1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
defined('BASEPATH') OR exit('No direct script access allowed'); |
4
|
|
|
|
5
|
|
|
class User_model extends CI_Model { |
6
|
|
|
|
7
|
|
|
public function __construct() { |
8
|
|
|
parent::__construct(); |
9
|
|
|
$this->load->library('encrypt'); |
10
|
|
|
} |
11
|
|
|
|
12
|
|
|
function resolve_user_login($username, $password) { |
|
|
|
|
13
|
|
|
|
14
|
|
|
$ldap = ldap_connect($this->config->item('ldapserver')); |
15
|
|
|
|
16
|
|
|
$ldaprdn = $this->config->item('ldapshortdomain') . $username; |
17
|
|
|
|
18
|
|
|
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); |
19
|
|
|
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); |
20
|
|
|
|
21
|
|
|
//bind with users creds |
22
|
|
|
$bind = @ldap_bind($ldap, $ldaprdn, $password); |
23
|
|
|
|
24
|
|
|
if ($bind) { |
25
|
|
|
$filter = "(sAMAccountName=$username)"; |
26
|
|
|
$result = ldap_search($ldap, $this->config->item('ldapuserou'), $filter); |
27
|
|
|
ldap_sort($ldap, $result, "sn"); |
28
|
|
|
$info = ldap_get_entries($ldap, $result); |
29
|
|
|
for ($i = 0; $i < $info["count"]; $i++) { |
|
|
|
|
30
|
|
|
return TRUE; |
31
|
|
|
} |
32
|
|
|
@ldap_close($ldap); |
|
|
|
|
33
|
|
|
if (@ldap_close($ldap) === false) { |
34
|
|
|
echo "Could not close LDAP connection"; |
35
|
|
|
} |
36
|
|
|
} else { |
37
|
|
|
return FALSE; |
38
|
|
|
} |
39
|
|
|
} |
40
|
|
|
|
41
|
|
|
function user_exist($username) { |
|
|
|
|
42
|
|
|
|
43
|
|
|
$db_intranet = $this->load->database('intranet', TRUE); |
44
|
|
|
|
45
|
|
|
$db_intranet->select('uID'); |
46
|
|
|
$db_intranet->from('Users'); |
47
|
|
|
$db_intranet->where('uName', $username); |
48
|
|
|
|
49
|
|
|
$query = $db_intranet->get(); |
50
|
|
|
|
51
|
|
|
if ($query->num_rows() > 0) { |
52
|
|
|
return true; |
53
|
|
|
} else { |
54
|
|
|
return false; |
55
|
|
|
} |
56
|
|
|
|
57
|
|
|
$this->db->close(); |
|
|
|
|
58
|
|
|
} |
59
|
|
|
|
60
|
|
|
function user_ldap($username) { |
|
|
|
|
61
|
|
|
|
62
|
|
|
$ldap = ldap_connect($this->config->item('ldapserver')); |
63
|
|
|
|
64
|
|
|
//bind with ldapquery |
65
|
|
|
$ldaprdn = $this->config->item('ldapshortdomain').$this->config->item('ldapbindun'); |
66
|
|
|
$ldappass = $this->config->item('ldapbindpass'); |
67
|
|
|
|
68
|
|
|
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); |
69
|
|
|
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); |
70
|
|
|
|
71
|
|
|
$bind = @ldap_bind($ldap, $ldaprdn, $ldappass); |
72
|
|
|
|
73
|
|
|
if ($bind) { |
74
|
|
|
$filter = "(sAMAccountName=$username)"; |
75
|
|
|
$result = ldap_search($ldap, $this->config->item('ldapuserou'), $filter); |
76
|
|
|
ldap_sort($ldap, $result, "sn"); |
77
|
|
|
$info = ldap_get_entries($ldap, $result); |
78
|
|
|
for ($i = 0; $i < $info["count"]; $i++) { |
|
|
|
|
79
|
|
|
if ($info['count'] > 1) |
80
|
|
|
break; |
81
|
|
|
|
82
|
|
|
//clean |
83
|
|
|
$groups = $info[$i]["memberof"]; |
84
|
|
|
unset($groups['count']); |
85
|
|
|
|
86
|
|
|
//only dashboard groups |
87
|
|
|
foreach ($groups as $key => $value) { |
88
|
|
|
$exp_key = explode(',', $value); |
89
|
|
|
if ($exp_key[1] == $this->config->item('ldapdashboardgroupsou')) { |
90
|
|
|
$dashboard_groups = array(); |
91
|
|
|
$dashboard_groups[] = $value; |
92
|
|
|
} |
93
|
|
|
} |
94
|
|
|
|
95
|
|
|
// if no dashboard groups |
96
|
|
|
if (isset($dashboard_groups) === FALSE) { |
97
|
|
|
$dashboard_groups = 0; |
98
|
|
|
} |
99
|
|
|
|
100
|
|
|
return array( |
101
|
|
|
'useraccountcontrol' => $info[$i]["useraccountcontrol"][0], |
102
|
|
|
'full_name' => $info[$i]["displayname"][0], |
103
|
|
|
'first_name' => $info[$i]["givenname"][0], |
104
|
|
|
'last_name' => isset($info[$i]["sn"][0]), |
105
|
|
|
'username' => $username, |
106
|
|
|
'email' => $info[$i]["mail"][0], |
107
|
|
|
'phone' => isset($info[$i]["telephonenumber"][0]), |
108
|
|
|
'position' => isset($info[$i]["title"][0]), |
109
|
|
|
'department' => isset($info[$i]["department"][0]), |
110
|
|
|
'ern' => isset($info[$i]["employeeid"][0]), |
111
|
|
|
'groups' => $groups, |
112
|
|
|
'dashboard_groups' => $dashboard_groups, |
|
|
|
|
113
|
|
|
); |
114
|
|
|
} |
115
|
|
|
@ldap_close($ldap); |
|
|
|
|
116
|
|
|
if (@ldap_close($ldap) === false) { |
117
|
|
|
echo "Could not close LDAP connection"; |
118
|
|
|
} |
119
|
|
|
} else { |
120
|
|
|
return FALSE; |
121
|
|
|
} |
122
|
|
|
} |
123
|
|
|
|
124
|
|
|
public function get_uid_from_username($username) { |
125
|
|
|
|
126
|
|
|
$db_intranet = $this->load->database('intranet', TRUE); |
127
|
|
|
|
128
|
|
|
$db_intranet->select('uID'); |
129
|
|
|
$db_intranet->from('Users'); |
130
|
|
|
$db_intranet->where('uName', $username); |
131
|
|
|
|
132
|
|
|
return $db_intranet->get()->row('uID'); |
133
|
|
|
} |
134
|
|
|
|
135
|
|
|
public function set_user($uid, $username, $ip) { |
136
|
|
|
|
137
|
|
|
$this->db->where('uid', $uid); |
138
|
|
|
$query = $this->db->get('users'); |
139
|
|
|
$current = $query->result_array(); |
140
|
|
|
|
141
|
|
|
// always available in model |
142
|
|
|
$two_hour_login = strtotime("-2 hours"); |
143
|
|
|
$current_timestamp = date("Y-m-d H:i:s", time()); |
144
|
|
|
$login_count = 1; |
|
|
|
|
145
|
|
|
$browser = $this->agent->browser() . ' ' . $this->agent->version(); |
146
|
|
|
|
147
|
|
|
if ($query->num_rows() > 0) { |
148
|
|
|
|
149
|
|
|
// model overide |
150
|
|
|
$last_timestamp = strtotime($current[0]['last_login']); |
151
|
|
|
$login_count = $current[0]['login_count'] + 1; |
152
|
|
|
|
153
|
|
|
if ($this->user_model->ip_is_private($ip) === FALSE) { |
154
|
|
|
// add 1 if external ip |
155
|
|
|
$external_login = $current[0]['external_login'] + 1; |
156
|
|
|
$ip_external = $ip; |
157
|
|
|
$ip_internal = $current[0]['ip_internal']; |
158
|
|
|
$last_external = $current_timestamp; |
159
|
|
|
} else { |
160
|
|
|
$external_login = $current[0]['external_login']; |
161
|
|
|
$ip_external = $current[0]['ip_external']; |
162
|
|
|
$ip_internal = $ip; |
163
|
|
|
$last_external = $current[0]['last_external']; |
164
|
|
|
} |
165
|
|
|
|
166
|
|
|
if ($last_timestamp <= $two_hour_login) { |
167
|
|
|
// update very 2 hours only |
168
|
|
|
$this->db->where('uid', $uid); |
169
|
|
|
return $this->db->update('users', array('last_login' => $current_timestamp, |
170
|
|
|
'login_count' => $login_count, |
171
|
|
|
'external_login' => $external_login, |
172
|
|
|
'ip_last' => $ip, |
173
|
|
|
'ip_internal' => $ip_internal, |
174
|
|
|
'ip_external' => $ip_external, |
175
|
|
|
'external_login' => $external_login, |
176
|
|
|
'browser' => $browser, |
177
|
|
|
'os' => $this->agent->platform(), |
178
|
|
|
'last_external' => $last_external, |
179
|
|
|
)); |
180
|
|
|
} else { |
181
|
|
|
// always up-to-date |
182
|
|
|
$this->db->where('uid', $uid); |
183
|
|
|
return $this->db->update('users', array('ip_last' => $ip, |
184
|
|
|
'ip_internal' => $ip_internal, |
185
|
|
|
'ip_external' => $ip_external, |
186
|
|
|
'external_login' => $external_login, |
187
|
|
|
'browser' => $browser, |
188
|
|
|
'os' => $this->agent->platform(), |
189
|
|
|
'last_active' => $current_timestamp, |
190
|
|
|
'last_external' => $last_external, |
191
|
|
|
)); |
192
|
|
|
} |
193
|
|
|
} else { |
194
|
|
|
|
195
|
|
|
if ($this->user_model->ip_is_private($ip) === FALSE) { |
196
|
|
|
// add 1 if external ip |
197
|
|
|
$external_login = 1; |
198
|
|
|
$ip_external = $ip; |
199
|
|
|
$ip_internal = 0; |
200
|
|
|
$last_external = $current_timestamp; |
201
|
|
|
} else { |
202
|
|
|
$external_login = 0; |
203
|
|
|
$ip_external = 0; |
204
|
|
|
$ip_internal = $ip; |
205
|
|
|
$last_external = NULL; |
206
|
|
|
} |
207
|
|
|
|
208
|
|
|
// first time login |
209
|
|
|
return $this->db->insert('users', array('uid' => $uid, |
210
|
|
|
'username' => $username, |
211
|
|
|
'last_login' => $current_timestamp, |
212
|
|
|
'login_count' => '1', |
213
|
|
|
'external_login' => $external_login, |
214
|
|
|
'ip_last' => $ip, |
215
|
|
|
'ip_internal' => $ip_internal, |
216
|
|
|
'ip_external' => $ip_external, |
217
|
|
|
'browser' => $browser, |
218
|
|
|
'os' => $this->agent->platform(), |
219
|
|
|
'last_active' => $current_timestamp, |
220
|
|
|
'last_external' => $last_external, |
221
|
|
|
)); |
222
|
|
|
} |
223
|
|
|
} |
224
|
|
|
|
225
|
|
|
function clean($string) { |
|
|
|
|
226
|
|
|
return preg_replace('/[\x00-\x09\x0B\x0C\x0E-\x1F\x7F]/', '', $string); |
227
|
|
|
} |
228
|
|
|
|
229
|
|
|
function decrypt($key, $cookie) { |
|
|
|
|
230
|
|
|
|
231
|
|
|
define('IV_SIZE', mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)); |
232
|
|
|
|
233
|
|
|
$combo = base64_decode($cookie); |
234
|
|
|
$iv = substr($combo, 0, IV_SIZE); |
235
|
|
|
$crypt = substr($combo, IV_SIZE, strlen($combo)); |
236
|
|
|
$username = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $crypt, MCRYPT_MODE_CBC, $iv); |
237
|
|
|
|
238
|
|
|
return $this->user_model->clean($username); |
239
|
|
|
} |
240
|
|
|
|
241
|
|
View Code Duplication |
function encrypt($key, $encrypt_item) { |
|
|
|
|
242
|
|
|
|
243
|
|
|
$iv = mcrypt_create_iv(IV_SIZE, MCRYPT_DEV_URANDOM); |
244
|
|
|
$crypt = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $encrypt_item, MCRYPT_MODE_CBC, $iv); |
245
|
|
|
$combo = $iv . $crypt; |
|
|
|
|
246
|
|
|
$output = base64_encode($iv . $crypt); |
247
|
|
|
|
248
|
|
|
return $output; |
249
|
|
|
} |
250
|
|
|
|
251
|
|
|
function ip_is_private($ip) { |
|
|
|
|
252
|
|
|
$safe_ip = array( |
253
|
|
|
$this->config->item('safeipone'), |
254
|
|
|
$this->config->item('safeiptwo'), |
255
|
|
|
$this->config->item('safeipthree'), |
256
|
|
|
$this->config->item('safeipfour'), |
257
|
|
|
$this->config->item('safeipfive'), |
258
|
|
|
$this->config->item('safeipsix'), |
259
|
|
|
$this->config->item('safeipseven'), |
260
|
|
|
$this->config->item('safeipeight'), |
261
|
|
|
$this->config->item('safeipnine'), |
262
|
|
|
$this->config->item('safeipten'), |
263
|
|
|
); |
264
|
|
|
|
265
|
|
|
if (in_array($_SERVER['REMOTE_ADDR'], $safe_ip)) { |
266
|
|
|
return true; |
267
|
|
|
} else { |
268
|
|
|
return false; |
269
|
|
|
} |
270
|
|
|
|
271
|
|
|
} |
272
|
|
|
|
273
|
|
|
function external_login_blocked($uid) { |
|
|
|
|
274
|
|
|
|
275
|
|
|
$this->db->select('external_login_block'); |
276
|
|
|
$this->db->from('users'); |
277
|
|
|
$this->db->where('uid', $uid); |
278
|
|
|
|
279
|
|
|
$query = $this->db->get()->result_array(); |
280
|
|
|
|
281
|
|
|
if ($query[0]['external_login_block'] === '0') { |
282
|
|
|
return true; |
283
|
|
|
} else { |
284
|
|
|
return false; |
285
|
|
|
} |
286
|
|
|
} |
287
|
|
|
|
288
|
|
|
function external_login_fail($uid) { |
|
|
|
|
289
|
|
|
|
290
|
|
|
$this->db->where('uid', $uid); |
291
|
|
|
$query = $this->db->get('users'); |
292
|
|
|
$current = $query->result_array(); |
293
|
|
|
|
294
|
|
|
if ($current[0]['external_login_block'] == '0') { |
295
|
|
|
$new = 0; |
296
|
|
|
} else { |
297
|
|
|
$new = $current[0]['external_login_block'] - 1; |
298
|
|
|
} |
299
|
|
|
|
300
|
|
|
$this->db->where('uid', $uid); |
301
|
|
|
return $this->db->update('users', array('external_login_block' => $new)); |
302
|
|
|
} |
303
|
|
|
|
304
|
|
|
function external_login_reset($uid) { |
|
|
|
|
305
|
|
|
|
306
|
|
|
$this->db->where('uid', $uid); |
307
|
|
|
return $this->db->update('users', array('external_login_block' => 5)); |
308
|
|
|
} |
309
|
|
|
|
310
|
|
|
public function user_log() { |
311
|
|
|
|
312
|
|
|
$ip = $_SERVER['REMOTE_ADDR']; |
313
|
|
|
$data = array( |
314
|
|
|
'timestamp' => date("Y-m-d H:i:s", time()), |
315
|
|
|
'ip' => $ip, |
316
|
|
|
'username' => $_SESSION['username'], |
317
|
|
|
'url' => current_url(), |
318
|
|
|
); |
319
|
|
|
|
320
|
|
|
return $this->db->insert('users_log', $data); |
321
|
|
|
} |
322
|
|
|
|
323
|
|
|
public function function_log($function) { |
324
|
|
|
|
325
|
|
|
$ip = $_SERVER['REMOTE_ADDR']; |
326
|
|
|
|
327
|
|
|
if (isset($_SESSION['username'])) { |
328
|
|
|
$username = $_SESSION['username']; |
329
|
|
|
} else { |
330
|
|
|
$username = NULL; |
331
|
|
|
} |
332
|
|
|
|
333
|
|
|
$data = array( |
334
|
|
|
'timestamp' => date("Y-m-d H:i:s", time()), |
335
|
|
|
'ip' => $ip, |
336
|
|
|
'username' => $username, |
337
|
|
|
'url' => current_url(), |
338
|
|
|
'function' => $function |
339
|
|
|
); |
340
|
|
|
|
341
|
|
|
return $this->db->insert('users_log', $data); |
342
|
|
|
} |
343
|
|
|
|
344
|
|
|
public function resolve_passkey($passid, $passkey) { |
345
|
|
|
|
346
|
|
|
$this->db->select('passkey'); |
347
|
|
|
$this->db->from('passkey'); |
348
|
|
|
$this->db->where('passid', $passid); |
349
|
|
|
$decrypt = $this->db->get()->row('passkey'); |
350
|
|
|
|
351
|
|
|
$hash = $this->encrypt->decode($decrypt); |
352
|
|
|
|
353
|
|
|
return password_verify($passkey, password_hash($hash, PASSWORD_BCRYPT)); |
354
|
|
|
; |
355
|
|
|
} |
356
|
|
|
|
357
|
|
|
public function get_passkey_details($passid) { |
358
|
|
|
|
359
|
|
|
$query = $this->db->get_where('passkey', array('passid' => $passid)); |
360
|
|
|
return $query->result_array(); |
361
|
|
|
} |
362
|
|
|
|
363
|
|
|
public function log_passkey($ip, $passid) { |
364
|
|
|
|
365
|
|
|
if (isset($_SESSION['username']) === TRUE) { |
366
|
|
|
$username = $_SESSION['username']; |
367
|
|
|
} else { |
368
|
|
|
$username = NULL; |
369
|
|
|
} |
370
|
|
|
|
371
|
|
|
$data = array( |
372
|
|
|
'timestamp' => date("Y-m-d H:i:s", time()), |
373
|
|
|
'ip' => $ip, |
374
|
|
|
'passid' => $passid, |
375
|
|
|
'username' => $username, |
376
|
|
|
); |
377
|
|
|
|
378
|
|
|
return $this->db->insert('passkey_log', $data); |
379
|
|
|
} |
380
|
|
|
|
381
|
|
|
} |
382
|
|
|
|
383
|
|
|
// END model |
384
|
|
|
|
Adding explicit visibility (
private
,protected
, orpublic
) is generally recommend to communicate to other developers how, and from where this method is intended to be used.