* Member::set_login_marker_cookie("SS_LOGGED_IN");
*
*
* And then adding this condition to each of the rewrite rules that make use of
* the static cache.
*
* RewriteCond %{HTTP_COOKIE} !SS_LOGGED_IN=1
*
*
* @param $cookieName string The name of the cookie to set.
*/
static function set_login_marker_cookie($cookieName) {
self::$login_marker_cookie = $cookieName;
}
/**
* Check if the passed password matches the stored one (if the member is not locked out).
*
* @param string $password
* @return ValidationResult
*/
public function checkPassword($password) {
$result = $this->canLogIn();
$spec = Security::encrypt_password(
$password,
$this->Salt,
$this->PasswordEncryption,
$this
);
$e = $spec['encryptor'];
if(!$e->compare($this->Password, $spec['password'])) {
$result->error(_t (
'Member.ERRORWRONGCRED',
'That doesn\'t seem to be the right e-mail address or password. Please try again.'
));
}
return $result;
}
/**
* Returns a valid {@link ValidationResult} if this member can currently log in, or an invalid
* one with error messages to display if the member is locked out.
*
* You can hook into this with a "canLogIn" method on an attached extension.
*
* @return ValidationResult
*/
public function canLogIn() {
$result = new ValidationResult();
if($this->isLockedOut()) {
$result->error(_t (
'Member.ERRORLOCKEDOUT',
'Your account has been temporarily disabled because of too many failed attempts at ' .
'logging in. Please try again in 20 minutes.'
));
}
$this->extend('canLogIn', $result);
return $result;
}
/**
* Returns true if this user is locked out
*/
public function isLockedOut() {
return $this->LockedOutUntil && time() < strtotime($this->LockedOutUntil);
}
/**
* Regenerate the session_id.
* This wrapper is here to make it easier to disable calls to session_regenerate_id(), should you need to.
* They have caused problems in certain
* quirky problems (such as using the Windmill 0.3.6 proxy).
*/
static function session_regenerate_id() {
if(!self::$session_regenerate_id) return;
// This can be called via CLI during testing.
if(Director::is_cli()) return;
$file = '';
$line = '';
// @ is to supress win32 warnings/notices when session wasn't cleaned up properly
// There's nothing we can do about this, because it's an operating system function!
if(!headers_sent($file, $line)) @session_regenerate_id(true);
}
/**
* Get the field used for uniquely identifying a member
* in the database. {@see Member::$unique_identifier_field}
*
* @return string
*/
static function get_unique_identifier_field() {
return self::$unique_identifier_field;
}
/**
* Set the field used for uniquely identifying a member
* in the database. {@see Member::$unique_identifier_field}
*
* @param $field The field name to set as the unique field
*/
static function set_unique_identifier_field($field) {
self::$unique_identifier_field = $field;
}
/**
* Set a {@link PasswordValidator} object to use to validate member's passwords.
*/
static function set_password_validator($pv) {
self::$password_validator = $pv;
}
/**
* Returns the current {@link PasswordValidator}
*/
static function password_validator() {
return self::$password_validator;
}
/**
* Set the number of days that a password should be valid for.
* Set to null (the default) to have passwords never expire.
*/
static function set_password_expiry($days) {
self::$password_expiry_days = $days;
}
/**
* Configure the security system to lock users out after this many incorrect logins
*/
static function lock_out_after_incorrect_logins($numLogins) {
self::$lock_out_after_incorrect_logins = $numLogins;
}
function isPasswordExpired() {
if(!$this->PasswordExpiry) return false;
return strtotime(date('Y-m-d')) >= strtotime($this->PasswordExpiry);
}
/**
* Logs this member in
*
* @param bool $remember If set to TRUE, the member will be logged in automatically the next time.
*/
function logIn($remember = false) {
self::session_regenerate_id();
Session::set("loggedInAs", $this->ID);
// This lets apache rules detect whether the user has logged in
if(self::$login_marker_cookie) Cookie::set(self::$login_marker_cookie, 1, 0);
$this->NumVisit++;
if($remember) {
$generator = new RandomGenerator();
$token = $generator->generateHash('sha1');
$this->RememberLoginToken = $token;
Cookie::set('alc_enc', $this->ID . ':' . $token, 90, null, null, null, true);
} else {
$this->RememberLoginToken = null;
Cookie::set('alc_enc', null);
Cookie::forceExpiry('alc_enc');
}
// Clear the incorrect log-in count
if(self::$lock_out_after_incorrect_logins) {
$this->FailedLoginCount = 0;
}
// Don't set column if its not built yet (the login might be precursor to a /dev/build...)
if(array_key_exists('LockedOutUntil', DB::fieldList('Member'))) {
$this->LockedOutUntil = null;
}
$this->write();
// Audit logging hook
$this->extend('memberLoggedIn');
}
/**
* Check if the member ID logged in session actually
* has a database record of the same ID. If there is
* no logged in user, FALSE is returned anyway.
*
* @return boolean TRUE record found FALSE no record found
*/
static function logged_in_session_exists() {
if($id = Member::currentUserID()) {
if($member = DataObject::get_by_id('Member', $id)) {
if($member->exists()) return true;
}
}
return false;
}
/**
* Log the user in if the "remember login" cookie is set
*
* The remember login token will be changed on every successful
* auto-login.
*/
static function autoLogin() {
// Don't bother trying this multiple times
self::$_already_tried_to_auto_log_in = true;
if(strpos(Cookie::get('alc_enc'), ':') && !Session::get("loggedInAs")) {
list($uid, $token) = explode(':', Cookie::get('alc_enc'), 2);
$SQL_uid = Convert::raw2sql($uid);
$member = DataObject::get_one("Member", "\"Member\".\"ID\" = '$SQL_uid'");
// check if autologin token matches
if($member && (!$member->RememberLoginToken || $member->RememberLoginToken != $token)) {
$member = null;
}
if($member) {
self::session_regenerate_id();
Session::set("loggedInAs", $member->ID);
// This lets apache rules detect whether the user has logged in
if(self::$login_marker_cookie) Cookie::set(self::$login_marker_cookie, 1, 0, null, null, false, true);
$generator = new RandomGenerator();
$member->RememberLoginToken = $generator->generateHash('sha1');
Cookie::set('alc_enc', $member->ID . ':' . $token, 90, null, null, false, true);
$member->NumVisit++;
$member->write();
// Audit logging hook
$member->extend('memberAutoLoggedIn');
}
}
}
/**
* Logs this member out.
*/
function logOut() {
Session::clear("loggedInAs");
if(self::$login_marker_cookie) Cookie::set(self::$login_marker_cookie, null, 0);
self::session_regenerate_id();
$this->extend('memberLoggedOut');
$this->RememberLoginToken = null;
Cookie::set('alc_enc', null);
Cookie::forceExpiry('alc_enc');
$this->write();
// Audit logging hook
$this->extend('memberLoggedOut');
}
/**
* Generate an auto login hash
*
* This creates an auto login hash that can be used to reset the password.
*
* @param int $lifetime The lifetime of the auto login hash in days (by default 2 days)
*
* @todo Make it possible to handle database errors such as a "duplicate key" error
*/
function generateAutologinHash($lifetime = 2) {
do {
$generator = new RandomGenerator();
$hash = $generator->generateHash('sha1');
} while(DataObject::get_one('Member', "\"AutoLoginHash\" = '$hash'"));
$this->AutoLoginHash = $hash;
$this->AutoLoginExpired = date('Y-m-d', time() + (86400 * $lifetime));
$this->write();
}
/**
* Return the member for the auto login hash
*
* @param bool $login Should the member be logged in?
*/
static function member_from_autologinhash($RAW_hash, $login = false) {
$SQL_hash = Convert::raw2sql($RAW_hash);
$member = DataObject::get_one('Member',"\"AutoLoginHash\"='" . $SQL_hash . "' AND \"AutoLoginExpired\" > " . DB::getConn()->now());
if($login && $member)
$member->logIn();
return $member;
}
/**
* Send signup, change password or forgot password informations to an user
*
* @param string $type Information type to send ("signup", "changePassword" or "forgotPassword")
* @param array $data Additional data to pass to the email (can be used in the template)
*/
function sendInfo($type = 'signup', $data = null) {
switch($type) {
case "signup":
$e = Object::create('Member_SignupEmail');
break;
case "changePassword":
$e = Object::create('Member_ChangePasswordEmail');
break;
case "forgotPassword":
$e = Object::create('Member_ForgotPasswordEmail');
break;
}
if(is_array($data)) {
foreach($data as $key => $value)
$e->$key = $value;
}
$e->populateTemplate($this);
$e->setTo($this->Email);
$e->send();
}
/**
* Returns the fields for the member form - used in the registration/profile module.
* It should return fields that are editable by the admin and the logged-in user.
*
* @return FieldSet Returns a {@link FieldSet} containing the fields for
* the member form.
*/
public function getMemberFormFields() {
$fields = parent::getFrontendFields();
$fields->replaceField('Password', $password = new ConfirmedPasswordField (
'Password',
$this->fieldLabel('Password'),
null,
null,
(bool) $this->ID
));
$password->setCanBeEmpty(true);
$fields->replaceField('Locale', new DropdownField (
'Locale',
$this->fieldLabel('Locale'),
i18n::get_existing_translations()
));
$fields->removeByName('RememberLoginToken');
$fields->removeByName('NumVisit');
$fields->removeByName('LastVisited');
$fields->removeByName('Bounced');
$fields->removeByName('AutoLoginHash');
$fields->removeByName('AutoLoginExpired');
$fields->removeByName('PasswordEncryption');
$fields->removeByName('Salt');
$fields->removeByName('PasswordExpiry');
$fields->removeByName('FailedLoginCount');
$fields->removeByName('LastViewed');
$fields->removeByName('LockedOutUntil');
$this->extend('updateMemberFormFields', $fields);
return $fields;
}
function getValidator() {
return new Member_Validator();
}
/**
* Returns the current logged in user
*
* @return bool|Member Returns the member object of the current logged in
* user or FALSE.
*/
static function currentUser() {
$id = Member::currentUserID();
if($id) {
return DataObject::get_one("Member", "\"Member\".\"ID\" = $id", true, 1);
}
}
/**
* Get the ID of the current logged in user
*
* @return int Returns the ID of the current logged in user or 0.
*/
static function currentUserID() {
$id = Session::get("loggedInAs");
if(!$id && !self::$_already_tried_to_auto_log_in) {
self::autoLogin();
$id = Session::get("loggedInAs");
}
return is_numeric($id) ? $id : 0;
}
private static $_already_tried_to_auto_log_in = false;
/*
* Generate a random password, with randomiser to kick in if there's no words file on the
* filesystem.
*
* @return string Returns a random password.
*/
static function create_new_password() {
if(file_exists(Security::get_word_list())) {
$words = file(Security::get_word_list());
list($usec, $sec) = explode(' ', microtime());
srand($sec + ((float) $usec * 100000));
$word = trim($words[rand(0,sizeof($words)-1)]);
$number = rand(10,999);
return $word . $number;
} else {
$random = rand();
$string = md5($random);
$output = substr($string, 0, 6);
return $output;
}
}
/**
* Event handler called before writing to the database.
*/
function onBeforeWrite() {
if($this->SetPassword) $this->Password = $this->SetPassword;
// If a member with the same "unique identifier" already exists with a different ID, don't allow merging.
// Note: This does not a full replacement for safeguards in the controller layer (e.g. in a registration form),
// but rather a last line of defense against data inconsistencies.
$identifierField = self::$unique_identifier_field;
if($this->$identifierField) {
// Note: Same logic as Member_Validator class
$idClause = ($this->ID) ? sprintf(" AND \"Member\".\"ID\" <> %d", (int)$this->ID) : '';
$existingRecord = DataObject::get_one(
'Member',
sprintf(
"\"%s\" = '%s' %s",
$identifierField,
Convert::raw2sql($this->$identifierField),
$idClause
)
);
if($existingRecord) {
throw new ValidationException(new ValidationResult(false, sprintf(
_t(
'Member.ValidationIdentifierFailed',
'Can\'t overwrite existing member #%d with identical identifier (%s = %s))',
PR_MEDIUM,
'The values in brackets show a fieldname mapped to a value, usually denoting an existing email address'
),
$existingRecord->ID,
$identifierField,
$this->$identifierField
)));
}
}
// We don't send emails out on dev/tests sites to prevent accidentally spamming users.
// However, if TestMailer is in use this isn't a risk.
if(
(Director::isLive() || Email::mailer() instanceof TestMailer)
&& $this->isChanged('Password')
&& $this->record['Password']
&& Member::$notify_password_change
) {
$this->sendInfo('changePassword');
}
// The test on $this->ID is used for when records are initially created.
// Note that this only works with cleartext passwords, as we can't rehash
// existing passwords.
if((!$this->ID && $this->Password) || $this->isChanged('Password')) {
// Password was changed: encrypt the password according the settings
$encryption_details = Security::encrypt_password(
$this->Password, // this is assumed to be cleartext
$this->Salt,
$this->PasswordEncryption,
$this
);
// Overwrite the Password property with the hashed value
$this->Password = $encryption_details['password'];
$this->Salt = $encryption_details['salt'];
$this->PasswordEncryption = $encryption_details['algorithm'];
// If we haven't manually set a password expiry
if(!$this->isChanged('PasswordExpiry')) {
// then set it for us
if(self::$password_expiry_days) {
$this->PasswordExpiry = date('Y-m-d', time() + 86400 * self::$password_expiry_days);
} else {
$this->PasswordExpiry = null;
}
}
}
// save locale
if(!$this->Locale) {
$this->Locale = i18n::get_locale();
}
parent::onBeforeWrite();
}
function onAfterWrite() {
parent::onAfterWrite();
if($this->isChanged('Password')) {
MemberPassword::log($this);
}
}
/**
* If any admin groups are requested, deny the whole save operation.
*
* @param Array $ids Database IDs of Group records
* @return boolean
*/
function onChangeGroups($ids) {
// Filter out admin groups to avoid privilege escalation,
// unless the current user is an admin already
if(!Permission::checkMember($this, 'ADMIN')) {
$adminGroups = Permission::get_groups_by_permission('ADMIN');
$adminGroupIDs = ($adminGroups) ? $adminGroups->column('ID') : array();
return count(array_intersect($ids, $adminGroupIDs)) == 0;
} else {
return true;
}
}
/**
* Check if the member is in one of the given groups.
*
* @param array|DataObjectSet $groups Collection of {@link Group} DataObjects to check
* @param boolean $strict Only determine direct group membership if set to true (Default: false)
* @return bool Returns TRUE if the member is in one of the given groups, otherwise FALSE.
*/
public function inGroups($groups, $strict = false) {
if($groups) foreach($groups as $group) {
if($this->inGroup($group, $strict)) return true;
}
return false;
}
/**
* Check if the member is in the given group or any parent groups.
*
* @param int|Group|string $group Group instance, Group Code or ID
* @param boolean $strict Only determine direct group membership if set to TRUE (Default: FALSE)
* @return bool Returns TRUE if the member is in the given group, otherwise FALSE.
*/
public function inGroup($group, $strict = false) {
if(is_numeric($group)) {
$groupCheckObj = DataObject::get_by_id('Group', $group);
} elseif(is_string($group)) {
$SQL_group = Convert::raw2sql($group);
$groupCheckObj = DataObject::get_one('Group', "\"Code\" = '{$SQL_group}'");
} elseif($group instanceof Group) {
$groupCheckObj = $group;
} else {
user_error('Member::inGroup(): Wrong format for $group parameter', E_USER_ERROR);
}
if(!$groupCheckObj) return false;
$groupCandidateObjs = ($strict) ? $this->getManyManyComponents("Groups") : $this->Groups();
if($groupCandidateObjs) foreach($groupCandidateObjs as $groupCandidateObj) {
if($groupCandidateObj->ID == $groupCheckObj->ID) return true;
}
return false;
}
/**
* Adds the member to a group. This will create the group if the given
* group code does not return a valid group object.
*
* @param string $groupcode
* @param string Title of the group
*/
public function addToGroupByCode($groupcode, $title = "") {
$group = DataObject::get_one('Group', "\"Code\" = '" . Convert::raw2sql($groupcode). "'");
if($group) {
$this->Groups()->add($group);
}
else {
if(!$title) $title = $groupcode;
$group = new Group();
$group->Code = $groupcode;
$group->Title = $title;
$group->write();
$this->Groups()->add($group);
}
}
/**
* Returns true if this user is an administrator.
* Administrators have access to everything.
*
* @deprecated Use Permission::check('ADMIN') instead
* @return Returns TRUE if this user is an administrator.
*/
function isAdmin() {
return Permission::checkMember($this, 'ADMIN');
}
/**
* @param Array $columns Column names on the Member record to show in {@link getTitle()}.
* @param String $sep Separator
*/
static function set_title_columns($columns, $sep = ' ') {
if (!is_array($columns)) $columns = array($columns);
self::$title_format = array('columns' => $columns, 'sep' => $sep);
}
//------------------- HELPER METHODS -----------------------------------//
/**
* Get the complete name of the member, by default in the format "
* $fields->push(
* new CheckboxSetField(
* "NewsletterSubscriptions",
* "Receive email notification of events in ",
* $sourceitems = DataObject::get("NewsletterType")->toDropDownMap("GroupID","Title"),
* $selectedgroups = $member->Groups()->Map("ID","ID")
* )
* );
*
*
* On the form handler:
*
*
* $groups = $member->Groups();
* $checkboxfield = $form->Fields()->fieldByName("NewsletterSubscriptions");
* $groups->setByCheckboxSetField($checkboxfield);
*
*
* @param CheckboxSetField $checkboxsetfield The CheckboxSetField (with
* data) from your form.
*/
function setByCheckboxSetField(CheckboxSetField $checkboxsetfield) {
// Get the values from the formfield.
$values = $checkboxsetfield->Value();
$sourceItems = $checkboxsetfield->getSource();
if($sourceItems) {
// If (some) values are present, add and remove as necessary.
if($values) {
// update the groups based on the selections
foreach($sourceItems as $k => $item) {
if(in_array($k,$values)) {
$add[] = $k;
} else {
$remove[] = $k;
}
}
// else we should be removing all from the necessary groups.
} else {
$remove = array_keys($sourceItems);
}
if($add)
$this->addManyByGroupID($add);
if($remove)
$this->RemoveManyByGroupID($remove);
} else {
USER_ERROR("Member::setByCheckboxSetField() - No source items could be found for checkboxsetfield " .
$checkboxsetfield->Name(), E_USER_WARNING);
}
}
/**
* Adds this member to the groups based on the group IDs
*
* @param array $ids Group identifiers.
*/
function addManyByGroupID($groupIds){
$groups = $this->getGroupsFromIDs($groupIds);
if($groups) {
foreach($groups as $group) {
$this->add($group);
}
}
}
/**
* Removes the member from many groups based on the group IDs
*
* @param array $ids Group identifiers.
*/
function removeManyByGroupID($groupIds) {
$groups = $this->getGroupsFromIDs($groupIds);
if($groups) {
foreach($groups as $group) {
$this->remove($group);
}
}
}
/**
* Returns the groups from an array of group IDs
*
* @param array $ids Group identifiers.
* @return mixed Returns the groups from the array of Group IDs.
*/
function getGroupsFromIDs($ids){
if($ids && count($ids) > 1) {
return DataObject::get("Group", "\"ID\" IN (" . implode(",", $ids) . ")");
} else {
return DataObject::get_by_id("Group", $ids[0]);
}
}
/**
* Adds this member to the groups based on the group codenames
*
* @param array $codenames Group codenames
*/
function addManyByCodename($codenames) {
$groups = $this->codenamesToGroups($codenames);
if($groups) {
foreach($groups as $group){
$this->add($group);
}
}
}
/**
* Removes this member from the groups based on the group codenames
*
* @param array $codenames Group codenames
*/
function removeManyByCodename($codenames) {
$groups = $this->codenamesToGroups($codenames);
if($groups) {
foreach($groups as $group) {
$this->remove($group);
}
}
}
/**
* Helper function to return the appropriate groups via a codenames
*
* @param array $codenames Group codenames
* @return array Returns the the appropriate groups.
*/
protected function codenamesToGroups($codenames) {
$list = "'" . implode("', '", $codenames) . "'";
$output = DataObject::get("Group", "\"Code\" IN ($list)");
// Some are missing - throw warnings
if(!$output || ($output->Count() != sizeof($list))) {
foreach($codenames as $codename)
$missing[$codename] = $codename;
if($output) {
foreach($output as $record)
unset($missing[$record->Code]);
}
if($missing)
user_error("The following group-codes aren't matched to any groups: " .
implode(", ", $missing) .
". You probably need to link up the correct group codes in phpMyAdmin",
E_USER_WARNING);
}
return $output;
}
}
/**
* Form for editing a member profile.
* @package sapphire
* @subpackage security
*/
class Member_ProfileForm extends Form {
function __construct($controller, $name, $member) {
Requirements::clear();
Requirements::css(CMS_DIR . '/css/typography.css');
Requirements::css(SAPPHIRE_DIR . "/css/Form.css");
$fields = $member->getCMSFields();
$fields->push(new HiddenField('ID','ID',$member->ID));
$actions = new FieldSet(
new FormAction('dosave',_t('CMSMain.SAVE', 'Save'))
);
$validator = new Member_Validator();
parent::__construct($controller, $name, $fields, $actions, $validator);
$this->loadDataFrom($member);
}
function dosave($data, $form) {
// don't allow ommitting or changing the ID
if(!isset($data['ID']) || $data['ID'] != Member::currentUserID()) {
return Director::redirectBack();
}
$SQL_data = Convert::raw2sql($data);
$member = DataObject::get_by_id("Member", $SQL_data['ID']);
if($SQL_data['Locale'] != $member->Locale) {
$form->addErrorMessage("Generic", _t('Member.REFRESHLANG'),"good");
}
$form->saveInto($member);
$member->write();
$closeLink = sprintf(
'(%s)',
_t('ComplexTableField.CLOSEPOPUP', 'Close Popup')
);
$message = _t('Member.PROFILESAVESUCCESS', 'Successfully saved.') . ' ' . $closeLink;
$form->sessionMessage($message, 'good');
Director::redirectBack();
}
}
/**
* Class used as template to send an email to new members
* @package sapphire
* @subpackage security
*/
class Member_SignupEmail extends Email {
protected $from = ''; // setting a blank from address uses the site's default administrator email
protected $subject = '';
protected $body = '';
function __construct() {
parent::__construct();
$this->subject = _t('Member.EMAILSIGNUPSUBJECT', "Thanks for signing up");
$this->body = '
' . _t('Member.EMAILSIGNUPINTRO1','Thanks for signing up to become a new member, your details are listed below for future reference.') . '
' . _t('Member.EMAILSIGNUPINTRO2','You can login to the website using the credentials listed below') . ':