lib/security.lib.php

   1 <?php
   2 /*
   3         (c) 2005 Joe Presbrey
   4 */
   5
   6 require_once('mitsql.lib.php');
   7
   8 class Login {
   9         private $id, $u, $p;
  10     private $info;
  11     function Login($u, $p=null) {
  12                 if (empty($u)) return;
  13                 $this->u = $u;
  14                 $this->p = $p;
  15                 if ((string)intval($u)===(string)$u) {
  16                         $this->id = $u;
  17                         $opt = sprintf(" Username = '%s' OR UserId = '%s'", mysql_escape_string($u), mysql_escape_string($u));
  18                 } else {
  19                         $opt = sprintf(" Username = '%s'", mysql_escape_string($u));
  20                         $opt .= (is_null($p)?'':sprintf(" AND Password='%s'", mysql_escape_string(base64_encode($p))));
  21                 }
  22         $sql = sprintf("SELECT UserId, Username, Name, Email, UL, bEnabled
  23                         FROM User
  24                         WHERE %s", $opt);
  25         $r = fetchRows(DBSelect($sql),'UserId');
  26                 $this->info = count($r)?array_shift($r):$r;
  27         }
  28     function exists() {
  29         return count($this->info);
  30     }
  31         function isValid() {
  32                 return $this->getUL()>0;
  33         }
  34     function isEnabled() {
  35         return $this->exists() && $this->info['bEnabled']==1;
  36     }
  37     function canLogin() {
  38         return $this->isEnabled() && $this->isValid();
  39     }
  40     function canSignup() {
  41         return !$this->isEnabled() && $this->isValid();
  42     }
  43     function getUserId() {
  44         return $this->exists()?$this->info['UserId']:'';
  45     }
  46     function getUsername() {
  47         return $this->exists()?$this->info['Username']:'';
  48     }
  49     function getName() {
  50         return $this->exists()?$this->info['Name']:'';
  51     }
  52     function getEmail() {
  53         return $this->exists()?$this->info['Email']:'';
  54     }
  55     function getUL() {
  56         return $this->exists()?$this->info['UL']:'';
  57     }
  58     function expire() {
  59         $this->info = null;
  60     }
  61     function refresh() {
  62                 if (!empty($this->id)) {
  63                         $this->Login($this->id);
  64                 } else {
  65                         $this->Login($this->u,$this->p);
  66                 }
  67     }
  68     function update($name=null,$email=null) {
  69         if (!$this->exists()) return;
  70         $arr = array();
  71                 if ($name == $this->getName()) $name = null;
  72                 if ($email == $this->getEmail()) $email = null;
  73         is_null($name) || $arr['Name'] = $name;
  74         is_null($email) || $arr['Email'] = $email;
  75                 $upd = buildSQLSet($arr);
  76         $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
  77                         $upd, mysql_escape_string($this->getUserId()));
  78                 if (!empty($upd) && $upd != 'SET')
  79                         DBUpdate($sql);
  80                 if (isset($arr['Name']))
  81                         $this->info['Name'] = $arr['Name'];
  82                 if (isset($arr['Email']))
  83                         $this->info['Email'] = $arr['Email'];
  84         }
  85 }
  86
  87 class User {
  88         private $userId;
  89         private $info;
  90         private $dblist;
  91     function User($userId) {
  92                 $this->userId = $userId;
  93         $sql = sprintf("SELECT User.UserId, Username, Name, Email, UL, bEnabled, nBytesSoft, nBytesHard, nBytes, nDatabases, nDatabasesHard, IF(nBytes>nBytesHard,1,0) AS bOverQuota
  94                         FROM User
  95                                                 INNER JOIN UserQuota ON User.UserId = UserQuota.UserId
  96                                                 INNER JOIN UserStat ON User.UserId = UserStat.UserId
  97                         WHERE User.UserId = '%s'",
  98                         mysql_escape_string($userId));
  99         $r = fetchRows(DBSelect($sql),'UserId');
 100         $this->info = count($r)?array_shift($r):$r;
 101                 $this->dblist = $this->getDBList();
 102     }
 103         function refresh() {
 104                 unset($this->dblist);
 105                 $this->User($this->userId);
 106                 /*
 107         $sql = sprintf("SELECT UserId, Username, Name, Email, UL, bEnabled
 108                         FROM User
 109                         WHERE UserId = '%s'",
 110                         mysql_escape_string($this->userId));
 111         $r = fetchRows(DBSelect($sql),'UserId');
 112         $this->info = count($r)?array_shift($r):$r;
 113                 unset($this->dblist);
 114                 $this->getDBList();
 115                 */
 116         }
 117     function exists() {
 118         return count($this->info);
 119     }
 120     function getUserId() {
 121         return $this->exists()?$this->info['UserId']:'';
 122     }
 123     function getUsername() {
 124         return $this->exists()?$this->info['Username']:'';
 125     }
 126     function isOverQuota() {
 127         return $this->exists()?($this->info['bOverQuota']>0?true:false):'';
 128     }
 129     function getDBQuotaHard() {
 130         return $this->exists()?$this->info['nDatabasesHard']:0;
 131     }
 132     function getBytes() {
 133         if($this->exists()) {
 134                         $arr['nBytes'] = $this->info['nBytes'];
 135                         $arr['nBytesSoft'] = $this->info['nBytesSoft'];
 136                         $arr['nBytesHard'] = $this->info['nBytesHard'];
 137                         return $arr;
 138                 }
 139     }
 140         function setPassword($pwd) {
 141                 $arr['Password'] = base64_encode($pwd);
 142         $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
 143                         buildSQLSet($arr), mysql_escape_string($this->getUserId()));
 144         DBUpdate($sql);
 145                 $sql = sprintf('SET PASSWORD FOR \'%s\'@\'%%\'=PASSWORD(\'%s\')',
 146                                                 mysql_escape_string($this->getUsername()),
 147                                                 mysql_escape_string($pwd));
 148                 DBSet($sql);
 149         }
 150         function signup($pwd) {
 151                 $this->pass = $pwd;
 152                 $arr['Password'] = base64_encode($pwd);
 153                 $arr['bEnabled'] = 1;
 154                 $arr['dSignup'] = 'NOW()';
 155         $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
 156                         buildSQLSet($arr), mysql_escape_string($this->getUserId()));
 157         DBUpdate($sql);
 158
 159                 $this->setUsage();
 160                 $this->setAccess();
 161         }
 162         function setUsage($yes=true) {
 163                 $verb = $yes?'GRANT':'REVOKE';
 164                 $prep = $yes?'TO':'FROM';
 165                 $suffix = $yes?sprintf("IDENTIFIED BY '%s'",mysql_escape_string($this->pass)):'';
 166                 $sql = sprintf("%s USAGE ON * . * %s '%s'@'%s' %s",
 167                                                 mysql_escape_string($verb),
 168                                                 mysql_escape_string($prep),
 169                                                 mysql_escape_string($this->getUsername()),
 170                                                 '%',
 171                                                 $suffix);
 172                 DBGrant($sql);
 173         }
 174         function setAccess($db=null,$yes=true) {
 175                 $verb = $yes?'GRANT':'REVOKE';
 176                 $prep = $yes?'TO':'FROM';
 177                 if (is_null($db)) {
 178                         $dbs = $this->getDBList();
 179                 } else {
 180                         $dbs[] = array('Name'=>$db);
 181                 }
 182                 foreach($dbs as $db) {
 183                         $name = $db['Name'];
 184                         $sql = sprintf("%s ALL PRIVILEGES ON `%s` . * %s '%s'@'%s'",
 185                                                         mysql_escape_string($verb),
 186                                                         mysql_escape_string($name),
 187                                                         mysql_escape_string($prep),
 188                                                         mysql_escape_string($this->getUsername()),
 189                                                         '%');
 190                         DBGrant($sql);
 191                 }
 192         }
 193         function getDBList() {
 194                 if (isset($this->dblist)) {
 195                         return $this->dblist;
 196                 } else {
 197                         //                      LEFT JOIN DBQuota ON DBQuota.DatabaseId = DBOwner.DatabaseId
 198                         $sql = sprintf("SELECT *
 199                                                 FROM DBOwner
 200                                                 INNER JOIN DB ON DB.DatabaseId = DBOwner.DatabaseId
 201                                                 INNER JOIN DBQuota ON DBQuota.DatabaseId = DBOwner.DatabaseId
 202                                                 WHERE DBOwner.UserId = '%s' AND DB.bEnabled=1",
 203                                                 mysql_escape_string($this->getUserId()));
 204 //                      $r = fetchRows(DBSelect($sql),'DatabaseId');
 205                         $r = fetchRows(DBSelect($sql),'Name');
 206                         ksort($r);
 207                         return $r;
 208                 }
 209         }
 210         function addDB($name) {
 211                 if (in_array($name, array_keys($this->getDBList()))) return false;
 212                 if (!addDB($name, $this->getUserId())) return false;
 213                 $this->setAccess($name);
 214                 return true;
 215         }
 216         function delDB($name) {
 217                 if (!in_array($name, array_keys($this->getDBList()))) return false;
 218                 if (!delDB($name)) return false;//, $this->getUserId())) return false;
 219                 $this->setAccess($name,false);
 220                 return true;
 221         }
 222 }
 223
 224
 225 function isLoggedIn($aLogin=null) {
 226     if (is_null($aLogin)) {
 227         global $Login;
 228         $aLogin = $Login;
 229     }
 230     return !empty($aLogin) && ($aLogin instanceof Login) && $aLogin->canLogin();
 231 }
 232
 233 function isAdmin($aLogin=null) {
 234     if (is_null($aLogin)) {
 235         global $Login;
 236         $aLogin = $Login;
 237     }
 238     return !empty($aLogin) && ($aLogin instanceof Login) && $aLogin->getUL()>=100;
 239 }
 240
 241 function isImpersonating() {
 242         return isSess('_UserId') && isSess('UserId');
 243 }
 244
 245 function isOffline() {
 246         return (defined('OFFLINE') && OFFLINE);
 247 }
 248
 249 function isOnline() {
 250         return !isOffline();
 251 }
 252
 253 function impersonate($userId=null) {
 254         $wasImpersonating = isImpersonating();
 255         if ($wasImpersonating) {
 256                 if (is_null($userId) || empty($userId)) {
 257                         sess('UserId',sess('_UserId'));
 258                         sess('_UserId','');
 259                 } elseif ($userId>0) {
 260                         sess('UserId',$userId);
 261                 } else {
 262                         return false;
 263                 }
 264         } elseif (isLoggedIn()) {
 265                 sess('_UserId',sess('UserId'));
 266                 sess('UserId',$userId);
 267                 return true;
 268         } else {
 269                 return false;
 270         }
 271 }
 272
 273 function isSSL() {
 274         return isset($_SERVER['SERVER_PORT'])?($_SERVER['SERVER_PORT'] == 443):false;
 275 }
 276
 277 function getSSLCert() {
 278     if (DEVEL && file_exists('.forceauth')) {
 279         $fu = explode('|',file_get_contents('.forceauth'));
 280         $name = trim($fu[0]);
 281         $email = trim($fu[1]);
 282     } else {
 283         $name = isset($_SERVER['SSL_CLIENT_S_DN_CN'])?$_SERVER['SSL_CLIENT_S_DN_CN']:null;
 284         $email = isset($_SERVER['SSL_CLIENT_S_DN_Email'])?$_SERVER['SSL_CLIENT_S_DN_Email']:null;
 285     }
 286     if (!is_null($email)) {
 287         $user = explode('@',$email);
 288                 $user = $user[0];
 289         return array('Username'=>$user, 'Name'=>$name, 'Email'=>$email);
 290         } else {
 291                 return null;
 292         }
 293 }
 294
 295 ## 302 REDIRECTS
 296
 297 function redirect($target=null,$secure=null) {
 298     $base = (is_null($target)||substr($target,0,1)=='?')?$_SERVER['REDIRECT_URL']:(dirname($_SERVER['REDIRECT_URL']).'/');
 299     redirectFull(is_null($target)?$base:($base.$target),$secure);
 300 }
 301 function redirectStart() {
 302         redirectFull(BASE_URL,null);
 303 }
 304 function redirectFull($target,$secure) {
 305         //redirect2((((isSSL()&&is_null($secure))||$secure==true)?'https://':'http://').$_SERVER['SERVER_NAME'].$target);
 306         redirect2((((isSSL()&&is_null($secure))||$secure==true)?'https://scripts-cert.mit.edu':'http://scripts.mit.edu').$target);
 307 }
 308 function redirect2($target) {
 309         header('Location: '.$target);
 310         exit;
 311 }
 312 function flipSSL() {
 313         //return (isSSL()?'http://':'https://').$_SERVER['SERVER_NAME'].$_SERVER['REDIRECT_URL'];
 314         return (isSSL()?'http://scripts.mit.edu':'https://scripts-cert.mit.edu').$_SERVER['REDIRECT_URL'];
 315 }
 316
 317 ## USER SCRIPTS
 318
 319 function addUser($sslCredentials) {
 320     global $_NEW_USER, $_NEW_USERQUOTA, $_NEW_USERSTAT;
 321
 322     $arr = array_merge($sslCredentials, $_NEW_USER);
 323     $sql = sprintf("INSERT INTO User %s",
 324                     buildSQLInsert($arr));
 325     $UserId = DBInsert($sql);
 326
 327         $arr = $_NEW_USERQUOTA;
 328         $arr['UserId'] = $UserId;
 329     $sql = sprintf("INSERT INTO UserQuota %s",
 330                     buildSQLInsert($arr));
 331         DBInsert($sql);
 332
 333         $arr = $_NEW_USERSTAT;
 334         $arr['UserId'] = $UserId;
 335     $sql = sprintf("INSERT INTO UserStat %s",
 336                     buildSQLInsert($arr));
 337         DBInsert($sql);
 338
 339         return $UserId;
 340 }
 341
 342 function addDB($dbname,$userid) {
 343         global $_NEW_DB, $_NEW_DBQUOTA, $_NEW_DBOWNER;
 344
 345         DBCreate(sprintf('CREATE DATABASE `%s`', mysql_escape_string($dbname)));
 346         if (mysql_error()) return false;
 347
 348         $newdb['Name'] = $dbname;
 349         $arr = array_merge($newdb, $_NEW_DB);
 350         $arr['bEnabled'] = 1;
 351         $sql = sprintf("INSERT IGNORE INTO DB %s",
 352                     buildSQLInsert($arr));
 353         $DBId = DBInsert($sql);
 354         if (empty($DBId)) {
 355                 $sql = sprintf("SELECT DatabaseId FROM DB WHERE Name = '%s'",
 356                                                 mysql_escape_string($dbname));
 357                 $r = fetchRows(DBSelect($sql), 'DatabaseId');
 358                 if (count($r)) {
 359                         $r = array_shift($r);
 360                         $DBId = $r['DatabaseId'];
 361                 } else {
 362                         return false;
 363                 }
 364                 $sql = sprintf("UPDATE DB SET %s WHERE DB.DatabaseId = '%s'",
 365                                                 buildSQLSet($arr),
 366                                                 $DBId);
 367                 DBUpdate($sql);
 368         }
 369
 370         DBDelete(sprintf("DELETE FROM DBOwner WHERE DatabaseId = '%s'", mysql_escape_string($DBId)));
 371         DBDelete(sprintf("DELETE FROM DBQuota WHERE DatabaseId = '%s'", mysql_escape_string($DBId)));
 372
 373         $arr = $_NEW_DBQUOTA;
 374         $arr['DatabaseId'] = $DBId;
 375         $sql = sprintf("INSERT IGNORE INTO DBQuota %s",
 376                                         buildSQLInsert($arr));
 377         DBInsert($sql);
 378
 379         $arr = $_NEW_DBOWNER;
 380         $arr['DatabaseId'] = $DBId;
 381         $arr['UserId'] = $userid;
 382         $sql = sprintf("INSERT IGNORE INTO DBOwner %s",
 383                                         buildSQLInsert($arr));
 384         DBInsert($sql);
 385
 386         return $DBId;
 387 }
 388
 389 function delDB($dbname) {
 390         global $_NEW_DB, $_NEW_DBQUOTA, $_NEW_DBOWNER;
 391
 392         DBCreate(sprintf('DROP DATABASE `%s`', mysql_escape_string($dbname)));
 393
 394         $arr['bEnabled'] = 0;
 395         $sql = sprintf("UPDATE DB SET %s WHERE DB.Name = '%s'",
 396                                         buildSQLSet($arr),
 397                                         $dbname);
 398         DBUpdate($sql);
 399
 400         return true;
 401 }
 402
 403 ?>