webadmin.php

/var/www/hkosl.com/onegolf/webadmin/function_auth.php

<?php
//require_once __DIR__.'/inc/Db.php';
//require_once 'function_login_block.php';

    defined('HTML_EOL') or define('HTML_EOL', '<br />');

    /*
     * Usage:
    *
    * -authentication
    * Sys_user::auth($userid, $pwd, $return_user);
    * return true or false
    *
    * -change password
    * Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
    * return true or false
    *
    * -check the (SESSION) user is valid
    * Sys_user::checkLogin();
    * return true or false
    */

    class Sys_user {

        /*
         * Database USER Table defination
         */
        const TBL_NAME             = "sys_cms_login";
        const FLD_ID            = "cmsloginid";
        const FLD_USER            = "cmsusername";
        const FLD_LOGINNAME        = "cmsloginname";
        const FLD_PASSWORD        = "cmsloginpw";
        const FLD_ROLE            = "cmsrole";
        const FLD_CREATEDATE    = "createdate";
        const FLD_MODIFYDATE    = "lastupdate";
        const FLD_STATUS        = "cmsstatus";
        const FLD_PWEXPIRYDATE  = "password_expirydate";
        const STATUS_ALLOW        = "1"; // allow status=1 to login

        //settings
        static $SHOW_WARNING     = false;
        static $ENABLE_CALLBACK    = true;
        static $ENABLE_PWEXPIRYDATE = true;

        /*
         * To be called if authorization is OK
         */
        protected static function authSuccessCallback($row){
            //put some variables into SESSION
            //var_dump($row);
            $_SESSION['loginname']    = $row{self::FLD_LOGINNAME};
            $_SESSION['cmsloginid']    = $row{self::FLD_ID};
            $_SESSION['loginid']    = $row{self::FLD_ID};
            $_SESSION['cmsrole']    = $row{self::FLD_ROLE};
            $_SESSION['role']    = $row{self::FLD_ROLE};

            $_SESSION['KCFINDER'] = array();
            $_SESSION['KCFINDER']['disabled'] = false;
            $_SESSION['KCFINDER']['uploadURL'] = "upload/";
            //$_SESSION['KCFINDER']['uploadURL'] = "upload/user/".$row{self::FLD_ID};
            $_SESSION['KCFINDER']['uploadDir'] = "";

            /*if($_POST['autologin'] == 1)
            {
                //disabled cookie

                //$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
                //setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
                //insert_login_log($usrid, true);
            }
            */
            insert_login_log($row{self::FLD_LOGINNAME}, true);

            if ( self::$ENABLE_PWEXPIRYDATE && (strtotime($row{self::FLD_PWEXPIRYDATE}) < time() - 24 * 60 * 60) ){ //expired
                header( "Location: sys_cms_user_modifypwform.php" );
                exit;
            }

            header("Location: index.php");
            exit;
        }

        /*
         * To be called if authorization is Failed
         */
        protected static function authFailCallback($username){
            //put a log into System_log table
            global $login_error;
            $login_error = true;
            insert_login_log($username, false);
            die_if_login_block();
        }

        /*
         * Customize procedure to check during authorization
         * return ture to allow this authorization
         */
        protected static function whenAuth(){
            //you can add some checking
            //return false to reject the authorization
            return true;
        }

        // --------------  DO NOT MODIFY BELOW --------------------------------------------

        /*
         * check the loginid has a valid status (usually run in every script)
         * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
         */
        static function checkLogin($loginid=null){

            global $loggin;
            global $dbh;

            if(!isset($loginid) && empty($loginid) && !empty($_SESSION['loginname'])){
                $loginid = $_SESSION['loginname'];
            }else{
                $loginid = "";
            }

            $sql = "SELECT * FROM ".self::TBL_NAME
                ." WHERE ".self::FLD_LOGINNAME . " = :loginname "
                ." AND ". self::FLD_STATUS." = :status ";

            $sql_param = array(
                ':loginname' => $loginid,
                ':status' => self::STATUS_ALLOW,
            );


            $sth = $dbh->prepare($sql);
            //var_dump($sth);
            //echo $sth->getSQL( $sql_param ).HTML_EOL;
            //$sth->execute( $sql_param );
            /*if( $error = $sth->getError($sql_param) ){
                var_dump($error);
            }*/
            if (!$sth->execute($sql_param))
                throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

            if($row = $sth->fetch()){
                $loggin = 1;
                return true;
            }
            $loggin = false;
            return false;
        }

        //user authenication
        static function auth($userid, $pwd, &$return_user=null){

            global $dbh;
            $sql = "SELECT * FROM ".self::TBL_NAME."
                WHERE ".self::FLD_LOGINNAME." = :loginname
                        AND ".self::FLD_PASSWORD." = :password
                        AND ".self::FLD_STATUS." = :status ";

            $sql_param = array(
                ':loginname' => $userid,
                ':password' => Password::hash($pwd),
                ':status' => self::STATUS_ALLOW,
            );


            $sth = $dbh->prepare($sql);
            //echo $sth->getSQL( $sql_param ).HTML_EOL;
            //$sth->execute( $sql_param );
            /*if( $error = $sth->getError($sql_param) ){
                var_dump($error);
            }*/
            if (!$sth->execute($sql_param))
                throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

            $result=$sth->fetch();

            if( $result && $result[self::FLD_PASSWORD]==Password::hash($pwd) ){
                //var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
                $authenticated =  true;
            }else{
                if(self::$SHOW_WARNING) { print "Login Failed <br/>";    }
                $authenticated =  false;
            }

            if( $authenticated && !self::whenAuth() ){
                $authenticated =  false;
            }

            if($authenticated){
                $return_user = $result;
                if(self::$ENABLE_CALLBACK) { self::authSuccessCallback($return_user); }
            }else{

                if(self::$SHOW_WARNING) { print "Login Failed <br/>"; }
                if(self::$ENABLE_CALLBACK) { self::authFailCallback($userid);}
            }
            return $authenticated;
        }

        //change user password
        static function changePassword($id, $orginal_password, $new_password, $confirm_password=null){
            global $dbh;
            $sql = "SELECT * FROM ".self::TBL_NAME." WHERE ".self::FLD_ID." = :id ";

            $sql_param = array(
                ':id' => $id
            );

            $sth = $dbh->prepare($sql);
            //echo $sth->getSQL( $sql_param ).HTML_EOL;
            //$sth->execute( $sql_param );
            /*if( $error = $sth->getError($sql_param) ){
                var_dump($error);
            }*/
            if (!$sth->execute($sql_param))
                throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

            if(!$result = $sth->fetch()){
                if(self::$SHOW_WARNING) {
                    print "User not found <br/>";

                }
                return false;
            }

            if($confirm_password && $new_password!=$confirm_password){
                if(self::$SHOW_WARNING) { print "Confirm password is incorrect <br/>";  }
                return false;
            }
            if(Password::hash($orginal_password)!=$result[self::FLD_PASSWORD]){
                if(self::$SHOW_WARNING) { print "Original password is incorrect <br/>";}
                return false;
            }

            if($result[self::FLD_ID]){

                $sql_param = array(
                    ':password' => Password::hash($new_password),
                    ':date' => date("Y-m-d H:i:s"),
                    ':id' => (int)$result[self::FLD_ID],
                );

                if ( self::$ENABLE_PWEXPIRYDATE ){
                    $sql_updatefield = self::FLD_PWEXPIRYDATE." = :password_expirydate, ";
                    $sql_param[':password_expirydate'] = date('Y-m-d H:i:s', strtotime("+1 year")); //extend 1 year
                }

                $sql = "UPDATE ".self::TBL_NAME
                    ." SET "
                    .$sql_updatefield
                    .self::FLD_PASSWORD." = :password, "
                    .self::FLD_MODIFYDATE." = :date "
                    ." WHERE ".self::FLD_ID." = :id ";

                $sth = $dbh->prepare($sql);
                //echo $sth->getSQL( $sql_param ).HTML_EOL;
                //$sth->execute( $sql_param );
                /*if( $error = $sth->getError($sql_param) ){
                    var_dump($error);
                    return false;
                }*/
                if (!$sth->execute($sql_param)){
                    throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());
                    return false;
                }


                return true;
            }
            return false;
        }
    }

    /*
     * Usage:
    *
    * -hash
    * Password::hash($_POST["cmsloginpw"]);
    * return hashed password
    *
    * -strength test
    * Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
    * $msg: variable to store returned error messages
    * return true OR false
    *
    * -include javascript fragment for Jquery validation
    * Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
    * $password: password to be validated
    * $ajax_checker: validate script
    * $loginname: optional username to be compared with the password
    * return javascript string
    */
    class Password{
        static $SALT1 = "3ruthaQE";
        static $SALT2 = "kaheSt6H";
        static $SALT3 = "sA6wePej";
        static $SALT4 = "Tha7unaT";

        static function hash($str){
            $len = strlen($str);
            $len_a = (int)($len/3);
            $len_b = (int)($len/3);
            //$len_c = $len - $a - $b;
            $a = substr($str, 0, $len_a);
            $b = substr($str, $len_a, $len_b);
            $c = substr($str, $len_a+$len_b);
            //var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
            return hash('sha256', self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
        }

        static function strength($password, $username='', &$msg=''){
            //ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
            //$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
            //$t1 = preg_match($pattern, $password, $matches);
            $result = true;

            $pattern = "/^.{8,15}$/";
            if(!preg_match($pattern, $password, $matches)){
                $msg .= '<li>必須有8-15字元長度</li>';
                $result = false;
            }
            $pattern = "/(?=.*[a-z])/";
            if(!preg_match($pattern, $password, $matches)){
                $msg .= '<li>必須包含最少一個小寫字母</li>';
                $result = false;
            }
            $pattern = "/(?=.*[A-Z])/";
            if(!preg_match($pattern, $password, $matches)){
                $msg .= '<li>必須包含最少一個大寫字母</li>';
                $result = false;
            }
            $pattern = "/(?=.*[\d])/";
            if(!preg_match($pattern, $password, $matches)){
                $msg .= '<li>必須包含最少一個數字</li>';
                $result = false;
            }
            $pattern = "/(?=.*[\W_])/";
            if(!preg_match($pattern, $password, $matches)){
                $msg .= '<li>必須包含最少一個特殊字元</li>';
                $result = false;
            }
            if(stripos($password, $username)!==false){
                $msg .= '<li>密碼不可含有用戶名稱</li>';
                $result = false;
            }
            if($msg){
                $msg = '<ul class="validerr">'.$msg.'</ul>';
            }

            return $result;
        }



        static function ajax_validate($id, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id='', $required=false){
            $s ='
<script>
$(document).ready(function(e) {
    $( "#'.$id.'" ).rules( "add", {
        "required": '.($required?'true':'false').',
        "minlength": 8,
        "maxlength": 15,
            messages: {
                 remote: "密碼格式不正確"
            },
        "remote": { 
            url: "'.$ajaxChecker.'",
            type: "post",
            data:{
                allowEmpty: "'.($required?'false':'true').'",
                fld: "'.$id.'",
                username: function(){
                    return $("#'.$usernameInput_id.'").val();
                }
            },
        }
    });
});
</script>';

            return $s;
        }

        static function html_input($tag_attr, $id, $ajaxChecking=true, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id=''){
            if(empty($id)){
                $id=rand(1000,999999);
            }
            $s='<input type="text" '.$tag_attr.' id="'.$id.'" >';
            if($ajaxChecking){//change, blur, keyup
                if($usernameInput_id){
                    $usernameInput = ", #".$usernameInput_id;
                }
                $s .='<script>
                    $("#'.$id.$usernameInput.'").on("change, blur, keyup", function(e){
                        $.getJSON( "'.$ajaxChecker.'", {
                                password: $("#'.$id.'").val(),
                                username: $("#'.$usernameInput_id.'").val(),
                            },
                            function(data) {
                                if(data.strength){
                                    $("#'.$id.'").removeClass("bad").addClass("ok");
                                }else{
                                    $("#'.$id.'").removeClass("ok").addClass("bad");
                                }
                        });
                    });
                 </script>';
            }
            return $s;
        }


    }