class.bertasecurity.php

<?php

/*
 ==================================================================================================================================

    CLASS BertaSecurity

    Manages security and ip-tracking operations:
         (*) Log-in and log-out
         (*) Session-based authentification
         (*) Protected areas

 ==================================================================================================================================
*/

class BertaSecurity {

    const BERTASECURITY_ERROR_SESSION_VARIABLE = 1;     // session variable corrupt
    const BERTASECURITY_ERROR_SESSION_EXPIRED = 2;          // session expired
    const BERTASECURITY_ERROR_SESSION_IP_CONFLICT = 3;      // ip address has changed
    const BERTASECURITY_ERROR_LOGIN_VARIABLE = 4;           // login variables corrupt or empty
    const BERTASECURITY_ERROR_LOGIN_INCORRECT = 5;          // login user and password incorrect

    public $authExpiresSeconds; // session idle time
    public $authUseAuthentification = false;

    public $authentificated = false; // if
    public $userLoggedIn = false;

    public $user;               // array of all user information available in the database (id, ident, nick, email, etc.)

    public $accessIP;               // array containing ip address by bytes
    public $accessIPStr = '';

    public $errAuth = 0;    // the reason (id), why autentification failed;
    public $errLogin = 0;   // the reason (id), why login failed;

    public function BertaSecurity($authEnvironment = 'site', $authExpiresSeconds = 21600) {
        $this->authExpiresSeconds = $authExpiresSeconds;
        $this->authUseAuthentification = true;

        $this->authentificated = $this->authUseAuthentification ? $this->authentificate() : true;


        // todo - change relying on userLoggedIn to a new environment variable
        if($authEnvironment == 'site') {
            $this->userLoggedIn = false;
        }
    }


    public function getAccessIP() {
        $this->accessIPStr = $_SERVER["REMOTE_ADDR"];
        if(preg_match("/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/", $this->accessIPStr, $ipRegs)) {
            $this->accessIP = array((int) $ipRegs[1],
                                    (int) $ipRegs[2],
                                    (int) $ipRegs[3],
                                    (int) $ipRegs[4]);
            return $this->accessIP;
        } else
            return false;
    }




    // ------------------------------------------------------------------------------------------------------------------------------
    // --    Login and authentification    ------------------------------------------------------------------------------------------
    // ------------------------------------------------------------------------------------------------------------------------------


    public function authentificate() {
        //echo Berta::$options['SITE_ABS_ROOT'];
        session_name(BertaUtils::canonizeString('berta_' . Berta::$options['version'] . '_' . Berta::$options['SITE_ABS_ROOT'], '_', ''));
        session_start();
        $curTime = time();

        //var_dump($_SESSION);

        //echo $curTime - $_SESSION['_berta__user']['last_access'];

        if(isset($_SESSION['_berta__user']) && is_array($_SESSION['_berta__user'])) {
            if(($curTime - $_SESSION['_berta__user']['last_access'] <= $this->authExpiresSeconds)) {
                if($_SESSION['_berta__user']['last_ip'] == $_SERVER['REMOTE_ADDR']) {

                    $_SESSION['_berta__user']['last_access'] = $curTime;
                    $this->user = $_SESSION['_berta__user'];
                    $this->userLoggedIn = true;

                    if(!empty($_REQUEST['_security_reload_user']))
                        $this->updateUserSettings($this->user);

                    return $this->userLoggedIn = true;

                } else {
                    $this->destroy(self::BERTASECURITY_ERROR_SESSION_IP_CONFLICT); // ip conflict
                    return $this->userLoggedIn = false;
                }
            } else {
                $this->destroy(self::BERTASECURITY_ERROR_SESSION_EXPIRED);
                return $this->userLoggedIn = false;
            }

        } elseif(isset($_SESSION['_berta__user']) && !is_array($_SESSION['_berta__user'])) {
            $this->destroy(self::BERTASECURITY_ERROR_SESSION_VARIABLE);
            return $this->userLoggedIn = false;

        } else {
            return $this->userLoggedIn = false;
        }
    }



    public function goToLoginPage($loginPageRelativeURL) {
        $qS = $this->errAuth ? "?autherror=" . $this->errAuth : "";
        if(headers_sent()) {
            echo '<script language="javascript" type="text/javascript">window.location="' . $loginPageRelativeURL . $qS . '";</script>';
            echo '<p>Please wait... (or <a href="' . $loginPageRelativeURL . $qS . '">click here</a> if nothing happens)</p>';
        } else
            header('Location: ' . $loginPageRelativeURL . $qS);

        exit;
    }


    public function login($name, $pass, $realName, $realPass) {
        if($name && $pass) {
            if($name == $realName && $pass == $realPass) {
                $this->destroy();
                session_start();
                $this->updateUserSettings(array('name' => $realName));

                return $this->userLoggedIn = true;

            } else {
                $this->errLogin = self::BERTASECURITY_ERROR_LOGIN_INCORRECT;    // wrong creditentials
                return false;
            }

        } else {
            $this->errLogin = self::BERTASECURITY_ERROR_LOGIN_VARIABLE; // no identification supplied
            return false;
        }

    }


    public function destroy($authErrNo = false) {
        if(isset($_SESSION['_berta__user'])) unset($_SESSION['_berta__user']);
        @session_destroy();
        $this->user = array();
        //echo $authErrNo;

        return true;
    }


    public function updateUserSettings($user = false) {

        if(isset($user["last_access_sec"])) $this->user["prev_access"] = $user["last_access_sec"];
        if(isset($user["last_ip"])) $this->user["prev_ip"] = $user["last_ip"];
        $this->user = array_merge($user, array(
                          "user_name" => $user["name"] ? $user["name"] : $user['nickname'],
                          "login_time" => time(),
                          "last_access" => time(),
                          "last_ip" => $_SERVER['REMOTE_ADDR']));

        $_SESSION['_berta__user'] = $this->user;
    }








    // ------------------------------------------------------------------------------------------------------------------------------
    // --    Misc    ----------------------------------------------------------------------------------------------------------------
    // ------------------------------------------------------------------------------------------------------------------------------


    public function getError($errType, $errId) {
        switch($errType) {
            case "auth":
                switch($errId) {
                    case self::BERTASECURITY_ERROR_SESSION_VARIABLE: return "Please check whether your browser supports cookies!";
                    case self::BERTASECURITY_ERROR_SESSION_EXPIRED: return "The max idle time is " . round($this->authExpiresSeconds / 60) . " minutes.";
                    case self::BERTASECURITY_ERROR_SESSION_IP_CONFLICT: return "Your IP address has changed... any idea why?";
                    default: return "Unknown error (id: $errId).";
                }
            case "login":
                switch($errId) {
                    case self::BERTASECURITY_ERROR_LOGIN_VARIABLE: return "Pardon?";
                    case self::BERTASECURITY_ERROR_LOGIN_INCORRECT:
                        $arr = array("Pardon?");
                        return $arr[array_rand($arr)];
                    case 8: return "You have been deactivated.";
                    default: return "Unknown error ($errId)";
                }
        }
    }











    function dispNocacheHeaders() {
        if(!headers_sent()) {
            header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
            header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
            header("Cache-Control: no-store, no-cache, must-revalidate");
            header("Cache-Control: post-check=0, pre-check=0", false);
            header("Pragma: no-cache");
            return true;
        }
        return false;
    }


}

?>