bludit/bl-kernel/users.class.php

217 lines
4.8 KiB
PHP
Raw Normal View History

2015-05-05 03:00:01 +02:00
<?php defined('BLUDIT') or die('Bludit CMS.');
2018-08-03 18:59:23 +02:00
class Users extends dbJSON {
2018-07-25 23:42:00 +02:00
protected $dbFields = array(
2018-07-25 23:42:00 +02:00
'firstName'=>'',
'lastName'=>'',
2018-07-28 18:33:37 +02:00
'nickname'=>'',
2019-04-24 00:11:36 +02:00
'description'=>'',
2019-05-13 18:26:35 +02:00
'role'=>'author', // admin, editor, author
2018-07-25 23:42:00 +02:00
'password'=>'',
'salt'=>'!Pink Floyd!Welcome to the machine!',
'email'=>'',
'registered'=>'1985-03-15 10:00',
'tokenRemember'=>'',
'tokenAuth'=>'',
'tokenAuthTTL'=>'2009-03-15 14:00',
'twitter'=>'',
'facebook'=>'',
'codepen'=>'',
2019-02-22 18:26:42 +01:00
'instagram'=>'',
2018-07-25 23:42:00 +02:00
'github'=>'',
2019-02-22 18:26:42 +01:00
'gitlab'=>'',
'linkedin'=>'',
'mastodon'=>''
2015-05-05 03:00:01 +02:00
);
function __construct()
{
parent::__construct(DB_USERS);
2015-05-05 03:00:01 +02:00
}
2018-07-25 23:42:00 +02:00
public function getDefaultFields()
2016-01-01 00:31:51 +01:00
{
2018-07-25 23:42:00 +02:00
return $this->dbFields;
}
// Return an array with the database of the user, FALSE otherwise
public function getUserDB($username)
{
if ($this->exists($username)) {
return $this->db[$username];
}
return false;
}
// Return TRUE if the user exists, FALSE otherwise
public function exists($username)
{
return isset($this->db[$username]);
}
2018-07-25 23:42:00 +02:00
// Disable the user
public function disableUser($username)
{
$this->db[$username]['password'] = '!';
return $this->save();
}
// Add a new user
2017-07-02 22:46:05 +02:00
public function add($args)
{
2018-07-25 23:42:00 +02:00
// The username is store as key and not as field
$username = $args['username'];
// The password is hashed, the password doesn't need to be sanitize in the next step
$password = $args['password'];
2017-07-02 22:46:05 +02:00
2018-07-25 23:42:00 +02:00
$row = array();
foreach ($this->dbFields as $field=>$value) {
if (isset($args[$field])) {
2018-07-25 23:42:00 +02:00
// Sanitize if will be stored on database
$finalValue = Sanitize::html($args[$field]);
} else {
2018-07-25 23:42:00 +02:00
// Default value for the field if not defined
$finalValue = $value;
2017-07-02 22:46:05 +02:00
}
2018-07-25 23:42:00 +02:00
settype($finalValue, gettype($value));
$row[$field] = $finalValue;
2017-07-02 22:46:05 +02:00
}
2018-07-25 23:42:00 +02:00
$row['registered'] = Date::current(DB_DATE_FORMAT);
$row['salt'] = $this->generateSalt();
$row['password'] = $this->generatePasswordHash($password, $row['salt']);
$row['tokenAuth'] = $this->generateAuthToken();
2017-07-05 23:30:30 +02:00
2017-07-02 22:46:05 +02:00
// Save the database
2018-07-25 23:42:00 +02:00
$this->db[$username] = $row;
2017-07-05 19:59:51 +02:00
return $this->save();
2017-07-02 22:46:05 +02:00
}
2018-07-25 23:42:00 +02:00
// Edit an user
public function set($args)
{
2018-07-25 23:42:00 +02:00
// The username is store as key and not as field
$username = $args['username'];
// Current database of the user
2018-07-25 23:42:00 +02:00
$row = $this->db[$username];
foreach ($this->dbFields as $field=>$value) {
if ($field!=='password') {
if (isset($args[$field])) {
// Sanitize if will be stored on database
$finalValue = Sanitize::html($args[$field]);
} else {
// Default value is the current one
$finalValue = $row[$field];
}
settype($finalValue, gettype($value));
$row[$field] = $finalValue;
}
}
2018-01-15 17:13:46 +01:00
// Set a new password
2018-05-14 00:00:10 +02:00
if (!empty($args['password'])) {
2018-07-25 23:42:00 +02:00
$row['salt'] = $this->generateSalt();
$row['password'] = $this->generatePasswordHash($args['password'], $row['salt']);
$row['tokenAuth'] = $this->generateAuthToken();
2018-01-15 17:13:46 +01:00
}
// Save the database
2018-07-25 23:42:00 +02:00
$this->db[$username] = $row;
return $this->save();
}
// Delete an user
public function delete($username)
{
unset($this->db[$username]);
return $this->save();
}
2017-07-05 23:30:30 +02:00
public function generateAuthToken()
{
return md5( uniqid().time().DOMAIN );
}
2017-11-07 00:18:16 +01:00
public function generateRememberToken()
2017-07-06 23:27:22 +02:00
{
return $this->generateAuthToken();
}
public function generateSalt()
{
return Text::randomText(SALT_LENGTH);
}
public function generatePasswordHash($password, $salt)
{
return sha1($password.$salt);
}
2017-11-07 00:18:16 +01:00
public function setRememberToken($username, $token)
{
$args['username'] = $username;
$args['tokenRemember'] = $token;
return $this->set($args);
}
2018-05-15 20:12:15 +02:00
// Change user password
// args => array( username, password )
public function setPassword($args)
2017-07-05 23:30:30 +02:00
{
return $this->set($args);
}
2017-07-06 23:27:22 +02:00
// Return the username associated to an email, FALSE otherwise
2015-10-20 05:14:28 +02:00
public function getByEmail($email)
{
2017-09-23 13:10:05 +02:00
foreach ($this->db as $username=>$values) {
if ($values['email']==$email) {
2015-10-24 01:23:33 +02:00
return $username;
2015-10-20 05:14:28 +02:00
}
}
return false;
}
// Returns the username with the authentication token assigned, FALSE otherwise
public function getByAuthToken($token)
{
2017-09-23 13:10:05 +02:00
foreach ($this->db as $username=>$fields) {
if ($fields['tokenAuth']==$token) {
return $username;
}
}
return false;
}
2017-11-07 00:18:16 +01:00
// Returns the username with the remember token assigned, FALSE otherwise
public function getByRememberToken($token)
2015-10-20 05:14:28 +02:00
{
2017-11-07 00:18:16 +01:00
foreach ($this->db as $username=>$fields) {
2018-01-01 20:19:45 +01:00
if (!empty($fields['tokenRemember'])) {
if ($fields['tokenRemember']==$token) {
return $username;
}
2017-11-07 00:18:16 +01:00
}
}
return false;
}
2015-10-20 05:14:28 +02:00
2017-11-07 00:18:16 +01:00
// This function clean all tokens for Remember me
// This function is used when some hacker try to use an invalid remember token
public function invalidateAllRememberTokens()
{
foreach ($this->db as $username=>$values) {
$this->db[$username]['tokenRemember'] = '';
}
return $this->save();
2017-07-06 23:27:22 +02:00
}
2018-08-03 18:59:23 +02:00
public function keys()
2017-07-06 23:27:22 +02:00
{
2018-07-25 23:42:00 +02:00
return array_keys($this->db);
2017-09-23 15:15:29 +02:00
}
2018-01-15 17:13:46 +01:00
}