diff options
Diffstat (limited to 'modules/user/helpers/user.php')
| -rw-r--r-- | modules/user/helpers/user.php | 195 |
1 files changed, 185 insertions, 10 deletions
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php index 5ef2b726..e7e75d64 100644 --- a/modules/user/helpers/user.php +++ b/modules/user/helpers/user.php @@ -24,22 +24,98 @@ * Note: by design, this class does not do any permission checking. */ class user_Core { + static function get_login_form($url) { + $form = new Forge($url, "", "post", array("id" => "g-login-form")); + $form->set_attr('class', "g-narrow"); + $group = $form->group("login")->label(t("Login")); + $group->input("name")->label(t("Username"))->id("g-username")->class(null); + $group->password("password")->label(t("Password"))->id("g-password")->class(null); + $group->inputs["name"]->error_messages("invalid_login", t("Invalid name or password")); + $group->submit("")->value(t("Login")); + return $form; + } + + /** + * Make sure that we have a session and group_ids cached in the session. + */ + static function load_user() { + $session = Session::instance(); + if (!($user = $session->get("user"))) { + $session->set("user", $user = user::guest()); + } + + // The installer cannot set a user into the session, so it just sets an id which we should + // upconvert into a user. + if ($user === 2) { + $user = model_cache::get("user", 2); + user::login($user); + $session->set("user", $user); + } + + if (!$session->get("group_ids")) { + $ids = array(); + foreach ($user->groups as $group) { + $ids[] = $group->id; + } + $session->set("group_ids", $ids); + } + } + + /** + * Return the array of group ids this user belongs to + * + * @return array + */ + static function group_ids() { + return Session::instance()->get("group_ids", array(1)); + } + + /** + * Return the active user. If there's no active user, return the guest user. + * + * @return User_Model + */ + static function active() { + // @todo (maybe) cache this object so we're not always doing session lookups. + $user = Session::instance()->get("user", null); + if (!isset($user)) { + // Don't do this as a fallback in the Session::get() call because it can trigger unnecessary + // work. + $user = user::guest(); + } + return $user; + } + /** * Return the guest user. * - * @return User_Model the user object + * @todo consider caching + * + * @return User_Model */ static function guest() { return model_cache::get("user", 1); } /** + * Change the active user. + * + * @return User_Model + */ + static function set_active($user) { + $session = Session::instance(); + $session->set("user", $user); + $session->delete("group_ids"); + self::load_user(); + } + + /** * Create a new user. * * @param string $name * @param string $full_name * @param string $password - * @return User_Definition the user object + * @return User_Model */ static function create($name, $full_name, $password) { $user = ORM::factory("user")->where("name", $name)->find(); @@ -60,9 +136,44 @@ class user_Core { } /** - * Hash the password to the internal value - * @param string $password the user password - * @param string The hashed equivalent + * Is the password provided correct? + * + * @param user User Model + * @param string $password a plaintext password + * @return boolean true if the password is correct + */ + static function is_correct_password($user, $password) { + $valid = $user->password; + + // Try phpass first, since that's what we generate. + if (strlen($valid) == 34) { + require_once(MODPATH . "user/lib/PasswordHash.php"); + $hashGenerator = new PasswordHash(10, true); + return $hashGenerator->CheckPassword($password, $valid); + } + + $salt = substr($valid, 0, 4); + // Support both old (G1 thru 1.4.0; G2 thru alpha-4) and new password schemes: + $guess = (strlen($valid) == 32) ? md5($password) : ($salt . md5($salt . $password)); + if (!strcmp($guess, $valid)) { + return true; + } + + // Passwords with <&"> created by G2 prior to 2.1 were hashed with entities + $sanitizedPassword = html::specialchars($password, false); + $guess = (strlen($valid) == 32) ? md5($sanitizedPassword) + : ($salt . md5($salt . $sanitizedPassword)); + if (!strcmp($guess, $valid)) { + return true; + } + + return false; + } + + /** + * Create the hashed passwords. + * @param string $password a plaintext password + * @return string hashed password */ static function hash_password($password) { require_once(MODPATH . "user/lib/PasswordHash.php"); @@ -71,24 +182,88 @@ class user_Core { } /** + * Log in as a given user. + * @param object $user the user object. + */ + static function login($user) { + $user->login_count += 1; + $user->last_login = time(); + $user->save(); + + user::set_active($user); + module::event("user_login", $user); + } + + /** + * Log out the active user and destroy the session. + * @param object $user the user object. + */ + static function logout() { + $user = user::active(); + if (!$user->guest) { + try { + Session::instance()->destroy(); + } catch (Exception $e) { + Kohana::log("error", $e); + } + module::event("user_logout", $user); + } + } + + /** * Look up a user by id. * @param integer $id the user id - * @return User_Definition the user object, or null if the id was invalid. + * @return User_Model the user object, or null if the id was invalid. */ static function lookup($id) { - return self::lookup_by_field("id", $id); + return self::_lookup_user_by_field("id", $id); } /** * Look up a user by name. * @param integer $name the user name - * @return User_Definition the user object, or null if the name was invalid. + * @return User_Model the user object, or null if the name was invalid. */ static function lookup_by_name($name) { - return self::lookup_by_field("name", $name); + return self::_lookup_user_by_field("name", $name); + } + + /** + * Look up a user by hash. + * @param integer $hash the user hash value + * @return User_Model the user object, or null if the name was invalid. + */ + static function lookup_by_hash($hash) { + return self::_lookup_user_by_field("hash", $hash); + } + + /** + * List the users + * @param mixed filters (@see Database.php + * @return array the user list. + */ + static function get_user_list($filter=array()) { + $user = ORM::factory("user"); + + foreach($filter as $method => $args) { + switch ($method) { + case "in": + $user->in($args[0], $args[1]); + break; + default: + $user->$method($args); + } + } + return $user->find_all(); } - static function lookup_by_field($field_name, $value) { + /** + * Look up a user by field value. + * @param string search field + * @param string search value + * @return User_Core the user object, or null if the name was invalid. + */ + private static function _lookup_user_by_field($field_name, $value) { try { $user = model_cache::get("user", $value, $field_name); if ($user->loaded) { |