Auth.php

gehe zur Dokumentation dieser Datei

<?php
require_once('rights/User_SQL.php');

class Auth_Exception extends Exception
{
    const  LOGIN_REQUIRED = 1; 
    const  LOGIN_REQUIRED_TEXT = 'Bitte melden Sie sich an.'; 
    const  WRONG_PASSWORD = 2; 
    const  WRONG_PASSWORD_TEXT = 'Falscher Benutzername oder falsches Passwort.';
    const  LOGIN_DENIED = 3; 
    const  LOGIN_DENIED_TEXT = 'Sie dürfen sich an diesem Server nicht anmelden.';
    const  WRONG_IP = 4; 
    const  WRONG_IP_TEXT = 'Sie dürfen sich auf Grund der IP-Beschränkungen nicht anmelden';
    const  WRONG_TIME = 5; 
    const  WRONG_TIME_TEXT = 'Sie dürfen sich auf Grund der Zeit-Beschränkung nicht anmelden';
    const  AUTH_ERROR = 6; 
    const  AUTH_ERROR_TEXT = 'Fehlerhafte Konfiguration.';
    const  NO_MULTIPLE_LOGIN = 7; 
    const  NO_MULTIPLE_LOGIN_TEXT = 'Dieser Benutzer befindet sich zur Zeit schon im System.';
    const  WRONG_PASSWORD_LIMIT = 8; 
    const  WRONG_PASSWORD_LIMIT_TEXT = 'Das Passwort wurde zu oft falsch eingegeben.';
    const  CONCURRENT_USERS_LIMIT = 9; 
    const  CONCURRENT_USERS_LIMIT_TEXT = 'Sie dürfen sich derzeit am System nicht anmelden, da die maximale Anzahl an gleichzeitigen Benutzern erreicht ist. Bitte versuchen Sie es später erneut.';
    const  PERMISSION_DENIED = 32; 
    const  PERMISSION_DENIED_TEXT = 'Der Zugriff wird auf Grund fehlender Rechte verweigert.';
    const  MUST_CHANGE_PASSWORD = 64; 
    const  MUST_CHANGE_PASSWORD_TEXT = 'Das Passwort muss geändert werden.';
    const  INVALID_LOGIN_PARAMETERS = 128; 
    const  INVALID_LOGIN_PARAMETERS_TEXT = 'Bitte geben Sie einen Benutzernamen an.';

    const  LOGIN_TIMED_OUT = 256; 
    const  LOGIN_TIMED_OUT_TEXT = 'Ihre Anmeldung ist abgelaufen. Bitte melden Sie sich erneut an.';

    function __construct($text, $nr)
    {
        if ($nr == 2) // falsches Passwort
        {
            $bf_file = $GLOBALS['egotec_conf']['tmp_dir'].'wrong_pwd'.md5(Ego_System::getIp());
            if(file_exists($bf_file))
            {
                list ($s, $n) = explode(' ', file_get_contents($bf_file));
            }
            file_put_contents($bf_file, $s.' '.(++$n));
        }
        parent::__construct($text, $nr);
    }
}

class Auth
{
    const  LOGIN = 'login'; 
    const  LOGOUT = 'logout'; 
    const  ID = 'id'; 
    const  WEBDAV = 'webdav'; 
    const NO_NULL_RIGHTS = ',child,edit,release,remove,view,workflow,live,linkto,';

    protected  $_id = ''; 
    public  $user; 
    private static  $_userRecord = array(); 
    private $superUserFlag = null;

    public  $isEditable = true; 
    public function __construct($force_login=false, $id='', $action='', $param=array())
    {
        $this->_id = $id;
        if(isset($action))
        {
            switch ($action)
            {
                case Auth::LOGIN: // Benutzer anmeldem.
                    $this->reset();
                    $this->_id = $this->validate($param['username'], $param['password']);
                    $this->_id = $this->postValidate();
                    break;
                case Auth::LOGOUT: // Benutzer abmelden.
                    $this->reset();
                    break;
                case Auth::ID: // Als Benutzer über die ID anmelden.
                    $this->_id = $this->postValidate();
                    $this->clearCache();
            }
        }
        if (!$this->_id && $force_login)
        {
            throw new Auth_Exception(Auth_Exception::LOGIN_REQUIRED_TEXT, Auth_Exception::LOGIN_REQUIRED);
        }
        if ($this->_id)
        {
            if (!$action && $_SESSION['AUTH_TIME'][$this->_id] && $_SESSION['AUTH_TIME'][$this->_id]+$GLOBALS['egotec_conf']['auth_timeout']<time())
            { // Timeout.
                $this->reset();
                throw new Auth_Exception(Auth_Exception::LOGIN_TIMED_OUT_TEXT, Auth_Exception::LOGIN_TIMED_OUT);
            } else
            {
                if (!$this->user) {
                    $this->user = $this->_getUser();
                }
                $_SESSION['AUTH_TIME'][$this->_id] = time();

                if (in_array($action, array(Auth::LOGIN, Auth::ID)) && $GLOBALS['admin_area'] !== 'webdav')
                {
                    $db = new_db_connection();
                    $this->user->extra['Anzahl_login'] = $this->user->extra['Anzahl_login'] +1;
                    $this->user->extra['Anzahl_login_'.$GLOBALS['site']->name] = $this->user->extra['Anzahl_login_'.$GLOBALS['site']->name] +1;
                    $sid = session_id();
                    $now = date('Y-m-d H:i:s');
                    $db->update(array(
                        'table' => 'egotec_user',
                        'set'   => array(
                            'sid'   => $sid,
                            'last_login'    => $now,
                            'extra' => serialize($this->user->extra)
                        ),
                        'where' => 'user_id=\''.$this->_id.'\''
                    ));
                }
            }
        }
    }

    public function reset()
    {
        $this->clearCache();
        unset($_SESSION['AUTH_TIME']);
        unset($_SESSION['auth_id']);
        unset($_SESSION['intranet_admin']);
        unset($_SESSION['is_adoptuser']);
        unset($_SESSION['login']);
        if (!empty($GLOBALS['egotec_conf']['auth']['sso_logout'])) {
            $_SESSION['logout'] = true; // Nach dem ersten Logout gibt es kein SSO mehr.
        }
        if ($this->_id)
        {
            $db = new_db_connection();
            $db->delete(array(
                'table' => 'egotec_page_lock',
                'where' => 'user_id=\''.$this->_id.'\''
            ));
            $db->update(array(
                'table' => 'egotec_user',
                'set'   => array('sid' => ''),
                'where' => 'user_id=\''.$this->_id.'\''
            ));
        }
        $this->_id = '';
    }

    public function validate($username, $password) {
        if (!$password) {
            throw new Auth_Exception(Auth_Exception::WRONG_PASSWORD_TEXT, Auth_Exception::WRONG_PASSWORD);
        }

        // Den Benutzer in der Datenbank abfragen
        $db = new_db_connection(array(
            'fields' => '*',
            'from' => 'egotec_user',
            'where' => 'username = :username',
            'bind' => array(
                'username' => $username
            )
        ));

        if ($db->nextRecord()) {
            // Benutzer wurde gefunden
            $id = $db->Record['user_id'];
            $this->_id = $id;
            $this->user = $this->_getUser();

            if (!$this->user->isPassword($password)) {
                $this->_id = '';
                throw new Auth_Exception(Auth_Exception::WRONG_PASSWORD_TEXT, Auth_Exception::WRONG_PASSWORD);
            } elseif (!$this->user->field['salt']) {
                // Salt setzen
                $this->user->setPassword($password);
                $this->user->update();
            }

            return $id;
        }
        throw new Auth_Exception(Auth_Exception::WRONG_PASSWORD_TEXT, Auth_Exception::WRONG_PASSWORD);
    }

    public function clearTrashUsers() {
        $db = new_db_connection();
        if ($this->hasSuperuserPermission(true, true)) {
            // Alle Benutzer löschen
            $db->delete(array(
                'table' => 'egotec_user',
                'where' => 'deleted = 1'
            ));
        } else {
            // Nur Benutzer löschen, für die man Rechte besitzt
            $users = $this->getTrashUsers();
            $user_ids = array();
            foreach ($users as $user) {
                $user_ids[] = $user['user_id'];
            }
            if (!empty($user_ids)) {
                $db->delete(array(
                    'table' => 'egotec_user',
                    'where' => "deleted = 1 AND user_id IN ('" . implode("', '", $user_ids) . "')"
                ));
            }
        }
        $msg = $this->translate("Der Benutzer Papierkorb wurde geleert.");
        return $msg;
    }

    public function getTrashUsers() {
        $db = new_db_connection();
        $db->select(array(
            'table' => 'egotec_user',
            'where' => 'deleted = 1'
        ));
        $users = array();
        while ($db->nextRecord()) {
            if (!$this->hasSuperuserPermission(true, true)) {
                $user = new User_SQL($db->Record['user_id']);
                $rel = $user->getGroupRoleRelations();
                if (!empty($rel)) { // Nicht zugeordnete Benutzer darf jeder bearbeiten
                    $next = true;
                    foreach ($rel as $group => $roles) {
                        $roles = explode(',', $roles);
                        foreach ($roles as $role) {
                            if ($this->hasPermission($group, $role, false, false, false)) {
                                $next = false;
                                break 2;
                            }
                        }
                    }
                    if ($next) {
                        continue;
                    }
                }
            }
            $users[] = $db->Record;
        }
        return $users;
    }

    public function postValidate()
    {
        if (!$this->_id)
        {
            return false;
        }
        try {
            $this->user = new User_SQL($this->_id);
        } catch (User_Exception $e) {
            return false;
        }

        $this->extra = $this->user->extra;

        $days = array("Mon","Tue","Wed","Thu","Fri","Sat","Sun");
        $group_ips = array();
        $user_ips = array();
        $group_times = array();
        $user_times = array();

        if ($this->user->extra['ip_rights'] != "")
        {
            $user_ip_arr = explode("\n", $this->user->extra['ip_rights']);
            foreach ($user_ip_arr as $entry)
            {
                $entry = str_replace('*', '', $entry);
                $entry = trim($entry);
                if ($entry)
                {
                    $user_ips['_'.$entry] = $entry;
                }
            }
        }

        if ($this->user->extra['time_rights'] != '')
        {
            $user_time_arr = explode("\n", $this->user->extra['time_rights']);
            foreach ($user_time_arr as $entry)
            {
                $day_arr = explode(" ",$entry);
                $user_times[$day_arr[0]] = $day_arr[1];
            }
        }

        $db = new_db_connection(array(
            'fields' => '*',
            'from' => 'egotec_user_group',
            'join'  => array('egotec_group on egotec_group.group_id = egotec_user_group.group_id'),
            'where' => "user_id='$this->_id'"
        ));

        $groupDesc_arr = array();
        do {
            $groupDesc = str_replace("\n\r", "\n", $db->Record['group_descr']);
            if (strpos($groupDesc, "\n\n")>=0)
            {
                $groupDesc_arr1 = explode("\n", $groupDesc);
                foreach ($groupDesc_arr1 as $line)
                {
                    if (trim($line)=='')
                    {
                        $add_flag = false;
                    }else
                    {
                        $groupDesc_arr[] = trim($line);
                    }
                }
            }
        }while($db->nextRecord());



        if ($groupDesc_arr)
        {
            // die berschreibung durchgehen
            foreach ($groupDesc_arr as $entry)
            {
                // check ob $entry eine IP ist
                if (strpos($entry, 'IP:') === 0)
                {
                    $entry = str_replace('IP:', '', $entry);
                    $entry = trim($entry);
                    $ip_arr = explode(' ',$entry);
                    $ip_arr[0] = trim(str_replace('*', '',$ip_arr[0]));
                    $group_ips['_'.$ip_arr[0]] = $ip_arr[0];
                    continue;
                }

                // check ob $entry eine zeit ist
                foreach ($days as $day)
                {

                    if (strpos($entry, "$day ") === 0)
                    { // wir haben einen tag
                        $group_times[] = $entry;
                    }
                }
            }
        }

        $ips = array_merge($group_ips,$user_ips);
        $times = array_merge($group_times,$user_times);

        // check ob die IP gleich der Session IP ist. bzw ob welche da sind
        if (count($ips) > 0)
        {
            $ipcheck = false;
            $currentIP = Ego_System::getIp();
            foreach ($ips as $ip)
            {
                if (strpos($currentIP, $ip)===0)
                {
                    $ipcheck = true;
                    break;
                }
            }

            if (!$ipcheck)
            {
                throw new Auth_Exception(Auth_Exception::WRONG_IP_TEXT, Auth_Exception::WRONG_IP);
            }
        }

        // check ob eine zeitbeschraenkung vorliegt bzw. ob der benutzer in diesem Zeit Frame ist
        if (count($times) > 0)
        {
            $timecheck = false;

            // aktueller tag mit stunde
            // Mon-10
            //echo date('D-H'); exit;
            $dayTime_arr = explode('-', date('D-H'));

            foreach($times as $entry)
            {
                $day_arr = explode(' ',$entry);
                $day = $day_arr[0];
                $time = $day_arr[1];
                $time_arr = explode("-",$time);
                $day_start = $time_arr[0];
                $day_end = $time_arr[1];

                if($day == $dayTime_arr[0])
                { //aktueller tag
                    if($dayTime_arr[1] < $day_start)
                    {
                        break; // frame hat noch nicht angefangen
                    }
                    elseif($dayTime_arr[1] >= $day_end)
                    {
                        break; // frame zu ende
                    }
                    else
                    {
                        // im zeit frame
                        $timecheck = true;
                    }
                }
            }

            if(!$timecheck)
            {
                throw new Auth_Exception(Auth_Exception::WRONG_TIME_TEXT, Auth_Exception::WRONG_TIME);
            }
        }
        if (isset($GLOBALS['admin_area']) && $GLOBALS['egotec_conf']['liveserver'])
        { // Auf einem Liveserver
            if (!$this->user->extra['liveserver'])
            {
                throw new Auth_Exception(Auth_Exception::LOGIN_DENIED_TEXT, Auth_Exception::LOGIN_DENIED);
            }
        }
        if ($this->user->isInactive()) {
            // Ein inaktiver Benutzer kann sich nicht anmelden.
            throw new Auth_Exception(Auth_Exception::WRONG_PASSWORD_TEXT, Auth_Exception::WRONG_PASSWORD);
        }
        if (!$this->user->getGroupRoleRelations()) {
            // Nicht zugeordneter Benutzer kann sich nicht anmelden.
            throw new Auth_Exception(Auth_Exception::LOGIN_DENIED_TEXT, Auth_Exception::LOGIN_DENIED);
        }
        if ($this->user->field['sid']
            && !$this->user->field['multiple_login']
            && $this->user->field['sid']!=$_COOKIE[EGOTEC]
            && $this->user->isActive()
            && $GLOBALS['admin_area'] != 'webdav'
        ) {
            // Meldet sich ein Benutzer mit einer neuen Session an, so wird die alte zerstört und der Benutzer angemeldet.
            sess_destroy($this->user->field['sid']);
        }
        self::makeFlat($this->_id);
        if ($GLOBALS['admin_area']) {
            // Anmeldung über den Adminbereich
            $_SESSION['login']['admin'] = true;
        }
        return $this->_id;
    }

    function getId()
    {
        return $this->_id;
    }

    public function getAnonymousId() {
        return '#'.substr(
            md5(Ego_System::getIp().$_SERVER['HTTP_USER_AGENT']),
            1
        ); // muss 32-Zeichen lang sein
    }

    public function translate($string, $placeholders = array(), $language = null)
    {
        global $site;
        require_once('smarty/Ego_Smarty.php');
        require_once('smarty/plugins/block.t.php');
        $smarty = $GLOBALS['smarty']?$GLOBALS['smarty']:new Ego_Smarty();

        if ($language) {
            $params['language'] = $language;
        } elseif (!$GLOBALS['admin_area']) {
            $params['language'] = $site->language;
        } else {
            $params['language'] = $this->user&&$this->user->extra['lang']?$this->user->extra['lang']:'de';
        }
        $params['placeholders'] = $placeholders;
        return smarty_block_t($params, $string, $smarty);
    }

    function getPageTableQuery($page_table, $rights, $query=array(), $param=array())
    {
        $is_null = true;
        if (is_array($rights))
        {
            if (sizeof($rights)>1)
            {
                $rights_condition = ' IN (\''.join('\',\'', $rights).'\')';
                $is_null = false;
                foreach ($rights as $right)
                {
                    if (strpos(Auth::NO_NULL_RIGHTS, ','.$right.',')===false)
                    {
                        $is_null = true;
                    }
                }
            } else
            {
                $rights_condition = '=\''.$rights[0].'\'';
                if (strpos(Auth::NO_NULL_RIGHTS, ','.$rights[0].',')!==false)
                {
                    $is_null = false;
                }
            }
        } else
        {
            $rights_condition = '=\''.$rights.'\'';
            if (strpos(Auth::NO_NULL_RIGHTS, ','.$rights.',')!==false)
            {
                $is_null = false;
            }
        }
        if ($param['user_id'])
        {
            $user_id = $param['user_id'];
            self::makeFlat($user_id);
        } else {
            $user_id = $this->_id;
            if ($this->hasSuperuserPermission())
            { // Ein Superuser darf alles.
                return $query;
            }
        }
        $as_page_table = $query['page_table'] ?? $page_table;
        if ($user_id)
        {
            if (isset($query['join']) && !is_array($query['join'])) {
                $query['join'] = array($query['join']);
                egotec_deprecated_log('14.6.3'); // join muss als Array übergeben werden
            }
            $query['join'][] = $page_table.'_rights ON '.
                $page_table.'_rights.page_id='.$as_page_table.'.id AND '.
                $page_table.'_rights.perm'.$rights_condition;
            $query['join'][] = 'egotec_user_group_flat ON '.
                $page_table.'_rights.group_id=egotec_user_group_flat.group_id AND '.
                $page_table.'_rights.role_id=egotec_user_group_flat.role_id AND '.
                'egotec_user_group_flat.user_id=\''.$user_id.'\'';
            $query['join'][] = $page_table.'_users ON '.
                $page_table.'_users.page_id='.$as_page_table.'.id AND '.
                $page_table.'_users.perm'.$rights_condition.' AND '.
                $page_table.'_users.user_id=\''.$user_id.'\'';
            $query['where'] = ($query['where']?$query['where'].' AND ':'').
                '(egotec_user_group_flat.user_id IS NOT NULL OR '.
                $page_table.'_rights.group_id=\'*\' OR '.
                $page_table.'_users.user_id IS NOT NULL'.
                ($is_null?' OR '.$page_table.'_rights.group_id IS NULL':'').
                ($param['auth_or']?' OR '.$param['auth_or']:'').')';
            $query['distinct'] = 1;
        } else
        { // Wenn keine Authentifizierung vorliegt, dann werden nur nicht beschränkte Seiten zurückgegeben.
            $query['join'][] = $page_table.'_rights on '.$page_table.'_rights.page_id='.$as_page_table.'.id AND '.$page_table.'_rights.perm '.$rights_condition;
            $query['where'] = ($query['where']?'('.$query['where'].') AND ':'').
                                '('.$page_table."_rights.group_id='*' AND ".$page_table."_rights.role_id='*')";
        }
        return $query;
    }

    function hasPermission($group, $role='', $flag=false, $user_id=false, $equal=true)
    {
        if ($this->superUserFlag) {
            return true; // Der Superuser darf alles.
        }
        if (is_array($group))
        {
            $role = $group['role'];
            $flag = $group['flag'];
            $group = $group['group'];
        }
        if (!$group && !$role)
        {
            return true;
        }
        if (!$user_id)
        {
            $user_id = $this->_id;
        }
        if (!$flag)
        { // Nur auf Mitgliedschaft in übergeordnete Gruppen prüfen.
            $db = new_db_connection(array(
                'from'  => 'egotec_user_group'.
                    ($group?', egotec_group, egotec_group user_group':'').
                    ($role?', egotec_role, egotec_role user_role':''),
                'where' => "egotec_user_group.user_id = '".$user_id."'
                    ".($group?" AND
                        egotec_user_group.group_id = user_group.group_id AND
                        egotec_group.group_id = '$group' AND
                        user_group.links <= egotec_group.links AND
                        user_group.rechts >= egotec_group.rechts
                    ":'').($role?" AND
                        egotec_user_group.role_id = user_role.role_id AND
                        egotec_role.role_id = '$role' AND
                        user_role.links <= egotec_role.links AND
                        user_role.rechts >= egotec_role.rechts
                    ":'').(!$equal && $group && $role ?" AND (
                        user_group.links != egotec_group.links OR
                        user_role.links != egotec_role.links)
                    ":'')
            ));
        } else
        { // Auf Mitgliedschaft in über und untergeordneten Gruppen prüfen.
            $db = new_db_connection(array(
                'from'  => 'egotec_user_group'.
                    ($group?', egotec_group, egotec_group user_group':'').
                    ($role?', egotec_role, egotec_role user_role':''),
                'where' => "egotec_user_group.user_id = '".$user_id."'
                    ".($group?" AND
                        egotec_user_group.group_id = user_group.group_id AND
                        egotec_group.group_id = '$group' AND ( (
                            user_group.links <= egotec_group.links AND
                            user_group.rechts >= egotec_group.rechts
                        ) OR (
                            egotec_group.links <= user_group.links AND
                            egotec_group.rechts >= user_group.rechts
                        ) )
                    ":'').($role?" AND
                        egotec_user_group.role_id = user_role.role_id AND
                        egotec_role.role_id = '$role' AND ( (
                            user_role.links <= egotec_role.links AND
                            user_role.rechts >= egotec_role.rechts
                        ) OR (
                            egotec_role.links <= user_role.links AND
                            egotec_role.rechts >= user_role.rechts
                        ) )
                    ":'')
            ));
        }
        return (bool) $db->next();
    }

    public function hasPermissionOn($object, $equal = true) {
        if (is_a($object, 'User_SQL')) {
            $relations = $object->getGroupRoleRelations();
            if (empty($relations)) {
                // Für nicht zugeordnete Benutzer hat man immer Rechte
                return true;
            }
            foreach ($relations as $group => $roles) {
                foreach (explode(',', $roles) as $role) {
                    if ($this->hasPermission($group, $role, false, false, $equal)) {
                        return true;
                    }
                }
            }
        } elseif (is_a($object, 'Group_SQL')) {
            return $this->hasPermission($object->field['group_id']);
        } elseif (is_a($object, 'Role_SQL')) {
            return $this->hasPermission('', $object->field['role_id']);
        }
        return false;
    }

    function hasSuperuserPermission($session = true, $recalc = false) {
        if ($recalc) {
            $this->superUserFlag = null;
        } elseif ($GLOBALS['soap'] || $GLOBALS['rest']) {
            $session = false;
        }
        if ($this->superUserFlag === null || !$session) {
            $this->superUserFlag = (!$session || $_SESSION['login']['is_superuser'])
                && $this->hasPermission($GLOBALS['egotec_conf']['superuser']['group'], $GLOBALS['egotec_conf']['superuser']['role']);
        }
        return $this->superUserFlag;
    }

    function isSoapUser()
    {
        if ($this->user->extra['anrede'] == "SOAP")
        {
            return true;
        } else {
            return false;
        }
    }

    function isNobody()
    {
        return $this->_id==NULL;
    }

    function checkSuperuserPermission()
    {
        return $this->checkPermission($GLOBALS['egotec_conf']['superuser']['group'], $GLOBALS['egotec_conf']['superuser']['role']);
    }

    function checkPermission($group, $role='', $flag = false)
    {
        if ($this->hasPermission($group, $role, $flag))
        {
            return true;
        } else
        {
            throw new Auth_Exception(Auth_Exception::PERMISSION_DENIED_TEXT, Auth_Exception::PERMISSION_DENIED);
        }
    }

    public static function getLanguages()
    {
        $languages = array();
        $handle = opendir($GLOBALS['egotec_conf']['lib_dir'].'locale');
        while ($file = readdir ($handle))
        {
            if ($file[0] != '.')
            {
                $languages[] = $file;
            }
        }
        closedir($handle);

        if(Ego_System::file_exists($GLOBALS['egotec_conf']['var_dir'].'lib/locale'))
        {
            $handle2 = opendir($GLOBALS['egotec_conf']['var_dir'].'lib/locale');
            while ($file = readdir ($handle2))
            {
                if ($file[0] != '.')
                {
                    $languages[] = $file;
                }
            }
            closedir($handle2);
        }
        sort($languages);
        return array_unique($languages);
    }

    static function getUserRecord($user_id)
    {
        if (isset(Auth::$_userRecord[$user_id]))
        {
            return Auth::$_userRecord[$user_id];
        }
        $db = new_db_connection(array(
            'table' => 'egotec_user',
            'where' => "user_id='".$user_id."'"
        ));
        if ($db->nextRecord())
        {
            $user_record = $db->Record;
            $user_record['extra'] = unserialize($user_record['extra']);

            try {
                require_once('rights/User_SQL.php');
                $user = new User_SQL($user_id, $db->Record);
                $user_record['fullname'] = $user->getFullname();
            } catch (User_Exception $e) {
                // ignorieren
            }
        } else
        {
            $user_record = array('username' => $GLOBALS['auth']->translate('unbekannt'));
            $user_record['fullname'] = $user_record['username'];
        }
        AUTH::$_userRecord[$user_id] = $user_record;
        return $user_record;
    }

    static function getUsers($rights, $users=array(), $direct_flag=false)
    {
        require_once('rights/User_Iterator.php');
        if ($rights)
        {
            $query = array();
            if ($direct_flag)
            {
                $query['distinct'] = true;
                $query['fields'] = 'egotec_user.*';
                $query['table'] = 'egotec_user';
                $query['join'][] = 'egotec_user_group ON egotec_user.user_id = egotec_user_group.user_id';
                $where = array();
                foreach ($rights as $right)
                {
                    $where[] = "egotec_user_group.group_id='".$right['group_id']."' AND egotec_user_group.role_id='".$right['role_id']."'";
                }
                $query['where'] = '('.join(') OR (', $where).')';
            } else
            {
                $query['distinct'] = true;
                $query['fields'] = 'egotec_user.*';
                $query['from'] = 'egotec_user';
                $query['join'][] = 'egotec_user_group ON egotec_user_group.user_id = egotec_user.user_id';
                $query['join'][] = 'egotec_group direct_group ON egotec_user_group.group_id = direct_group.group_id';
                $query['join'][] = "egotec_group ON egotec_group.links >= direct_group.links AND egotec_group.rechts <= direct_group.rechts";
                $query['join'][] = 'egotec_role direct_role ON egotec_user_group.role_id = direct_role.role_id';
                $query['join'][] = "egotec_role ON egotec_role.links >= direct_role.links AND egotec_role.rechts <= direct_role.rechts";
                $where = array();
                foreach ($rights as $right)
                {
                    $where[] = "egotec_group.group_id='".$right['group_id']."' AND egotec_role.role_id='".$right['role_id']."'";
                }
                $query['where'] = '('.join(') OR (', $where).')';
            }
            if ($users)
            {
                $query2['fields'] = 'egotec_user.*';
                $query2['table'] = 'egotec_user';
                foreach ($users as $user)
                {
                    if (is_array($user)) {
                        $user_ids[] = $user['user_id'];
                    } else {
                        $user_ids[] = $user;
                    }
                }
                $query2['where'] = "user_id IN ('".join("','", $user_ids)."')";
                return new User_Iterator(new_db_connection(array(
                    'union' => array($query, $query2)
                )));
            } else {
                return new User_Iterator(new_db_connection($query));
            }
        } elseif ($users)
        {
            foreach ($users as $user)
            {
                if (is_array($user)) {
                    $user_ids[] = $user['user_id'];
                } else {
                    $user_ids[] = $user;
                }
            }
            $db = new_db_connection(array(
                'fields'    => '*',
                'table' => 'egotec_user',
                'where' => "user_id IN ('".join("','", $user_ids)."')"
            ));
            return new User_Iterator($db);
        } else
        {
            return new User_Iterator();
        }
    }

    function clearCache()
    {
        if ($this->_id)
        {
            //require_once('base/functions.php');
            if (function_exists('deldir'))
            {
                $cache_dir = $GLOBALS['egotec_conf']['cache_dir'].'_user/'.$this->_id;
                deldir($cache_dir);
            }
        }
    }

    static function checkPassword($pwd, $name=0, $return_text=false)
    {
        $min_len = $GLOBALS['egotec_conf']['auth']['min_passw_chars'];
        $min_upper = $GLOBALS['egotec_conf']['auth']['min_big_chars'];
        $min_lower = $GLOBALS['egotec_conf']['auth']['min_small_chars'];
        $min_numbers = $GLOBALS['egotec_conf']['auth']['min_digits'];
        $min_special = $GLOBALS['egotec_conf']['auth']['min_extra_chars'];
        $max_same_chars = ($GLOBALS['egotec_conf']['auth']['no_chars_from_username'])?$GLOBALS['egotec_conf']['auth']['no_chars_from_username']-1:false;
        $min_erfuellt = ($GLOBALS['egotec_conf']['auth']['min_ok_parameters'])?$GLOBALS['egotec_conf']['auth']['min_ok_parameters']:0; // Alle müssen stimmen

        $nicht_erfuellt = array();

        $erfuellt = 0;
        if ($min_len)
        {
            if (strlen($pwd) >= $min_len) $erfuellt++;
            else $nicht_erfuellt[] = $return_text
                ? $GLOBALS['auth']->translate('Das Passwort ist zu kurz (vorgegeben: %n).', array('n' => $min_len))
                : 'min_len';
        }
        if ($min_upper)
        {
            $anz=0;
            for($i=0;$i<strlen($pwd);$i++)
            {
                $ascii = ord($pwd[$i]); // Ascii-Wert eines einzelnen Zeichens
                if ($ascii > 64 && $ascii < 91) $anz++;
            }
            if ($anz >= $min_upper) $erfuellt++;
            else $nicht_erfuellt[] = $return_text
                ? $GLOBALS['auth']->translate('Das Passwort hat zu wenige Großbuchstaben (vorgegeben: %n).', array('n' => $min_upper))
                : 'min_upper';
        }
        if ($min_lower)
        {
            $anz=0;
            for($i=0;$i<strlen($pwd);$i++)
            {
                $ascii = ord($pwd[$i]); // Ascii-Wert eines einzelnen Zeichens
                if ($ascii > 96 && $ascii < 123) $anz++;
            }
            if ($anz >= $min_lower) $erfuellt++;
            else $nicht_erfuellt[] = $return_text
                ? $GLOBALS['auth']->translate('Das Passwort hat zu wenige Kleinbuchstaben (vorgegeben: %n).', array('n' => $min_lower))
                : 'min_lower';
        }
        if ($min_numbers)
        {
            $anz=0;
            for($i=0;$i<strlen($pwd);$i++)
            {
                $ascii = ord($pwd[$i]); // Ascii-Wert eines einzelnen Zeichens
                if ($ascii > 47 && $ascii < 58) $anz++;
            }
            if ($anz >= $min_numbers) $erfuellt++;
            else $nicht_erfuellt[] = $return_text
                ? $GLOBALS['auth']->translate('Das Passwort hat zu wenige Zahlen (vorgegeben: %n).', array('n' => $min_numbers))
                : 'min_numbers';
        }
        if ($min_special)
        {
            $anz=0;
            for($i=0;$i<strlen($pwd);$i++)
            {
                $ascii = ord($pwd[$i]); // Ascii-Wert eines einzelnen Zeichens
                if (
                    ($ascii > 31 && $ascii < 48) ||
                    ($ascii > 57 && $ascii < 65) ||
                    ($ascii > 90 && $ascii < 95) ||
                    ($ascii > 122 && $ascii < 127)
                ) $anz++;
            }
            if ($anz >= $min_special) $erfuellt++;
            else $nicht_erfuellt[] = $return_text
                ? $GLOBALS['auth']->translate('Das Passwort hat zu wenige Sonderzeichen (vorgegeben: %n).', array('n' => $min_special))
                : 'min_special';
        }

        // zählen wie oft ein zeichen aus dem namen genommen wird
        if ($name)
        {
            if ($max_same_chars !== false)
            {
                $same_chars = 0;
                for ($i=0;$i<strlen($pwd);$i++)
                {
                    for ($ii=0;$ii<strlen($name);$ii++)
                    {
                        if ($name[$ii] == $pwd[$i])
                        {
                            $same_chars++;
                        }
                    }
                }
                if ($same_chars <= $max_same_chars) $erfuellt++;
                else $nicht_erfuellt[] = $return_text
                    ? $GLOBALS['auth']->translate('Das Passwort hat zu viele Zeichen aus dem Benutzernamen (vorgegeben: %n).', array('n' => $max_same_chars))
                    : 'same_chars';
            }
        }

        // Ausschlussliste prüfen
        if (file_exists($GLOBALS['egotec_conf']['var_dir'].'conf/pw_exclusion_list.txt'))
        {
            $words_array = file($GLOBALS['egotec_conf']['var_dir'].'conf/pw_exclusion_list.txt');
            if ($words_array)
            {
                foreach ($words_array as $word)
                {
                    if ($pwd == trim($word,"\n\r"))
                    {
                        return array(
                            $return_text
                                ? $GLOBALS['auth']->translate('Das Passwort darf nicht verwendet werden.')
                                : 'pw_exclusion_list'
                        );
                    }
                }
            }
        }

        if ($min_erfuellt == 0)
        { // alles muss erfuellt werden
            if (sizeof($nicht_erfuellt) == 0)
            {
                return true;
            }
        } else if ($erfuellt >= $min_erfuellt)
        {
            return true;
        }

        return $nicht_erfuellt;
    }

    public function getAllGroups()
    {
        $db = new_db_connection(
            array(
                'fields'    => 'group_id',
                'table'     => 'egotec_group'
            )
        );
        return new Group_Iterator($db);
    }

    public function getAllRoles()
    {
        $db = new_db_connection(
            array(
                'fields'    => 'role_id',
                'table'     => 'egotec_role'
            )
        );
        return new Role_Iterator($db);
    }

    protected function _getUser()
    {
        require_once('rights/User_SQL.php');
        return new User_SQL($this->_id);
    }

    public static function makeFlat($id) {
        $clear_cache = false; // Bei Änderungen der Rechte muss der Cache geleert werden

        // Die Tabelle mit der flachen Rechteprüfung mit den Berechtigungen des Benutzers füttern.
        $db = new_db_connection(array(
            'fields'    => 'egotec_group.group_id AS group_id, egotec_role.role_id AS role_id',
            'table' => 'egotec_user_group',
            'where' => 'egotec_user_group.user_id=:userid',
            'join'  => array(
                        'egotec_group direct_group ON direct_group.group_id=egotec_user_group.group_id', // Aus der direkt eingetragenen Gruppe alle
                        'egotec_group ON egotec_group.links>=direct_group.links AND egotec_group.rechts<=direct_group.rechts', // untergeordneten Gruppen bestimmen.
                        'egotec_role direct_role ON direct_role.role_id=egotec_user_group.role_id', // Aus der direkt eingetragenen Rolle alle
                        'egotec_role ON egotec_role.links>=direct_role.links AND egotec_role.rechts<=direct_role.rechts' // untergeordneten Rollen bestimmen.
                    ),
            'bind'  => array(
                'userid'    => $id
            )
        ));

        $db2 = new_db_connection(array(
            'fields'    => 'group_id, role_id',
            'table' => 'egotec_user_group_flat',
            'where' => 'user_id=:userid',
            'bind'  => array(
                'userid'    => $id
            )
        ));
        $old_rights = array();
        while ($db2->nextRecord()) {
            $old_rights[$db2->Record['group_id']."####".$db2->Record['role_id']] = 1;
        }

        $db2->begin();

        while ($db->nextRecord()) {
            if (empty($old_rights[$db->Record['group_id']."####".$db->Record['role_id']])) { // Wenn die Berechtigung nicht existiert => insert
                $db->Record['user_id'] = $id;
                if ($db->Record['group_id'] != '*' && $db->Record['role_id'] != '*') {
                    $db2->insert(array(
                        'table' => 'egotec_user_group_flat',
                        'set'   => $db->Record,
                        'nobackup'  => 1
                    ));
                    $clear_cache = true;
                }
            }
            // group / role merken
            $old_rights[$db->Record['group_id']."####".$db->Record['role_id']] = 2; // keine doppelten inserts (duplicate entry Fehler)
        }

        foreach ($old_rights as $key => $val) {
            if ($val == 1 && $key != "*####*") {
                $rights = explode("####", $key);
                $db2->delete(array(
                    'table' => 'egotec_user_group_flat',
                    'where' => 'user_id=\''.$id.'\' AND group_id=\''.$rights[0].'\' AND role_id=\''.$rights[1].'\'',
                    'nobackup'  => 1
                ));
                $clear_cache = true;
            }
        }

        // gibt es * / * noch nicht => insert
        if (!isset($old_rights["*####*"])) {
            $db2->insert(array(
                'table' => 'egotec_user_group_flat',
                'set'   => array(
                    'group_id'  => '*',
                    'role_id'   => '*',
                    'user_id'   => $id
                ),
                'nobackup'  => 1
            ));
        }

        $db2->commit();

        if ($clear_cache) {
            Ego_System::clearCacheAllSites();
        }
    }

    public static function makeFlatSuperusers() {
        require_once 'rights/Group_SQL.php';
        $root = new Group_SQL($GLOBALS['egotec_conf']['superuser']['group']);
        foreach ($root->getAllUsers() as $user) {
            if ($user->hasGroupRoleRelation(
                $GLOBALS['egotec_conf']['superuser']['group'],
                $GLOBALS['egotec_conf']['superuser']['role']
            )) {
                self::makeFlat($user->field['user_id']);
            }
        }
        Ego_System::clearCacheAllSites();
    }
}
?>