diff --git a/activate_roles.php b/activate_roles.php
index 16efc5fb..87254999 100644
--- a/activate_roles.php
+++ b/activate_roles.php
@@ -14,10 +14,10 @@
-
-
-
+
- ";
+
+ ";
if (get_config('use_ajaxQueue')) {
$src .= "
";
diff --git a/php/inc/header.inc.php b/php/inc/header.inc.php
index ff1afcce..cbca3683 100644
--- a/php/inc/header.inc.php
+++ b/php/inc/header.inc.php
@@ -9,14 +9,9 @@
$tpl_print_incidents = configuration_vars::get_instance()->print_incidents_template;
try {
- $cookie = new Cookie();
- $cookie->validate();
- if (isset($_SESSION['userdata'])
- and isset($_SESSION['userdata']['current_role'])
- and $_SESSION['userdata']['current_role'] !== false) {
$fp = configuration_vars::get_instance()->forbidden_pages;
$uri = $_SERVER['REQUEST_URI'];
- $role = $_SESSION['userdata']['current_role'];
+ $role = get_current_role();
$forbidden = false;
foreach($fp[$role] as $page) {
if (strpos($uri, $page) !== false) {
@@ -25,18 +20,10 @@
}
}
if ($forbidden) {
- /* $firephp->log('forbidden'); */
- /* $firephp->log($uri, 'uri'); */
- /* $firephp->log($role, 'role'); */
- /* $firephp->log($_SESSION, 'session'); */
- /* $firephp->log($_SERVER, 'server'); */
header("Location: index.php");
}
- }
-
}
catch (AuthException $e) {
- // var_dump($_COOKIE);
echo("caught AuthException: $e");
header("Location: login.php?originating_uri=".$_SERVER['REQUEST_URI']);
exit;
diff --git a/php/inc/header.inc.version.php b/php/inc/header.inc.version.php
index bd0f54cf..a45b47e4 100644
--- a/php/inc/header.inc.version.php
+++ b/php/inc/header.inc.version.php
@@ -4,4 +4,4 @@
* Do not edit it, but instead run
* php make_canned_responses.php
*/
-$aixada_vesion_lastDate = '20170304_234636';
+$aixada_vesion_lastDate = '20181210_140125';
diff --git a/php/inc/menu.inc.php b/php/inc/menu.inc.php
index 860db6f7..07ee9a0c 100644
--- a/php/inc/menu.inc.php
+++ b/php/inc/menu.inc.php
@@ -1,49 +1,52 @@
- ' .
+ $Text['nav_help'] . ' | ';
+
+ // Login name and uf_id
+ echo $Text['nav_signedIn'] . " " . get_session_value('login').
+ " | " . $Text['uf_long'] . ' ' . get_session_value('uf_id') .
+ " | " . get_session_value('provider_id');
+
+ // Select rol
+ echo ' ';
- if ($_SESSION['userdata']['login'] != '') {
+ // Select lang
+ $cfg_use_shop = get_config('use_shop', 'order_and_stock');
+ if (get_config('show_menu_language_select', false)) {
+ echo ' ';
+ }
+ echo " | ";
- echo ''.$Text['nav_help'].' | ';
- if (isset($_SESSION['userdata']['can_checkout']) and
- $_SESSION['userdata']['can_checkout']) {
- echo '' . $Text['nav_can_checkout'] . ' ';
- }
- echo $Text['nav_signedIn'] . " " . $_SESSION['userdata']['login'] . " | "
- . $Text['uf_long'] . ' ' . $_SESSION['userdata']['uf_id'] . " | "
- . $_SESSION['userdata']['provider_id'];
- echo ' ';
-
- $cfg_use_shop = get_config('use_shop', 'order_and_stock');
- if (get_config('show_menu_language_select', false)) {
- echo ' ';
- }
- echo " | ";
-
-
- echo "".$Text['nav_logout']."";
-
- } else {
- echo ("userdata not set");
- header('Location:login.php');
- }
+ // logout
+ echo "" .
+ $Text['nav_logout'] . "";
+ } else {
+ echo "userdata not set";
+ header('Location:login.php');
+ }
?>
@@ -72,7 +75,7 @@
-
';
} else {
echo '';
diff --git a/php/lib/report_manager.php b/php/lib/report_manager.php
index 36633b41..20b73650 100644
--- a/php/lib/report_manager.php
+++ b/php/lib/report_manager.php
@@ -9,10 +9,6 @@
require_once(__ROOT__ . 'local_config/config.php');
require_once(__ROOT__ . 'php'.DS.'utilities'.DS.'general.php');
-if (!isset($_SESSION)) {
- session_start();
- }
-
require_once(__ROOT__ . 'local_config'.DS.'lang'.DS. get_session_language() . '.php');
require_once(__ROOT__ . 'php/inc/database.php');
diff --git a/php/lib/report_orders.php b/php/lib/report_orders.php
index 71425b5c..d455652f 100644
--- a/php/lib/report_orders.php
+++ b/php/lib/report_orders.php
@@ -4,9 +4,6 @@
*/
require_once(__ROOT__ . 'local_config/config.php');
require_once(__ROOT__ . 'php/utilities/general.php');
-if (!isset($_SESSION)) {
- session_start();
-}
require_once(__ROOT__ . 'local_config/lang/' . get_session_language() . '.php');
require_once(__ROOT__ . 'php/inc/database.php');
diff --git a/php/utilities/general.php b/php/utilities/general.php
index 98a2415d..6f9be02c 100644
--- a/php/utilities/general.php
+++ b/php/utilities/general.php
@@ -4,100 +4,196 @@
require_once(__ROOT__ . 'local_config'.DS.'config.php');
/**
- *
+ * Creates a Aixada session of the user.
+ */
+function create_session(
+ $user_id,
+ $login,
+ $uf_id,
+ $member_id,
+ $provider_id,
+ $roles,
+ $current_role,
+ $language_keys,
+ $language_names,
+ $current_language_key,
+ $theme
+ ) {
+ load_session();
+ $_SESSION['userdata'] = array(
+ 'user_id' => $user_id,
+ 'login' => $login,
+ 'uf_id' => $uf_id,
+ 'member_id' => $member_id,
+ 'provider_id' => $provider_id,
+ 'roles' => $roles,
+ 'current_role' => $current_role,
+ 'language_keys' => $language_keys,
+ 'language_names' => $language_names,
+ 'language' => $current_language_key,
+ 'theme' => $theme,
+ 'cli_addr' => $_SERVER['REMOTE_ADDR'],
+ 'cli_agent' => $_SERVER['HTTP_USER_AGENT'],
+ 't_created' => time(),
+ 't_saved' => time()
+ );
+ save_session();
+}
+
+/**
+ * Load php session if is not yet loaded.
+ */
+function load_session() {
+ if (!isset($_SESSION)) {
+ session_start();
+ }
+}
+
+/**
+ * Determines if the Aixada session of the user exist, returns true/false
+ */
+function is_created_session() {
+ load_session();
+ return isset($_SESSION['userdata']);
+}
+
+/**
+ * Logout Aixada session destroying php session.
+ */
+function logout_session() {
+ load_session();
+ session_regenerate_id(true);
+ session_unset();
+ session_destroy();
+}
+
+/**
+ * Save Aixada session (only used in this general.php)
+ */
+function save_session() {
+ $_SESSION['userdata']['t_saved'] = time();
+ session_commit();
+}
+
+/**
+ * Validate the Aixada session, throw error if the user is not logged in.
+ */
+function validate_session() {
+ load_session();
+ if (!isset($_SESSION['userdata'])) {
+ throw new AuthException("Not logged in");
+ }
+ // For compatibility with old versions the creation tate is forced if it does not exist.
+ if (!isset($_SESSION['userdata']['t_saved'])) {
+ $_SESSION['userdata']['t_saved'] = time();
+ $_SESSION['userdata']['cli_addr'] = $_SERVER['REMOTE_ADDR'];
+ $_SESSION['userdata']['cli_agent'] = $_SERVER['HTTP_USER_AGENT'];
+ }
+
+ // Check if the session is still valid.
+ if ((time() - $_SESSION['userdata']['t_saved']) > 30 * 86400 || // More than 30 days inactive
+ $_SESSION['userdata']['cli_addr'] !== $_SERVER['REMOTE_ADDR'] || // Client IP address is changed
+ $_SESSION['userdata']['cli_agent'] !== $_SERVER['HTTP_USER_AGENT'] // Client browser is changed
+ ) {
+ logout_session();
+ throw new AuthException("Not logged in");
+ }
+ if ((time() - $_SESSION['userdata']['t_saved']) > 15 * 60) { // > 15 min
+ save_session();
+ load_session();
+ }
+}
+
+/**
+ * Returns a value of the Aixada session, throw error if is not logged in.
+ */
+function get_session_value($name) {
+ validate_session();
+ return $_SESSION['userdata'][$name];
+}
+
+/**
* Returns the user_id of the logged user; wraps a check around this, in order to make sure
* the value is set.
*/
function get_session_user_id() {
-
- if (isset($_SESSION['userdata']['user_id']) && $_SESSION['userdata']['user_id'] > 0 ) {
- return $_SESSION['userdata']['user_id'];
- } else {
- throw new Exception("$_Session data user_id is not set!! ");
- }
+ return get_session_value('user_id');
}
-
/**
- *
* returns the uf of the logged user.
*/
function get_session_uf_id() {
-
- if (isset($_SESSION['userdata']['uf_id']) && $_SESSION['userdata']['uf_id'] > 0 ) {
- return $_SESSION['userdata']['uf_id'];
- } else {
- throw new Exception("$_Session data uf_id is not set!! ");
- }
+ return get_session_value('uf_id');
}
-
/**
- *
* Returns the member_id of the logged user.
*/
function get_session_member_id() {
-
- if (isset($_SESSION['userdata']['member_id']) && $_SESSION['userdata']['member_id'] > 0 ) {
- return $_SESSION['userdata']['member_id'];
- } else {
- throw new Exception("$_Session data member_id is not set!! ");
- }
+ return get_session_value('member_id');
}
/**
- *
* Returns the login of the logged user.
*/
function get_session_login() {
-
- if (isset($_SESSION['userdata']['login']) && $_SESSION['userdata']['login'] != "") {
- return $_SESSION['userdata']['login'];
- } else {
- throw new Exception("$_Session data login is not set!! ");
- }
+ return get_session_value('login');
}
-
/**
- *
* returns the language for the logged user
*/
function get_session_language() {
- if (isset($_SESSION['userdata']['language']) and $_SESSION['userdata']['language'] != '') {
- return $_SESSION['userdata']['language'];
+ if (is_created_session()) {
+ return $_SESSION['userdata']['language'];
} else {
- return configuration_vars::get_instance()->default_language;
+ return configuration_vars::get_instance()->default_language;
}
}
-
/**
- *
* returns the theme for the logged user
*/
function get_session_theme() {
- if (isset($_SESSION['userdata']['theme']) and $_SESSION['userdata']['theme'] != '') {
+ if (is_created_session()) {
return $_SESSION['userdata']['theme'];
} else {
return configuration_vars::get_instance()->default_theme;
}
}
-
/**
- *
* retrieves active role of the logged user
*/
function get_current_role()
{
- if (isset($_SESSION['userdata']['current_role']) and $_SESSION['userdata']['current_role'] != '') {
- return $_SESSION['userdata']['current_role'];
- } else {
- return false;
+ return get_session_value('current_role');
+}
+
+/**
+* Changes the role of a user. Information is written to $_SESSION['userdata'].
+*/
+function change_session_role($new_role) {
+ validate_session();
+ if (!in_array($new_role, $_SESSION['userdata']['roles'])) {
+ throw new AuthException("Not logged in role");
}
+ $_SESSION['userdata']['current_role'] = $new_role;
+ save_session();
}
+/**
+* Changes the language of a user. Information is written to $_SESSION['userdata'].
+*/
+function change_session_language($new_language_key) {
+ validate_session();
+ if (!in_array($new_language_key, $_SESSION['userdata']['language_keys'])) {
+ throw new AuthException("Language is not valid");
+ }
+ $_SESSION['userdata']['language'] = $new_language_key;
+ save_session();
+}
/**
*