specifies the user group i.e. ('admin')
     *  - the second parameter specifies whether the area is reserved ONLY to
     *    that group (true) or if it is accessible by groups higher in the
     *    hierarchy
     *
     * example usage in a controller
     *
     * 1) $this->freakauth_light->check()
     *    this restricts access to registered users and user-groups higher in
     *    the hierarchy (i.e. admin, superadmin)
     * 2) $this->freakauth_light->check('admin')
     *    this restricts access to 'admin' users and users who belong to roles
     *    higher in the hierarchy (i.e. 'superadmin')
     * 3) $this->freakauth_light->check('admin', true)
     *    this restricts access to 'admin' users ONLY
     *
     * @param string (the role to whom the area is restricted to) $lock_to_role
     * @param boolean (true/false) $only
     */
    function check($_lock_to_role=null, $_only=null)
    {

            // check who did the request and build role hierarchy
            $_who_is = $this->CI->db_session->userdata('role');
            
            // if we have a role stored in DB session for this user
            if ($this->CI->db_session AND $this->CI->config->item('FAL') AND !empty($_who_is))
            {
                
                // gets the locked role hierarchy value
                $_hierarchy = $this->CI->config->item('FAL_roles');
                
                // if we didn't specify to who we will reserve the action
                // let's restrict it to registered users
                if ($_lock_to_role==null){$_lock_to_role='user';}
                
                // let's see who did we reserve the area to
                $_lock_hierarchy = $_hierarchy[$_lock_to_role];
                // let's see who requested to access this area
                $_request_hierarchy = $_hierarchy[$_who_is];

                // let's see if we decided to restrict access ONLY to a given category
                switch ($_only)
                {
                    case true:
                        $_request_hierarchy == $_lock_hierarchy ? $_condition = true : $_condition = false;
                        break;
                    
                    // only false or not specified    
                    default:
                        $_request_hierarchy <= $_lock_hierarchy ? $_condition = true : $_condition = false;
                        break;
                        
                }
                
                // if who did the request doesn't have enough credentials
                if ($_condition==false)
                {
                    $this->denyAccess($_who_is);
                }
            }
            // it means it is a guest because it has no role stored in DB_session
            else
            {
                $this->denyAccess($_who_is);
            }
    }

    // --------------------------------------------------------------------

    /**
     * Handles the case where the one who did the request
     * doesn't have enough credentials
     *
     * if FAL_deny_with_flash_message == true in config file, displays a flash
     * message and redirects to the referer page (or homepage if none)
     *
     * else displays the FAL_denied_page (see config file)
     * -------------------------------
     * EXAMPLE USAGE (in a controller)
     * -------------------------------
     * $this->freakauth_light->denyAccess('user')
     *
     * @param string the role of the one we are denying the access
     */
    function denyAccess($role)
    {
        $this->CI->lang->load('freakauth');
        if ($this->CI->config->item('FAL_deny_with_flash_message'))
        {
            // if visitor is a GUEST
            if ($role == '')
            {
                // First, we have to store the requested page in order
                // to serve it back to the visitor after a successful login.
                $this->CI->db_session->set_flashdata('requested_page',
                    $this->CI->uri->uri_string());
                
                // Then we redirect to the login form with a 'access denied'
                // message. Maybe if the visitor can log in,
                // he'll get some more permissions...
                $msg = $this->CI->lang->line('FAL_no_credentials_guest');
                flashMsg($msg);
                redirect($this->CI->config->item('FAL_login_uri'), 'location');
            }
            // else if visitor is a USER
            else
            {
                $msg = $this->CI->lang->line('FAL_no_credentials_user');
                flashMsg($msg);
                
                // if visitor came to this site with an http_referer
                if (isset($_SERVER['HTTP_REFERER']))
                {
                    $referer = $_SERVER['HTTP_REFERER'];
                    if (preg_match("|^".base_url()."|", $referer) == 0)
                    {
                        // if http_referer is from an external site,
                        // users are taken to the page defined in the config file
                        redirect($this->CI->config->item('FAL_denied_from_ext_location'));
                    }
                    else
                    {
                        // if we came from our website, just go to this page back
                        // but maybe we arrived here because of the
                        // 'redirect to requested page', so in order not to
                        $this->CI->db_session->keep_flashdata('requested_page');
                        header("location:".$_SERVER['HTTP_REFERER']);
                        exit();
                    }
                }
                // if visitor did not come to this site with an http_referer,
                // redirect to the page defined in the config file too
                else
                {
                    redirect($this->CI->config->item('FAL_denied_from_ext_location'), 'location');
                }
            }
        }
        else
        {
            $page = $this->CI->config->item('FAL_denied_page');
            $data['role'] = $role;
            // this is how we stop the execution
            echo $this->CI->load->view($page, $data, true);
            exit();
        }
    }
    
    
    
    // --------------------------------------------------------------------

    /**
     * Checks to see if a user is an administrator
     * uses Class Db_session method userdata
     * Returns false if FreakAuth system is not activated
     * Returns true if admin or superadmin, otherwise false
     *
     * @return true if admin/superadmin or false otherwise
     */
    function isAdmin()
    {

        if ($this->CI->db_session AND $this->CI->config->item('FAL'))
        {
            $_username = $this->CI->db_session->userdata('user_name');
            $_role = $this->CI->db_session->userdata('role');
            
            if ($_username != false && $_role != false AND ($_role=='admin' OR $_role=='superadmin'))
                
                //returns the user id
                return true;
        }
        
        // if user_id not activated or not existent
        return false;
    }

    // --------------------------------------------------------------------

    /**
     * Checks to see if an administrator has superadmin credentials
     * uses Class Db_session method userdata
     * Returns false if FreakAuth system is not activated
     * Returns true if superadmin, otherwise false
     *
     * @return boolean
     */
    function isSuperAdmin()
    {

        if ($this->CI->db_session AND $this->CI->config->item('FAL'))
        {
            $_username = $this->CI->db_session->userdata('user_name');
            $_role = $this->CI->db_session->userdata('role');
            
            if ($_username != false AND $_role != false AND $_role=='superadmin')
                
                return true;
        }

        return false;
    }
    // --------------------------------------------------------------------
    
    /**
     * Checks to see if a user is logged in
     * Returns false if FreakAuth system is not activated
     * Returns true if a valid user is logged, false otherwise
     *
     * @return boolean
     */
    function isValidUser()
    {

        if ($this->CI->db_session AND $this->CI->config->item('FAL'))
        {
            if ($this->getUserName() != '')
                return true;
        }

        // if user not activated or not existent
        return false;
    }
    
    // --------------------------------------------------------------------
    
    /**
     * Method used to used to check if a logged in members belongs to the custom
     * role (group) specified in the first parameter.
     * It requires 2 optional parameters:
     *  - the first specifies the user roles as a comma separated string
     *  - the second specifies whether we want to check to the specified roles
     *    ONLY or for AT LEAST those group membership in the hierarchy
     *    (returns true also if the logged user belongs to a group higher
     *     in the hierarchy)
     *
     * example usage in a controller
     * (see the relative helper belongsToGroup() to use it in views)
     *
     * 1) $this->freakauth_light->belongsToGroup()
     *    returns true if the visitor is logged in and he is AT LEAST an user
     * 2) $this->freakauth_light->belongsToGroup('user,editor')
     *    returns true if the visitor is logged in and he is AT LEAST an user
     *    or an editor (therefore it returns true also if he belongs to
     *    user-groups higher in the hierarchy (i.e. superadmin)
     * 3) $this->freakauth_light->belongsToGroup('admin', true)
     *    this true if the visitor is logged in and is an 'admin' ONLY
     *
     * @param string with comma separated user roles: "user,editor,moderator" $_group
     * @param boolean $_only
     * @return true/false
     */
    function belongsToGroup($_group=null, $_only=null)
    {
        if ($this->CI->db_session AND $this->CI->config->item('FAL'))
        {
            $_username = $this->CI->db_session->userdata('user_name');
            $_who_is = $this->CI->db_session->userdata('role');
            
            if ($_username != false AND $_who_is != false)
            {
                // if we didn't specify who we are looking for
                // let's look if the request comes from an 'user'
                if ($_group==null){$_group='user';}
 
                $_groups = explode(",", $_group);
    
                $_group = array();
                // eliminate possible whitespaces at the beginning and end
                // of groups names passed as parameters to this function
                foreach($_groups as $_grp)
                {
                    $_group[] = trim($_grp);
                }

                // let's see if we decided to check if
                // it belongs ONLY to a given group
                switch ($_only)
                {    
                    // $_only = true
                    case true: //we decided to check if it belongs ONLY to a given group
                        in_array($_who_is, $_group) ? $_condition = true : $_condition = false;
                        break;
                    
                    // $_only false or not specified
                    // we decided to check if it belongs AT LEAST to a given group    
                    default:
                        // gets the locked role hierarchy value
                        $_hierarchy = $this->CI->config->item('FAL_roles');
                        // let's see who we are looking for
                        

                            foreach ($_group as $value)
                            {
                                $_group_hierarchy []= $_hierarchy[$value];
                            }

                            $_group_hierarchy = max($_group_hierarchy);
                        
                        // let's see who accessed. we need to get the
                        // role-hierarchy-value of the visitor that did the request
                        $_who_hierarchy = $_hierarchy[$_who_is];

                        $_who_hierarchy <= $_group_hierarchy ? $_condition = true : $_condition = false;
                        break;
                        
                }
                
                // if who did the request doesn't have enough credentials
                if ($_condition==true)
                {
                    return TRUE;
                }
            }
        }
    // if condition==false, db_session turner off or user not found (namely not logged in) in ci_session
    return false;
    }
       
    // --------------------------------------------------------------------

    /**
     * Performs the login procedure both for user login
     * and form administrators login
     *
     * @return unknown
     */
    function login()
    {
        if (!$this->CI->config->item('FAL')) 
        {
            redirect($this->CI->config->item('FAL_login_success_action'), 'location');
        }

        $message = $this->CI->lang->line('FAL_invalid_user_message');

        if ($this->CI->db_session)
        {
            $values = $this->getLoginForm();
            $username = (isset($values['user_name']) ? $values['user_name'] : false);
            $password = (isset($values['password']) ? $values['password'] : false);

            if (($username != false) && ($password != false))
            {
                $password = $this->_encode($password);

                    // Use the input username and password and check against
                    // 'user' table to check if user banned
                    $query = $this->CI->usermodel->getUserForLogin($username, $password);


                if ($query->num_rows() == 1)
                {
                    $row = $query->row();
                    $fields = array('id', 'user_name', 'country_id', 'email',
                                  'role', 'last_visit', 'created', 'modified');
                    foreach($fields as $field) $userdata[$field] = $row->{$field};

                    // verifies if a user has not been banned from the site
                    // (i.e. user table, banned=1)
                    if ($row->{'banned'} == 0)
                    {
                        $this->_set_logindata($userdata);
                        
                        // set FLASH MESSAGE
                        // (redirection is done in FAL_front if TRUE is returned)
                        flashMsg( $this->CI->lang->line('FAL_login_message') );
                        return true;
                    }
                    else
                    {
                        $message = $this->CI->lang->line('FAL_banned_user_message');
                    }
                }
            }
        }

        // On error send user back to login page, and add error message
        // set FLASH MESSAGE
        flashMsg( $message );
        // FIXME : if false is returned, no redirection is done in FAL_front
        return false;
    }
    
    // --------------------------------------------------------------------
    /**
     * Performs the logout procedure
     *
     */
    function logout()
    {        
        // checks if a session exists
        if ($this->CI->db_session)
        {
            $_username = $this->CI->db_session->userdata('user_name');

            if ($_username != false)
                // deletes the userdata stored in DB for the user that logged out
                $this->_unset_user($_username);
        }
       
        // set FLASH MESSAGE
       $msg = $this->CI->lang->line('FAL_logout_message');
       flashMsg($msg);
        
       redirect($this->CI->config->item('FAL_logout_success_action'), 'location');
    }
    
    // --------------------------------------------------------------------
    /**
     * Performs the registration procedure
     * Returns true if successful registration, false if unsucessful
     *
     * @return boolean