Pman/Login.php

[Pman.Base] / Pman / Login.php

diff --git a/Pman/Login.php b/Pman/Login.php
index 2394766..d5e0849 100644 (file)
--- a/Pman/Login.php
+++ b/Pman/Login.php
@@ -51,12 +51,7 @@ class Pman_Login extends Pman
                 
                 $this->addEvent('LOGOUT');
                 $e = DB_DataObject::factory('Events');
-                $e->query("UPDATE Events SET remarks = '' WHERE 
-                    person_id = {$u->id} AND
-                    action = 'LOGIN' AND
-                    remarks = '". $e->escape(session_id()) . "'");
-                    
-                
+              
                 session_regenerate_id(true);
                 $u->logout();
             }
@@ -76,6 +71,11 @@ class Pman_Login extends Pman
         if (!empty($_REQUEST['username'])) {
             $this->post();
         }
+        if (!empty($_REQUEST['switch'])) {
+            $this->switchUser($_REQUEST['switch']);
+        }
+        
+        
         $this->jerr("INVALID REQUEST");
         exit;
     }
@@ -123,6 +123,36 @@ class Pman_Login extends Pman
     }
 
     
+    function switchUser($id)
+    {
+        $tbl = empty($ff->Pman['authTable']) ? 'Person' : $ff->Pman['authTable'];
+        $u = DB_DataObject::factory($tbl);
+        if (!$u->isAuth()) {
+            $this->err("not logged in");
+        }
+        
+        $au = $u->getAuthUser();
+        
+        
+        // first check they have perms to do this..
+        if (!$au|| ($au->company()->comptype != 'OWNER') || !$this->hasPerm('Core.Person', 'E')) {
+            $this->jerr("User switching not permitted");
+        }
+        
+        
+        $u = DB_DataObject::factory($tbl);
+        $u->get($id);
+        if (!$u->active()) {
+            $this->jerr('Account disabled');
+        }
+        $u->login();
+            // we might need this later..
+        $this->addEvent("SWITCH USER", false, $au->name . ' TO ' . $u->name);
+        $this->jok("SWITCH");
+        
+    }
+    
+    
     var $domObj = false;
     function post()
     {
@@ -170,8 +200,18 @@ class Pman_Login extends Pman
             $this->jerr('Account disabled');
         }
         
+        // check if config allows non-owner passwords.
+        // auth_company = "OWNER" auth_company = "CLIENT"
+        $ff= HTML_FlexyFramework::get();
+        if (!empty($ff->Pman['auth_comptype']) && $ff->Pman['auth_comptype'] != $u->company()->comptype) {
+            $this->jerr("Login not permited to outside companies");
+        }
+        
+        
+        
         if ($u->checkPassword($_REQUEST['password'])) {
             $u->login();
+            // we might need this later..
             $this->addEvent("LOGIN", false, session_id());
             if (!empty($_REQUEST['lang'])) {
                 $u->lang($_REQUEST['lang']);