<?php
class User
{
private static $user = false;
private static $organization = NULL;
private static $isShib = false;
private static $isInDb = false;
private static $isAnonymous = false;
public static function isLoggedIn()
{
return self::$user !== false;
}
public static function isShibbolethAuth()
{
return self::$isShib;
}
public static function isInDatabase()
{
return self::$isInDb;
}
public static function isLocalOnly()
{
return self::$user !== false && self::$isShib === false;
}
public static function isAnonymous()
{
return self::$isAnonymous;
}
public static function getData()
{
return self::$user;
}
public static function getId()
{
if (!isset(self::$user['userid']))
return false;
return (int)self::$user['userid'];
}
public static function getMail()
{
if (!isset(self::$user['email']))
return false;
return self::$user['email'];
}
public static function getName()
{
if (!self::isLoggedIn())
return false;
return self::$user['firstname'] . ' ' . self::$user['lastname'];
}
public static function getLastName()
{
if (!self::isLoggedIn())
return false;
return self::$user['lastname'];
}
public static function hasFullName()
{
return self::$user !== false && !empty(self::$user['firstname']) && !empty(self::$user['lastname']);
}
public static function isTutor()
{
return isset(self::$user['role']) && self::$user['role'] === 'tutor';
}
public static function getOrganizationId()
{
$org = self::getOrganization();
if (!isset($org['organizationid']))
return false;
return $org['organizationid'];
}
public static function getOrganizationName()
{
$org = self::getOrganization();
if (!isset($org['name']))
return false;
return $org['name'];
}
public static function getRemoteOrganizationId()
{
if (empty(self::$user['organization']))
return false;
return self::$user['organization'];
}
public static function getOrganization()
{
if (!self::isLoggedIn())
return false;
if (is_null(self::$organization)) {
self::$organization = Database::queryFirst('SELECT organizationid, name FROM satellite_suffix '
. ' INNER JOIN satellite USING (organizationid) '
. ' WHERE suffix = :org LIMIT 1',
array('org' => self::$user['organization']));
}
return self::$organization;
}
public static function load()
{
if (self::isLoggedIn())
return true;
$hasSession = Session::load();
if (empty($_SERVER['persistent-id'])) {
if (Session::getUid() === false)
return false;
// Try user from local DB
self::$user = Database::queryFirst('SELECT userid, shibid, login, organizationid AS organization, firstname, lastname, email FROM user WHERE userid = :uid LIMIT 1', array('uid' => Session::getUid()));
self::$isInDb = self::$user !== false;
return self::$isInDb;
}
// Try bwIDM etc.
if (!$hasSession) {
Session::create();
Session::set('token', md5(mt_rand() . $_SERVER['REMOTE_ADDR'] . microtime(true) . $_SERVER['persistent-id'] . mt_rand()));
Session::save();
}
self::$isShib = true;
if (!isset($_SERVER['sn'])) $_SERVER['sn'] = '';
if (!isset($_SERVER['givenName'])) $_SERVER['givenName'] = '';
if (!isset($_SERVER['mail'])) $_SERVER['mail'] = '';
$shibId = md5($_SERVER['persistent-id']);
self::$user = array(
'userid' => 0,
'shibid' => $shibId,
'login' => NULL,
'firstname' => $_SERVER['givenName'],
'lastname' => $_SERVER['sn'],
'email' => $_SERVER['mail'],
);
// Figure out whether the user should be considered a tutor
if (isset($_SERVER['affiliation']) && preg_match('/(^|;)employee@/', $_SERVER['affiliation']))
self::$user['role'] = 'tutor';
elseif (isset($_SERVER['entitlement']) && strpos(";{$_SERVER['entitlement']};", ';http://bwidm.de/entitlement/bwLehrpool;') !== false)
self::$user['role'] = 'tutor';
// Try to figure out organization
if (isset($_SERVER['affiliation']) && preg_match('/@([a-zA-Z\-\._]+)(;|$)/', $_SERVER['affiliation'], $out))
self::$user['organization'] = $out[1];
// Get matching db entry if any
$user = Database::queryFirst('SELECT userid, login, firstname, lastname, email, fixedname FROM user WHERE shibid = :shibid LIMIT 1', array('shibid' => $shibId));
if ($user === false) {
// No match in database, user is not signed up
return true;
}
if (Session::getUid() === false) {
Session::setUid($user['userid']);
Session::save();
}
// Already signed up, see if we can fetch missing fields from DB
self::$user['login'] = $user['login'];
self::$isInDb = true;
self::$isAnonymous = (empty($user['firstname']) && empty($user['lastname']));
foreach (array('firstname', 'lastname', 'email') as $key) {
if (empty(self::$user[$key]))
self::$user[$key] = $user[$key];
}
return true;
}
public static function deploy($anonymous)
{
if (empty(self::$user['shibid']))
Util::traceError('NO SHIBID');
if ($anonymous) {
Database::exec("INSERT INTO user (shibid, login, organizationid, firstname, lastname, email) "
. " VALUES (:shibid, :shibid, :org, '', '', '') "
. " ON DUPLICATE KEY UPDATE firstname = '', lastname = '', email = ''", array(
'shibid' => self::$user['shibid'],
'org' => self::getOrganizationId()
));
} else {
Database::exec("INSERT INTO user (shibid, login, organizationid, firstname, lastname, email) "
. " VALUES (:shibid, :shibid, :org, :firstname, :lastname, :email) "
. " ON DUPLICATE KEY UPDATE firstname = VALUES(firstname), lastname = VALUES(lastname), email = VALUES(email)", array(
'shibid' => self::$user['shibid'],
'firstname' => self::$user['firstname'],
'lastname' => self::$user['lastname'],
'email' => self::$user['email'],
'org' => self::getOrganizationId()
));
}
}
public static function updatePassword($pass)
{
if (!self::isLoggedIn() || self::$isShib || !self::$isInDb)
return false;
$pw = Crypto::hash6($pass);
$ret = Database::exec('UPDATE user SET password = :pass WHERE userid = :user LIMIT 1', array(
'pass' => $pw,
'user' => self::getId()
));
return $ret == 1;
}
public static function updateMail($mail)
{
if (!self::isLoggedIn() || self::$isShib || !self::$isInDb)
return false;
$ret = Database::exec('UPDATE user SET email = :mail WHERE userid = :user LIMIT 1', array(
'mail' => $mail,
'user' => self::getId()
));
return $ret == 1 || $mail === self::get('email');
}
public static function login($user, $pass)
{
$ret = Database::queryFirst('SELECT userid, password FROM user WHERE login = :user LIMIT 1', array(':user' => $user));
if ($ret === false)
return false;
if (!Crypto::verify($pass, $ret['password']))
return false;
Session::create();
Session::setUid($ret['userid']);
Session::set('token', md5(rand() . time() . mt_rand() . $_SERVER['REMOTE_ADDR'] . rand() . $_SERVER['REMOTE_PORT'] . rand() . $_SERVER['HTTP_USER_AGENT'] . microtime(true)));
Session::save();
return true;
}
public static function logout()
{
foreach ($_COOKIE as $name => $value) {
if (substr($name, 0, 5) !== '_shib')
continue;
@setcookie($name, '', time() - 8640000, null, null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true);
}
Session::delete();
if (self::$isShib) {
Header('Location: ?do=Logout&noredirect=yes');
} else {
Header('Location: ?do=Main');
}
exit(0);
}
}
