webadmin.php

/var/www/hkosl.com/e-ims/file_manager/function_auth.php

<?php
require_once __DIR__.'/inc/Db.php';
require_once 'function_login_block.php';

defined('HTML_EOL') or define('HTML_EOL', '<br />');

/*
 * Usage:
*
* -authentication
* Sys_user::auth($userid, $pwd, $return_user);
* return true or false
*
* -change password
* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
* return true or false
*
* -check the (SESSION) user is valid
* Sys_user::checkLogin();
* return true or false
*/

class Sys_user {

    /*
     * Database USER Table defination
     */
    const TBL_NAME             = "sys_login";
    const FLD_ID            = "loginid";
    const FLD_USER            = "username";
    const FLD_LOGINNAME        = "loginname";    
    const FLD_PASSWORD        = "loginpw";
    const FLD_ROLE            = "role";
    const FLD_CREATEDATE    = "createdate";
    const FLD_MODIFYDATE    = "lastupdate";
    const FLD_STATUS        = "status";
    const STATUS_ALLOW        = "1"; // allow status=1 to login

    //settings
    static $SHOW_WARNING     = false;
    static $ENABLE_CALLBACK    = true;

    /*
     * To be called if authorization is OK
     */
    protected static function authSuccessCallback($row){
        //put some variables into SESSION
        $_SESSION['loginname']    = $row{self::FLD_LOGINNAME};
        $_SESSION['loginid']    = $row{self::FLD_ID};
        $_SESSION['role']    = $row{self::FLD_ROLE};

        if($_POST['autologin'] == 1)
        {
            //disabled cookie
                
            //$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
            //setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
            //insert_login_log($usrid, true);
        }
        insert_login_log($row{self::FLD_USER}, true);

        header("Location: index.php");
        exit;
    }

    /*
     * To be called if authorization is Failed
     */
    protected static function authFailCallback(){
        //put a log into System_log table
        global $login_error;
        $login_error = true;
        insert_login_log($usrid, false);
        die_if_login_block();
    }

    /*
     * Customize procedure to check during authorization
     * return ture to allow this authorization
     */
    protected static function whenAuth(){
        //you can add some checking
        //return false to reject the authorization
        return true;
    }

    // --------------  DO NOT MODIFY BELOW --------------------------------------------

    /*
     * check the loginid has a valid status (usually run in every script)
     * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
     */
    static function checkLogin($loginid=null){

        global $loggin;
        
        if(empty($loginid)){
            $loginid = $_SESSION['loginname'];
        }

        $sql = "SELECT * FROM ".self::TBL_NAME
                ." WHERE ".self::FLD_LOGINNAME . " = :loginname "
                ." AND ". self::FLD_STATUS." = :status ";
                
        $sql_param = array(
            ':loginname' => $loginid,
            ':status' => self::STATUS_ALLOW,
        );

        $sth = Db::getDbh()->prepare($sql);
        //echo $sth->getSQL( $sql_param ).HTML_EOL;
        $sth->execute( $sql_param );    
        if( $error = $sth->getError($sql_param) ){
            var_dump($error);
        }
            
        if($row = $sth->fetch()){
            $loggin = 1;
            return true;
        }
        $loggin = false;
        return false;
    }

    //user authenication
    static function auth($userid, $pwd, &$return_user=null){

        $sql = "SELECT * FROM ".self::TBL_NAME."
                WHERE ".self::FLD_LOGINNAME." = :loginname
                        AND ".self::FLD_PASSWORD." = :password
                        AND ".self::FLD_STATUS." = :status ";
                
        $sql_param = array(
            ':loginname' => $userid,
            ':password' => Password::hash($pwd),
            ':status' => self::STATUS_ALLOW,
        );

        $sth = Db::getDbh()->prepare($sql);
        //echo $sth->getSQL( $sql_param ).HTML_EOL;
        $sth->execute( $sql_param );    
        if( $error = $sth->getError($sql_param) ){
            var_dump($error);
        }
            
        $result=$sth->fetch();
            
        if( $result && $result[self::FLD_PASSWORD]==Password::hash($pwd) ){
            //var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
            $authenticated =  true;
        }else{
            if(self::$SHOW_WARNING) { print "Login Failed <br/>";    }
            $authenticated =  false;
        }
        
        if( $authenticated && !self::whenAuth() ){
            $authenticated =  false;
        }

        if($authenticated){
            $return_user = $result;
            if(self::$ENABLE_CALLBACK) { self::authSuccessCallback($return_user); }
        }else{
            if(self::$SHOW_WARNING) { print "Login Failed <br/>"; }
            if(self::$ENABLE_CALLBACK) { self::authFailCallback(); }
        }
        return $authenticated;
    }

    //change user password
    static function changePassword($id, $orginal_password, $new_password, $confirm_password=null){
        
        $sql = "SELECT * FROM ".self::TBL_NAME." WHERE ".self::FLD_ID." = :id ";
                
        $sql_param = array(
            ':id' => $id
        );

        $sth = Db::getDbh()->prepare($sql);
        //echo $sth->getSQL( $sql_param ).HTML_EOL;
        $sth->execute( $sql_param );    
        if( $error = $sth->getError($sql_param) ){
            var_dump($error);
        }
        
        if(!$result = $sth->fetch()){
            if(self::$SHOW_WARNING) {
                print "User not found <br/>";
            }
            return false;            
        }
        
        if($confirm_password && $new_password==$confirm_password){
            if(self::$SHOW_WARNING) { print "Confirm password is incorrect <br/>"; }
            return false;
        }
        if(Password::hash($orginal_password)!=$result[self::FLD_PASSWORD]){
            if(self::$SHOW_WARNING) { print "Original password is incorrect <br/>"; }
            return false;
        }
        
        if($result[self::FLD_ID]){
            $sql = "UPDATE ".self::TBL_NAME
            ." SET ".self::FLD_PASSWORD." = :password, "
                    .self::FLD_MODIFYDATE." = :date "
            ." WHERE ".self::FLD_ID." = :id ";
                    
            $sql_param = array(
                ':password' => Password::hash($new_password),
                ':date' => date("Y-m-d H:i:s"),
                ':id' => (int)$result[self::FLD_ID],
            );
    
            $sth = Db::getDbh()->prepare($sql);
            //echo $sth->getSQL( $sql_param ).HTML_EOL;
            $sth->execute( $sql_param );    
            if( $error = $sth->getError($sql_param) ){
                var_dump($error);
                return false;
            }
            return true;        
        }
        return false;
    }
}

/*    
 * Usage:
*
* -hash
* Password::hash($_POST["cmsloginpw"]);
* return hashed password
*
* -strength test
* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
* $msg: variable to store returned error messages
* return true OR false
*
* -include javascript fragment for Jquery validation
* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
* $password: password to be validated
* $ajax_checker: validate script
* $loginname: optional username to be compared with the password
* return javascript string
*/
class Password{
    static $SALT1             = "3ruthaQE";
    static $SALT2             = "kaheSt6H";
    static $SALT3             = "sA6wePej";
    static $SALT4             = "Tha7unaT";    

    static function hash($str){
        $len = strlen($str);
        $len_a = (int)($len/3);
        $len_b = (int)($len/3);
        //$len_c = $len - $a - $b;
        $a = substr($str, 0, $len_a);
        $b = substr($str, $len_a, $len_b);
        $c = substr($str, $len_a+$len_b);                
        //var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
        return hash('sha256', self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
    }
    
    static function strength($password, $username='', &$msg=''){
        //ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
        //$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
        //$t1 = preg_match($pattern, $password, $matches);
        $result = true;
        
        $pattern = "/^.{8,15}$/";
        if(!preg_match($pattern, $password, $matches)){
            $msg .= '<li>Must be 8-15 characters long</li>';    
            $result = false;
        }
        $pattern = "/(?=.*[a-z])/";
        if(!preg_match($pattern, $password, $matches)){
            $msg .= '<li>Include a lower case letter</li>';    
            $result = false;
        }
        $pattern = "/(?=.*[A-Z])/";
        if(!preg_match($pattern, $password, $matches)){
            $msg .= '<li>Include an upper case letter</li>';    
            $result = false;
        }
        $pattern = "/(?=.*[\d])/";
        if(!preg_match($pattern, $password, $matches)){
            $msg .= '<li>Include a number</li>';    
            $result = false;
        }
        $pattern = "/(?=.*[\W_])/";
        if(!preg_match($pattern, $password, $matches)){
            $msg .= '<li>Include a special character</li>';    
            $result = false;
        }
        if(stripos($password, $username)!==false){
            $msg .= '<li>Password cannot contain the username</li>';    
            $result = false;            
        }
        if($msg){
            $msg = '<ul class="validerr">'.$msg.'</ul>';    
        }
    
        return $result;
    }    
    
    

    static function ajax_validate($id, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id='', $required=false){
            $s .='
<script>
$(document).ready(function(e) {
    $( "#'.$id.'" ).rules( "add", {
        "required": '.($required?'true':'false').',
        "minlength": 8,
        "maxlength": 15,
            messages: {
                 remote: "Invalid password format"
            },
        "remote": { 
            url: "'.$ajaxChecker.'",
            type: "post",
            data:{
                allowEmpty: "'.($required?'false':'true').'",
                fld: "'.$id.'",
                username: function(){
                    return $("#'.$usernameInput_id.'").val();
                }
            },
        }
    });
});
</script>';

        return $s;
    }    
    
    static function html_input($tag_attr, $id, $ajaxChecking=true, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id=''){
        if(empty($id)){
            $id=rand(1000,999999);
        }            
        $s='<input type="text" '.$tag_attr.' id="'.$id.'" >';
        if($ajaxChecking){//change, blur, keyup
            if($usernameInput_id){
                $usernameInput = ", #".$usernameInput_id;    
            }
            $s .='<script>
                    $("#'.$id.$usernameInput.'").on("change, blur, keyup", function(e){
                        $.getJSON( "'.$ajaxChecker.'", {
                                password: $("#'.$id.'").val(),
                                username: $("#'.$usernameInput_id.'").val(),
                            },
                            function(data) {
                                if(data.strength){
                                    $("#'.$id.'").removeClass("bad").addClass("ok");
                                }else{
                                    $("#'.$id.'").removeClass("ok").addClass("bad");
                                }
                        });
                    });
                 </script>';
        }        
        return $s;
    }


}