fix check for sesssion settings

[Pman.Core] / DataObjects / Core_person.php

diff --git a/DataObjects/Core_person.php b/DataObjects/Core_person.php
index 740fb54..1f5e791 100644 (file)
--- a/DataObjects/Core_person.php
+++ b/DataObjects/Core_person.php
@@ -251,7 +251,10 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
     //   ---------------- authentication / passwords and keys stuff  ----------------
     function isAuth()
     {
-        @session_start();
+        // do not start a session if we are using http auth...
+        if (empty($_SERVER['PHP_AUTH_USER']) && php_sapi_name() != "cli") {
+            @session_start();
+        }
        
         $ff= HTML_FlexyFramework::get();
        
@@ -381,6 +384,9 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
         $u = DB_DataObject::factory($this->tableName());
         $u->whereAdd(' LENGTH(passwd) > 0');
         $n = $u->count();
+        if (empty($_SESSION[get_class($this)]) || !is_array($_SESSION[get_class($this)])) { 
+            $_SESSION[get_class($this)] = array();
+        }
         $_SESSION[get_class($this)][$sesPrefix .'-empty']  = $n;
         if (class_exists('PEAR')) {
             $error =  PEAR::getStaticProperty('DB_DataObject','lastError');
@@ -534,7 +540,58 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
         $month = $m > -1 ? date('Y-m') : date('Y-m', strtotime('LAST MONTH'));
         
         return md5(implode(',' ,  array($month, $this->email , $this->passwd, $this->id)));
-    } 
+    }
+    /**
+     * When we generate autologin urls:
+     * eg. /Somesite/Test/12
+     * it will generate:
+     * /Somesite/Test/12/{datetime}/{sha256(url + expires_datetime + password)}
+     *
+     * eg. genAutoLoginURL($sub, $expires)
+     */
+    function genAutoLoginURL($url, $expires = false)  
+    {
+        $expires = $expires  === false ? strtotime("NOW + 1 WEEK") : $expires;
+        //echo serialize(array($url, $expires, $this->email, $this->passwd));
+        //echo hash('sha256', serialize(array($url, $expires, $this->email, $this->passwd)));
+        
+        return $url.'/'.$this->id .'/'.$expires.'/'.
+            hash('sha256',
+                serialize(
+                    array($url, $expires, $this->email,$this->passwd)
+                )
+            );
+        
+    }
+    
+    function validateAutoLogin($called)
+    {
+        $bits = explode("/",$called);
+        if (count($bits) < 4) {
+            return false; // unrelated.
+        }
+        $hash = array_pop($bits);
+        $time = array_pop($bits);
+        
+        $id = array_pop($bits);
+        if (!is_numeric($time) || !is_numeric($id)) {
+            return false; // wrong format.
+        }
+        $u = DB_DataObject::Factory($this->tableName());
+        $u->get($id);
+        $url = implode("/", $bits);
+        if ($time < time()) {
+            return "Expired";
+        }
+        //echo serialize(array('/'.$url, $time, $u->email, $u->passwd));
+        //echo hash('sha256', serialize(array('/'.$url, $time, $u->email, $u->passwd)));
+        if ($hash == hash('sha256', serialize(array('/'.$url, $time*1, $u->email, $u->passwd)))) {
+            $u->login();
+            return $u;
+        }
+        return false;
+    }
+    
     
     function checkTwoFactorAuthentication($val)
     {
@@ -602,6 +659,9 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
     
     function company()
     {
+        if (empty($this->company_id)) {
+            return false;
+        }
         $x = DB_DataObject::factory('core_company');
         $x->autoJoin();
         $x->get($this->company_id);
@@ -1146,9 +1206,7 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
             
             COALESCE((
                 SELECT
-                    GROUP_CONCAT( 
-                        core_group.name
-                    , '\n')
+                    GROUP_CONCAT(  core_group.name separator  '\n')
                 FROM
                     core_group_member
                 LEFT JOIN
@@ -1162,7 +1220,7 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
     
     function setFromRoo($ar, $roo)
     {
-        $this->setFrom($ar);
+        $this->setFrom($ar); 
         
         if(!empty($ar['_enable_oath_key'])){
             $oath_key = $this->generateOathKey();
@@ -1183,7 +1241,7 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
         }
         // this only applies to our owner company..
         $c = $this->company();
-        if (empty($c->comptype_name) || $c->comptype_name != 'OWNER') {
+        if (empty($c) || empty($c->comptype_name) || $c->comptype_name != 'OWNER') {
             return true;
         }