      1: <?php
      2:
      3: // include the config file
      4: if(!isset($config)) {
      5:     require_once '../util/AlphaConfig.inc';
      6:     $config = AlphaConfig::getInstance();
      7:
      8:     require_once $config->get('app.root').'alpha/util/AlphaAutoLoader.inc';
      9: }
     10:
     11: /**
     12:  * Login controller that adds the current user object to the session
     13:  *
     14:  * @package alpha::controller
     15:  * @since 1.0
     16:  * @author John Collins <dev@alphaframework.org>
     17:  * @version $Id: Login.php 1765 2014-04-22 21:26:23Z alphadevx $
     18:  * @license http://www.opensource.org/licenses/bsd-license.php The BSD License
     19:  * @copyright Copyright (c) 2014, John Collins (founder of Alpha Framework).
     20:  * All rights reserved.
     21:  *
     22:  * <pre>
     23:  * Redistribution and use in source and binary forms, with or
     24:  * without modification, are permitted provided that the
     25:  * following conditions are met:
     26:  *
     27:  * * Redistributions of source code must retain the above
     28:  *   copyright notice, this list of conditions and the
     29:  *   following disclaimer.
     30:  * * Redistributions in binary form must reproduce the above
     31:  *   copyright notice, this list of conditions and the
     32:  *   following disclaimer in the documentation and/or other
     33:  *   materials provided with the distribution.
     34:  * * Neither the name of the Alpha Framework nor the names
     35:  *   of its contributors may be used to endorse or promote
     36:  *   products derived from this software without specific
     37:  *   prior written permission.
     38:  *
     39:  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
     40:  * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
     41:  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
     42:  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
     43:  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
     44:  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     45:  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     46:  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     47:  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     48:  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     49:  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
     50:  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
     51:  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     52:  * </pre>
     53:  *
     54:  */
     55: class Login extends AlphaController implements AlphaControllerInterface {
     56:     /**
     57:      * The person to be logged in
     58:      *
     59:      * @var PersonObject
     60:      * @since 1.0
     61:      */
     62:     protected $personObject;
     63:
     64:     /**
     65:      * The person view object
     66:      *
     67:      * @var PersonView
     68:      * @since 1.0
     69:      */
     70:     private $personView;
     71:
     72:     /**
     73:      * Trace logger
     74:      *
     75:      * @var Logger
     76:      * @since 1.0
     77:      */
     78:     private static $logger = null;
     79:
     80:     /**
     81:      * constructor to set up the object
     82:      * @since 1.0
     83:      */
     84:     public function __construct() {
     85:         self::$logger = new Logger('Login');
     86:         self::$logger->debug('>>__construct()');
     87:
     88:         global $config;
     89:
     90:         // ensure that the super class constructor is called, indicating the rights group
     91:         parent::__construct('Public');
     92:
     93:         $this->personObject = new PersonObject();
     94:         $this->personView = AlphaView::getInstance($this->personObject);
     95:         $this->setBO($this->personObject);
     96:
     97:         // set up the title and meta details
     98:         $this->setTitle('Login to '.$config->get('app.title'));
     99:         $this->setDescription('Login page.');
    100:         $this->setKeywords('login,logon');
    101:
    102:         self::$logger->debug('<<__construct');
    103:     }
    104:
    105:     /**
    106:      * Handle GET requests
    107:      *
    108:      * @param array $params
    109:      * @throws IllegalArguementException
    110:      * @since 1.0
    111:      */
    112:     public function doGET($params) {
    113:         self::$logger->debug('>>doGET($params=['.var_export($params, true).'])');
    114:
    115:         if(!is_array($params))
    116:             throw new IllegalArguementException('Bad $params ['.var_export($params, true).'] passed to doGET method!');
    117:
    118:         echo AlphaView::displayPageHead($this);
    119:
    120:         if (isset($params['reset']))
    121:             echo $this->personView->displayResetForm();
    122:         else
    123:             echo $this->personView->displayLoginForm();
    124:
    125:         echo AlphaView::displayPageFoot($this);
    126:
    127:         self::$logger->debug('<<doGET');
    128:     }
    129:
    130:     /**
    131:      * Handle POST requests (adds $currentUser PersonObject to the session)
    132:      *
    133:      * @param array $params
    134:      * @throws IllegalArguementException
    135:      * @since 1.0
    136:      */
    137:     public function doPOST($params) {
    138:         self::$logger->debug('>>doPOST($params=['.var_export($params, true).'])');
    139:
    140:         if(!is_array($params))
    141:             throw new IllegalArguementException('Bad $params ['.var_export($params, true).'] passed to doPOST method!');
    142:
    143:         global $config;
    144:
    145:         try {
    146:             // check the hidden security fields before accepting the form POST data
    147:             if(!$this->checkSecurityFields())
    148:                 throw new SecurityException('This page cannot accept post data from remote servers!');
    149:
    150:             if (isset($params['loginBut'])) {
    151:                 // if the database has not been set up yet, accept a login from the config admin username/password
    152:                 if(!AlphaDAO::isInstalled()) {
    153:                     if ($params['email'] == $config->get('app.install.username') && crypt($params['password'], $config->get('app.install.password')) ==
    154:                         crypt($config->get('app.install.password'), $config->get('app.install.password'))) {
    155:
    156:                         self::$logger->info('Logging in ['.$params['email'].'] at ['.date("Y-m-d H:i:s").']');
    157:                         $admin = new PersonObject();
    158:                         $admin->set('displayName', 'Admin');
    159:                         $admin->set('email', $params['email']);
    160:                         $admin->set('password', crypt($params['password'], $config->get('app.install.password')));
    161:                         $admin->set('OID', '00000000001');
    162:                         $_SESSION['currentUser'] = $admin;
    163:                         if ($this->getNextJob() != '') {
    164:                             $url = FrontController::generateSecureURL('act='.$this->getNextJob());
    165:                             self::$logger->info('Redirecting to ['.$url.']');
    166:                             header('Location: '.$url);
    167:                             exit;
    168:                         }else{
    169:                             $url = FrontController::generateSecureURL('act=Install');
    170:                             self::$logger->info('Redirecting to ['.$url.']');
    171:                             header('Location: '.$url);
    172:                             exit;
    173:                         }
    174:                     }else{
    175:                         throw new ValidationException('Failed to login user '.$params['email'].', the password is incorrect!');
    176:                     }
    177:                 }else{
    178:                     // here we are attempting to load the person from the email address
    179:                     $this->personObject->loadByAttribute('email', $params['email'], true);
    180:
    181:                     AlphaDAO::disconnect();
    182:
    183:                     // checking to see if the account has been disabled
    184:                     if (!$this->personObject->isTransient() && $this->personObject->get('state') == 'Disabled')
    185:                         throw new SecurityException('Failed to login user '.$params['email'].', that account has been disabled!');
    186:
    187:                     // check the password
    188:                     $this->doLoginAndRedirect($params['password']);
    189:                 }
    190:
    191:                 echo AlphaView::displayPageHead($this);
    192:
    193:                 echo $this->personView->displayLoginForm();
    194:             }
    195:
    196:             if (isset($params['resetBut'])) {
    197:                 // here we are attempting to load the person from the email address
    198:                 $this->personObject->loadByAttribute('email', $params['email']);
    199:
    200:                 AlphaDAO::disconnect();
    201:
    202:                 // generate a new random password
    203:                 $new_password = $this->personObject->generatePassword();
    204:
    205:                 // now encrypt and save the new password, then e-mail the user
    206:                 $this->personObject->set('password', crypt($new_password));
    207:                 $this->personObject->save();
    208:
    209:                 $message = 'The password for your account has been reset to '.$new_password.' as you requested.  You can now login to the site using your '.
    210:                     'e-mail address and this new password as before.';
    211:                 $subject = 'Password change request';
    212:
    213:                 $this->personObject->sendMail($message, $subject);
    214:
    215:                 echo AlphaView::displayUpdateMessage('The password for the user <strong>'.$params['email'].'</strong> has been reset, and the new password '.
    216:                     'has been sent to that e-mail address.');
    217:                 echo '<a href="'.$config->get('app.url').'">Home Page</a>';
    218:             }
    219:         }catch(ValidationException $e) {
    220:             echo AlphaView::displayPageHead($this);
    221:
    222:             echo AlphaView::displayErrorMessage($e->getMessage());
    223:
    224:             if (isset($params['reset']))
    225:                 echo $this->personView->displayResetForm();
    226:             else
    227:                 echo $this->personView->displayLoginForm();
    228:
    229:             self::$logger->warn($e->getMessage());
    230:         }catch(SecurityException $e) {
    231:             echo AlphaView::displayPageHead($this);
    232:
    233:             echo AlphaView::displayErrorMessage($e->getMessage());
    234:
    235:             self::$logger->warn($e->getMessage());
    236:         }catch(BONotFoundException $e) {
    237:             echo AlphaView::displayPageHead($this);
    238:
    239:             echo AlphaView::displayErrorMessage('Failed to find the user \''.$params['email'].'\'');
    240:
    241:             if (isset($params['reset']))
    242:                 echo $this->personView->displayResetForm();
    243:             else
    244:                 echo $this->personView->displayLoginForm();
    245:
    246:             self::$logger->warn($e->getMessage());
    247:         }
    248:
    249:         echo AlphaView::displayPageFoot($this);
    250:         self::$logger->debug('<<doPOST');
    251:     }
    252:
    253:     /**
    254:      * Login the user and re-direct to the defined destination
    255:      *
    256:      * @param string $password The password supplied by the user logging in
    257:      * @throws ValidationException
    258:      * @since 1.0
    259:      */
    260:     protected function doLoginAndRedirect($password) {
    261:         self::$logger->debug('>>doLoginAndRedirect(password=['.$password.'])');
    262:
    263:         global $config;
    264:
    265:         if (!$this->personObject->isTransient() && $this->personObject->get('state') == 'Active') {
    266:             if (crypt($password, $this->personObject->get('password')) == $this->personObject->get('password')) {
    267:
    268:                 $_SESSION['currentUser'] = $this->personObject;
    269:
    270:                 self::$logger->debug('Logging in ['.$this->personObject->get('email').'] at ['.date("Y-m-d H:i:s").']');
    271:                 self::$logger->action('Login');
    272:
    273:                 if ($this->getNextJob() != '') {
    274:                     self::$logger->debug('<<doLoginAndRedirect');
    275:                     $url = FrontController::generateSecureURL('act='.$this->getNextJob());
    276:                     header('Location: '.$url);
    277:                     exit;
    278:                 }else{
    279:                     self::$logger->debug('<<doLoginAndRedirect');
    280:                     header('Location: '.$config->get('app.url'));
    281:                     exit;
    282:                 }
    283:             }else{
    284:                 throw new ValidationException('Failed to login user '.$this->personObject->get('email').', the password is incorrect!');
    285:                 self::$logger->debug('<<doLoginAndRedirect');
    286:             }
    287:         }
    288:     }
    289:
    290:     /**
    291:      * Displays the application version number on the login screen.
    292:      *
    293:      * @return string
    294:      * @since 1.0
    295:      */
    296:     public function before_displayPageFoot_callback() {
    297:         global $config;
    298:
    299:         return '<p><em>Version '.$config->get('app.version').'</em></p>';
    300:     }
    301: }
    302:
    303: // now build the new controller if this file is called directly
    304: if ('Login.php' == basename($_SERVER['PHP_SELF'])) {
    305:     $controller = new Login();
    306:
    307:     if(!empty($_POST)) {
    308:         $controller->doPOST($_POST);
    309:     }else{
    310:         $controller->doGET($_GET);
    311:     }
    312: }
    313:
    314: ?>