Inheritance diagram for CO_Security_Login:

Collaboration diagram for CO_Security_Login:

Public Member Functions
	__construct ( $in_db_object=NULL, $in_db_result=NULL, $in_login_id=NULL, $in_ids=NULL, $in_personal_ids=NULL)

	load_from_db ($in_db_result)

	set_ids ( $in_ids_array)

	add_id ( $in_id)

	remove_id ( $in_id)

	ids ()

	user_can_edit_ids ()

	set_personal_ids ( $in_personal_ids=[])

	personal_ids ()

	get_crypted_password ( $in_password_to_crypt=NULL)

	is_login_valid ( $in_login_id, $in_hashed_password=NULL, $in_raw_password=NULL, $in_dont_create_new_api_key=false)

	i_am_a_god ()

	is_god ()

	is_manager ()

	get_lang ()

	set_lang ( $in_lang_id=NULL)

	get_user_object ()

	set_password_from_cleartext ( $in_cleartext_password)

	is_api_key_valid ( $in_api_key)

	get_remaining_time ()

	get_api_key ()

	get_api_key_age_in_seconds ()

	clear_api_key ()

	add_personal_token_from_current_login ( $in_id)

	remove_personal_token_from_this_login ( $in_id)

	get_logins_that_have_any_of_my_ids ()

	user_can_write ()

	delete_from_db ()

Public Member Functions inherited from CO_Security_Node
	__construct ( $in_db_object=NULL, $in_db_result=NULL)

Public Member Functions inherited from A_CO_DB_Table_Base
	set_batch_mode ()

	clear_batch_mode ()

	id ()

	lock ()

	locked ()

	danger_will_robinson_danger_clear_id ()

	user_can_read ()

	set_read_security_id ($in_new_id)

	set_write_security_id ($in_new_id)

	set_name ($in_new_value)

	update_db ()

	reload_from_db ()

	get_access_object ()

Public Attributes
	$login_id

Public Attributes inherited from A_CO_DB_Table_Base
	$class_description
	This is a description of the class (not the instance). More...

	$instance_description
	This is a description that describes the instance. More...

	$last_access
	This is a UNIX epoch date that describes the last modification. The default is UNIX Day Two (in case of UTC timezone issues). More...

	$name
	This is the "object_name" string field. More...

	$read_security_id
	This is a single integer, defining the security ID required to view the record. If it is 0, then it is "open.". More...

	$write_security_id
	This is a single integer, defining the required security token to modify the record. If it is 0, then any logged-in user can modify. More...

	$context
	This is a mixed associative array, containing fields for the object. More...

	$error
	If there is an error, it is contained here, in a LGV_Error instance. More...

Protected Member Functions
	_set_up_api_key ( $key_length)

	_default_setup ()

	_build_parameter_array ()

Protected Member Functions inherited from A_CO_DB_Table_Base
	_badger_serialize ( $in_data)

	_badger_unserialize ( $in_data)

	_write_to_db ()

	_seppuku ()

Static Protected Member Functions
static	_random_str ($length, $keyspace='0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ')

Protected Attributes
	$_api_key
	This is an API key for REST. More...

	$_personal_ids
	These are personal IDs (special IDs, unique to the login). More...

	$_ids
	These are security tokens, available to this ID. More...

Protected Attributes inherited from CO_Security_Node
	$_ids

Protected Attributes inherited from A_CO_DB_Table_Base
	$_db_object
	This is the actual database object that "owns" this instance. It should not be exposed beyond this class or subclasses, thereof. More...

	$_id
	This is the within-table unique ID of this record. More...

	$_batch_mode
	If this is true, then the write_record call will not be made in update_db. It will be done when clear_batch_mode() is called, instead. More...

Private Attributes
	$_override_access_class
	This is a special "one-shot" semaphore telling the save to override the access class. More...

Detailed Description

This is the specializing class for the login ID record type.

Definition at line 38 of file co_security_login.class.php.

Constructor & Destructor Documentation

◆ __construct()

CO_Security_Login::__construct	(	$in_db_object = `NULL`,
		$in_db_result = `NULL`,
		$in_login_id = `NULL`,
		$in_ids = `NULL`,
		$in_personal_ids = `NULL`
	)

Constructor

Parameters

$in_db_object	This is the database instance that "owns" this record.
$in_db_result	This is a database-format associative array that is used to initialize this instance.
$in_login_id	The login ID
$in_ids	An array of integers, representing the permissions this ID has.
$in_personal_ids	This is a preset array of integers, containing personal security IDs for the row.

Definition at line 164 of file co_security_login.class.php.

                                   {
         $this->login_id = $in_login_id;
         $this->_override_access_class = false;
         parent::__construct($in_db_object, $in_db_result, $in_ids);
         $this->class_description = 'This is a security class for individual logins.';
         
         // If explicit IDs are passed in, then that overrides the DB.
         if (isset($in_ids) && is_array($in_ids) && count($in_ids)) {
             $in_db_result['ids'] = implode(',', $in_ids);
         }
         
         if (CO_Config::use_personal_tokens() && isset($in_personal_ids) && is_array($in_personal_ids) && count($in_personal_ids)) {
             $in_db_result['personal_ids'] = implode(',', $in_ids);
         }
         
         if (!isset($this->context)) {
             $this->context = Array();
         }
         
         if (!isset($this->context['lang'])) {
             $this->context['lang'] = CO_Config::$lang;
         }
             
         if (isset($in_db_result['api_key'])) {
             $this->_api_key = $in_db_result['api_key'];
         }
         
         if (intval($this->id()) == intval(CO_Config::god_mode_id())) {
             // God Mode is always forced to use the config password.
             $this->instance_description = 'GOD MODE: '.(isset($this->name) && $this->name ? "$this->name (".$this->login_id.")" : "Unnamed Login Node (".$this->login_id.")");
         } else {
             $this->instance_description = isset($this->name) && $this->name ? "$this->name (".$this->login_id.")" : "Unnamed Login Node (".$this->login_id.")";
         }
         
         $access_object = $this->get_access_object();
         
         // By now, we have enough read, so we know if cogito ergo sum, so we can see if we can look at the IDs.
         if (isset($access_object) && ($access_object->god_mode() || ($access_object->get_login_id() == $this->_id))) {
             $this->_ids = Array($this->id());
             
             if (isset($in_db_result['ids']) && $in_db_result['ids']) {
                 $temp = $in_db_result['ids'];
                 if (isset ($temp) && $temp) {
                     $tempAr = explode(',', $temp);
                     if (is_array($tempAr) && count($tempAr)) {
                         $tempAr = array_unique(array_map('intval', $tempAr));
                         $tempAr = array_merge($this->_ids, $tempAr);
                         sort($tempAr);
                         // Our original login just gets all the IDs. However, subsequent access requires that only "known" IDs are read.
                         if (isset($tempAr) && is_array($tempAr) && count($tempAr)) {
                             $access_ids = $access_object->get_security_ids();
                             if ($access_object->god_mode() || (isset($access_ids) && is_array($access_ids) && count($access_ids))) {
                                 foreach($tempAr as $id) {
                                     if (($access_object->god_mode() || (in_array($id, $access_ids))) && !in_array($id, $this->_ids)) {
                                         $this->_ids[] = $id;
                                     }
                                 }
                             } else {
                                 $this->_ids = $tempAr;
                             }
                         }
                     }
                 }
             }
  
             $this->_personal_ids = NULL;
             
             if (CO_Config::use_personal_tokens() && isset($in_db_result['personal_ids']) && $in_db_result['personal_ids']) {
                 $temp = $in_db_result['personal_ids'];
                 if (isset ($temp) && $temp) {
                     $tempAr = explode(',', $temp);
                     if (is_array($tempAr) && count($tempAr)) {
                         $tempAr = array_unique(array_map('intval', $tempAr));
                         sort($tempAr);
                         if (isset($tempAr) && is_array($tempAr) && count($tempAr)) {
                             $this->_personal_ids = $tempAr;
                         }
                     }
                 }
             }
         }
     }

References $lang, and A_CO_DB_Table_Base\get_access_object().

Here is the call graph for this function:

Member Function Documentation

◆ _build_parameter_array()

CO_Security_Login::_build_parameter_array ( )

protected

This builds up the basic section of the instance database record. It should be overloaded, and the parent called before adding new fields.

This method overloads (and calls) the base class method.

Returns: an associative array, in database record form.

Reimplemented from CO_Security_Node.

Definition at line 110 of file co_security_login.class.php.

                                                 {
         $ret = parent::_build_parameter_array();
         
         if (NULL == $this->_personal_ids) {
             $this->_personal_ids = [];
         }
         
         $ret['api_key'] = $this->_api_key;
         $ret['login_id'] = $this->login_id;
         $personal_ids_as_string_array = Array();
         if (CO_Config::use_personal_tokens()) {
             $personal_ids_as_int = array_map('intval', $this->_personal_ids);
             sort($personal_ids_as_int);
         
             foreach ($this->_personal_ids as $id) {
                 array_push($personal_ids_as_string_array, strval($id));
             }
  
             $personal_id_list_string = trim(implode(',', $personal_ids_as_string_array));
             $ret['personal_ids'] = $personal_id_list_string ? $personal_id_list_string : NULL;
         }
         
         $ids_as_int = array_map('intval', $this->_ids);
         sort($ids_as_int);
         
         $ids_as_string_array = Array();
         foreach ($this->_ids as $id) {
             if ($id != $this->id() && (isset($personal_ids_as_int) && !in_array($id, $personal_ids_as_int))) {
                 array_push($ids_as_string_array, strval($id));
             } elseif ($id != $this->id()) {
                 array_push($ids_as_string_array, strval($id));
             }
         }
         
         $id_list_string = trim(implode(',', $ids_as_string_array));
         
         $ret['ids'] = $id_list_string ? $id_list_string : NULL;
  
         if ($this->_override_access_class) {
             $ret['access_class'] = 'CO_Security_ID';
             $ret['object_name'] = NULL;
             $ret['ids'] = NULL;
             $this->context = NULL;
             $this->_override_access_class = false;
         }
         
         return $ret;
     }

References $_api_key, and $login_id.

◆ _default_setup()

CO_Security_Login::_default_setup ( )

protected

This is called to populate the object fields for this class with default values. These use the SQL table tags.

This should be subclassed, and the parent should be called before applying specific instance properties.

This method overloads (and calls) the base class method.

Returns: An associative array, simulating a database read.

Reimplemented from CO_Security_Node.

Definition at line 91 of file co_security_login.class.php.

                                         {
         $default_setup = parent::_default_setup();
         $default_setup['login_id'] = $this->login_id;
         $default_setup['object_name'] = $this->login_id;
         $default_setup['api_key'] = $this->_api_key;
         $default_setup['personal_ids'] = (CO_Config::use_personal_tokens() && (NULL != $this->_personal_ids)) ? $this->_personal_ids : '';
         $default_setup['ids'] = (NULL != $this->_ids) ? $this->_ids : '';
         
         return $default_setup;
     }

References $_api_key, $_ids, $_personal_ids, and $login_id.

◆ _random_str()

static CO_Security_Login::_random_str	(	$length,
		$keyspace = `'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'`
	)

staticprotected

Generates a cryptographically secure string.

Returns: a randome string.

Definition at line 52 of file co_security_login.class.php.

     {
         $pieces = [];
         $max = mb_strlen($keyspace, '8bit') - 1;
         for ($i = 0; $i < $length; ++$i) {
             $pieces []= $keyspace[random_int(0, $max)];
         }
         return implode('', $pieces);
     }

Referenced by _set_up_api_key().

Here is the caller graph for this function:

◆ _set_up_api_key()

CO_Security_Login::_set_up_api_key ( $key_length )

protected

This sets up a new API key after the login has been successfully verified.

Parameters

$key_length The length (in bytes) of the key.

Definition at line 66 of file co_security_login.class.php.

                                           {
         $temp_api_key = self::_random_str($key_length);
  
         $temp_api_key .= ' - '.strval(microtime(true)); // Add the current generation microtime, for key timeout.
         
         // If we are taking the IP address into consideration, then we store that, as well.
         if (isset(CO_Config::$api_key_includes_ip_address) && CO_Config::$api_key_includes_ip_address) {
             $temp_api_key .= ' - '.strtolower(strval($_SERVER['REMOTE_ADDR']));
         }
         
         $this->_api_key = strval($temp_api_key);
     }

References _random_str().

Referenced by is_login_valid().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ add_id()

CO_Security_Login::add_id ( $in_id )

This is a setter, allowing you to add an ID.

Returns: true, if successful.

Parameters

$in_id A single integer. The new ID to add.

Definition at line 396 of file co_security_login.class.php.

                               {
         $ret = false;
         $in_id = intval($in_id);
         if ($this->user_can_edit_ids() || ($this->_added_new_id == $in_id)) {
             $id_pool = $this->get_access_object()->get_security_ids(true);
             
             if ($this->get_access_object()->god_mode() || (isset($id_pool) && is_array($id_pool) && count($id_pool))) {
                 // We can add an ID to the user, as long as it is one we own. We don't have to have full access to all user IDs.
                 if (($this->get_access_object()->god_mode() || (in_array($in_id, $id_pool)) || ($this->_added_new_id == $in_id)) && ($in_id != $this->id())) {
                     if (!isset($this->_ids) || !is_array($this->_ids) || !count($this->_ids)) {
                         $this->_ids = Array(intval($in_id));
                     } else {
                         $this->_ids[] = $in_id;
                         $this->_ids = array_unique($this->_ids);
                     }
                     sort($this->_ids);
                     $ret = $this->update_db();
                 } else {
                     if ($in_id != $this->id()) {
                         $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                                         CO_Lang::$db_error_name_user_not_authorized,
                                                         CO_Lang::$db_error_desc_user_not_authorized,
                                                         __LINE__,
                                                         __FILE__,
                                                         __METHOD__
                                                     );
                     } else {    // If we tried to add our own ID, then we don't add it, but it's not an error.
                         $ret = true;
                     }
                 }
             }
         } else {
             $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                             CO_Lang::$db_error_name_user_not_authorized,
                                             CO_Lang::$db_error_desc_user_not_authorized,
                                             __LINE__,
                                             __FILE__,
                                             __METHOD__
                                         );
         }
         
         return $ret;
     }

References CO_Lang_Common\$db_error_code_user_not_authorized, CO_Lang\$db_error_desc_user_not_authorized, CO_Lang\$db_error_name_user_not_authorized, A_CO_DB_Table_Base\get_access_object(), A_CO_DB_Table_Base\update_db(), and user_can_edit_ids().

Here is the call graph for this function:

◆ add_personal_token_from_current_login()

CO_Security_Login::add_personal_token_from_current_login ( $in_id )

This adds a personal token from the current logged-in ID's pool, to the regular ID pool of another ID.

Returns: true, if the operation was successful.

Parameters

$in_id The ID (personal token) to be added.

Definition at line 870 of file co_security_login.class.php.

                                                               {
         $ret = $this->get_access_object()->add_personal_token_from_current_login($this->_id, $in_id);
  
         if ($this->get_access_object()->error) {
             $this->error = $this->get_access_object()->error;
         } else {
             $this->reload_from_db();
             return $ret;
         }
  
         return false;
     }

References A_CO_DB_Table_Base\get_access_object(), and A_CO_DB_Table_Base\reload_from_db().

Here is the call graph for this function:

◆ clear_api_key()

CO_Security_Login::clear_api_key ( )

Removes the API Key.

Returns: true, if the operation was successful (even if there was no previous key).

Definition at line 858 of file co_security_login.class.php.

                                     {
         $this->_api_key = NULL;
         
         return $this->update_db();
     }

References A_CO_DB_Table_Base\update_db().

Here is the call graph for this function:

◆ delete_from_db()

CO_Security_Login::delete_from_db ( )

We override this, because logins never die. They just become security placeholders.

Returns: true, if the conversion was successful.

Reimplemented from A_CO_DB_Table_Base.

Definition at line 949 of file co_security_login.class.php.

                                      {
         if ($this->id() != CO_Config::god_mode_id()) {
             if ($this->user_can_write()) {
                 $user_object = $this->get_user_object();
             
                 if (isset($user_object) && ($user_object instanceof CO_User_Collection)) {
                     $user_object->set_login(NULL);
                 }
             
                 $this->read_security_id = 0;
                 $this->write_security_id = -1;
                 $this->api_key = NULL;
                 $this->context = NULL;
                 $this->name = NULL;
                 $this->login_id = NULL;
                 $this->_ids = Array();
                 $this->_override_access_class = true;
                 $ret = $this->_write_to_db();
                 return $ret;
             } else {
                 return false;
             }
         } else {
             $this->error = new LGV_Error(   CO_Lang_Common::$login_error_code_attempt_to_delete_god,
                                             CO_Lang::$login_error_name_attempt_to_delete_god,
                                             CO_Lang::$login_error_desc_attempt_to_delete_god
                                         );
         }
     }

References CO_Lang_Common\$login_error_code_attempt_to_delete_god, CO_Lang\$login_error_desc_attempt_to_delete_god, CO_Lang\$login_error_name_attempt_to_delete_god, A_CO_DB_Table_Base\_write_to_db(), get_user_object(), and user_can_write().

Here is the call graph for this function:

◆ get_api_key()

CO_Security_Login::get_api_key ( )

Returns: a string, with the API key, if the key is still valid. NULL, otherwise.

Definition at line 793 of file co_security_login.class.php.

                                   {
         $ret = NULL;
     
         if (isset($this->_api_key) && $this->_api_key) {
             $api_expl = explode(' - ', trim($this->_api_key));
             $my_ip = NULL;
  
             // God Mode gets a different timeout.
             $timeout = floatval($this->i_am_a_god() ? CO_Config::$god_session_timeout_in_seconds : CO_Config::$session_timeout_in_seconds);
             
             // We first check to make sure that we are still within the time window. If not, then all bets are off.
             // <0 as a $timeout value means no timeout.
             if (isset($api_expl[1]) && ((0 > $timeout) || ((microtime(true) - floatval($api_expl[1])) <= $timeout))) {
                 if (isset(CO_Config::$api_key_includes_ip_address) && CO_Config::$api_key_includes_ip_address) {    // See if we are also checking the IP address.
                     $my_ip = strtolower(strval($_SERVER['REMOTE_ADDR']));
                     if (isset($api_expl[2])) {
                         if ($api_expl[2] == $my_ip) {
                             $ret = $api_expl[0];
                         } else {
                             $this->error = new LGV_Error(   CO_Lang_Common::$login_error_code_api_key_invalid,
                                                             CO_Lang::$login_error_name_api_key_invalid,
                                                             CO_Lang::$login_error_desc_api_key_invalid
                                                         );
                         }
                     } else {
                         $this->error = new LGV_Error(   CO_Lang_Common::$login_error_code_api_key_invalid,
                                                         CO_Lang::$login_error_name_api_key_invalid,
                                                         CO_Lang::$login_error_desc_api_key_invalid
                                                     );
                     }
                 } else {
                     $ret = $api_expl[0];
                 }
             } elseif ($api_expl[0]) {
                 $this->error = new LGV_Error(   CO_Lang_Common::$login_error_code_api_key_invalid,
                                                 CO_Lang::$login_error_name_api_key_invalid,
                                                 CO_Lang::$login_error_desc_api_key_invalid
                                             );
             }
         }
         
         return $ret;
     }

References CO_Lang_Common\$login_error_code_api_key_invalid, CO_Lang\$login_error_desc_api_key_invalid, CO_Lang\$login_error_name_api_key_invalid, and i_am_a_god().

Referenced by get_remaining_time(), is_api_key_valid(), and is_login_valid().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ get_api_key_age_in_seconds()

CO_Security_Login::get_api_key_age_in_seconds ( )

Returns: an integer, with the number of seconds since the API key was created. -1 if there is no API key. This will return a value, even if the API key is present, but expired.

Definition at line 841 of file co_security_login.class.php.

                                           {
         $ret = -1;
         
         if (isset($this->_api_key) && $this->_api_key) {
             list($api_key, $api_time) = explode(' - ', trim($this->_api_key));
             $ret = ceil(microtime(true) - floatval($api_time));
         }
         
         return $ret;
     }

◆ get_crypted_password()

CO_Security_Login::get_crypted_password ( $in_password_to_crypt = NULL )

Returns: the crypted password, as a string.

Parameters

$in_password_to_crypt If this is not-NULL, then, instead of returning the instance's crypted PW, the given password is crypted and returned.

Definition at line 601 of file co_security_login.class.php.

                                           {
         
         $ret = $this->context['hashed_password'];
         
         if ($in_password_to_crypt) {
             if (strlen($in_password_to_crypt) >= CO_Config::$min_pw_len) {
                 $ret = password_hash($in_password_to_crypt, PASSWORD_DEFAULT);
             } else {
                 $ret = false;
             }
         }
         
         return $ret;
     }

Referenced by is_login_valid(), and set_password_from_cleartext().

Here is the caller graph for this function:

◆ get_lang()

CO_Security_Login::get_lang ( )

Returns: a string, with the language ID for this login.

Reimplemented from A_CO_DB_Table_Base.

Definition at line 691 of file co_security_login.class.php.

                                {
         return $this->context['lang'];
     }

◆ get_logins_that_have_any_of_my_ids()

CO_Security_Login::get_logins_that_have_any_of_my_ids ( )

This returns IDs that have our personal IDs.

Returns: an associative array of arrays of integer, keyed by integer. The key is the ID of the login, and the value is an array of integer, with the IDs that match. NULL, if an error.

Definition at line 910 of file co_security_login.class.php.

                                                          {
         return $this->get_access_object()->get_logins_that_have_any_of_my_ids();
     }

References A_CO_DB_Table_Base\get_access_object().

Here is the call graph for this function:

◆ get_remaining_time()

CO_Security_Login::get_remaining_time ( )

Returns: a floating-point number, with the remaining login time, in seconds. -1 means no timeout. 0 means time's up.

Definition at line 769 of file co_security_login.class.php.

                                          {
         $ret = 0;
         
         // Unless we are legally logged in, we will always get 0.
         if ( $this->get_api_key() ) {
             $timeout = floatval($this->i_am_a_god() ? CO_Config::$god_session_timeout_in_seconds : CO_Config::$session_timeout_in_seconds);
         
             if ( 0 < $timeout ) {
                 if (isset($this->_api_key) && $this->_api_key) {
                     list($api_key, $api_time) = explode(' - ', trim($this->_api_key));
                     $ret = $timeout - ceil((microtime(true) - floatval($api_time)) * 10000) / 10000;
                 }
             } else {
                 $ret = -1;
             }
         }
         
         return $ret;
     }

References get_api_key(), and i_am_a_god().

Here is the call graph for this function:

◆ get_user_object()

CO_Security_Login::get_user_object ( )

Returns: The associated User object, if it exists. NULL, otherwise.

Definition at line 715 of file co_security_login.class.php.

                                       {
         $ret = NULL;
         $access_instance = $this->get_access_object();
         
         // If we have a user, we also clear the user from knowing about us.
         if ($access_instance && method_exists($access_instance, 'get_user_from_login')) {
             $ret = $access_instance->get_user_from_login($this->id());
         }
         
         return $ret;
     }

References A_CO_DB_Table_Base\get_access_object().

Referenced by delete_from_db().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ i_am_a_god()

CO_Security_Login::i_am_a_god ( )

Returns: true, if this object represents the database "God" object.

Definition at line 667 of file co_security_login.class.php.

                                  {
         return intval(CO_Config::god_mode_id()) == intval($this->id());
     }

Referenced by get_api_key(), get_remaining_time(), and user_can_write().

Here is the caller graph for this function:

◆ ids()

CO_Security_Login::ids ( )

This does a security vetting. If logged in as God, then all IDs are returned. Otherwise, only IDs that our login can see are returned, whether or not they are in the object.

Returns: The current IDs.

Definition at line 499 of file co_security_login.class.php.

                           {
         if ($this->get_access_object()->god_mode()) {
             return $this->_ids;
         } else {
             $my_ids = $this->get_access_object()->get_security_ids();
             $ret = Array();
             foreach ($this->_ids as $id) {
                 if (in_array($id, $my_ids)) {
                     array_push($ret, $id);
                 }
             }
             return $ret;
         }
     }

References $_ids, and A_CO_DB_Table_Base\get_access_object().

Here is the call graph for this function:

◆ is_api_key_valid()

CO_Security_Login::is_api_key_valid ( $in_api_key )

This tests a given API key against the stored value. It also checks time elapsed, to ensure that we are still within the login window.

Returns: true, if the API key is valid, and we are still within the allotted timespan for the key.

Parameters

$in_api_key The API key that we're testing.

Definition at line 751 of file co_security_login.class.php.

                                       {
         $ret = ($this->get_api_key() == $in_api_key);
         
         if ($ret && !$this->error) {
             $this->error = new LGV_Error(   CO_Lang_Common::$login_error_code_api_key_mismatch,
                                             CO_Lang::$login_error_name_api_key_mismatch,
                                             CO_Lang::$login_error_desc_api_key_mismatch
                                         );
         }
         
         return $ret;
     }

References CO_Lang_Common\$login_error_code_api_key_mismatch, CO_Lang\$login_error_desc_api_key_mismatch, CO_Lang\$login_error_name_api_key_mismatch, and get_api_key().

Here is the call graph for this function:

◆ is_god()

CO_Security_Login::is_god ( )

Returns: true, if we are the "God" login.

Definition at line 675 of file co_security_login.class.php.

                              {
         return $this->id() == CO_Config::god_mode_id();
     }

References A_CO_DB_Table_Base\id().

Referenced by CO_Cobra\_convert_login(), CO_Cobra\_create_new_login(), and is_manager().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ is_login_valid()

CO_Security_Login::is_login_valid	(	$in_login_id,
		$in_hashed_password = `NULL`,
		$in_raw_password = `NULL`,
		$in_dont_create_new_api_key = `false`
	)

Returns: true, if the presented credentials are good.

Parameters

$in_login_id	The login ID
$in_hashed_password	The password, crypt-hashed
$in_raw_password	The password, cleartext.
$in_dont_create_new_api_key	If true, then we don't create a new API key.

Definition at line 621 of file co_security_login.class.php.

                                       {
         $ret = false;
         if (isset($this->login_id) && $this->login_id && ($this->login_id == $in_login_id)) {
             $api_key = $this->get_api_key();
             if ($this->id() == CO_Config::god_mode_id()) {
                 if (("" != $in_hashed_password) && ($in_hashed_password == $api_key)) { // We have a special provision that allows the God hashed password to use the API key.
                     $ret = true;
                 } else {    // God mode uses the cleartext password in the config file.
                     if ($in_raw_password && !$in_dont_create_new_api_key && isset(CO_Config::$block_logins_for_valid_api_key) && CO_Config::$block_logins_for_valid_api_key && $api_key) {
                         return false;
                     } else {
                         $ret = ($in_raw_password == CO_Config::god_mode_password());
                     }
                 }
             } else {
                 // The server can be set up to prevent users from logging in while another login is still active.
                 if ($in_raw_password && !$in_dont_create_new_api_key && isset(CO_Config::$block_logins_for_valid_api_key) && CO_Config::$block_logins_for_valid_api_key && $api_key) {
                     return false;
                 } elseif (isset($this->context['hashed_password']) && $this->context['hashed_password']) {
                     // First, see if this is in the hashed password.
                     if ($in_hashed_password) {
                         $ret = hash_equals($this->get_crypted_password(), $in_hashed_password);
                     } else { // If not, see if it's the raw password.
                         $ret = password_verify($in_raw_password, $this->get_crypted_password());
                     }
                 }
             }
         }
         
         // Generate an API key. We can't save it yet, as we're probably not actually logged in.
         if ($ret && !$in_dont_create_new_api_key) {
             // God mode gets a longer key. It's not actually more secure, but we can use that to determine different treatment, later on.
             $this->_set_up_api_key($this->id() == CO_Config::god_mode_id() ? 40 : 32);
         }
         
         return $ret;
     }

References _set_up_api_key(), get_api_key(), and get_crypted_password().

Here is the call graph for this function:

◆ is_manager()

CO_Security_Login::is_manager ( )

Returns: false, as we are not a manager.

Reimplemented in CO_Login_Manager.

Definition at line 683 of file co_security_login.class.php.

                                  {
         return $this->is_god();
     }

References is_god().

Here is the call graph for this function:

◆ load_from_db()

CO_Security_Login::load_from_db ( $in_db_result )

This function sets up this instance, according to the DB-formatted associative array passed in.

Returns: true, if the instance was able to set itself up to the provided array.

Reimplemented from A_CO_DB_Table_Base.

Reimplemented in CO_Login_Manager, and CO_Cobra_Login.

Definition at line 258 of file co_security_login.class.php.

                                                 {
         $ret = parent::load_from_db($in_db_result);
         $this->_personal_ids = NULL;
         $this->_ids = Array($this->id());
                 
         if ($ret) {
             if (!isset($this->context)) {
                 $this->context = Array();
             }
         
             if (!isset($this->context['lang'])) {
                 $this->context['lang'] = CO_Config::$lang;
             }
  
             $this->class_description = 'This is a security class for individual logins.';
             
             if (isset($in_db_result['login_id'])) {
                 $this->login_id = $in_db_result['login_id'];
                 $this->instance_description = isset($this->name) && $this->name ? "$this->name (".$this->login_id.")" : "Unnamed Login Node (".$this->login_id.")";
             }
             
             if (isset($in_db_result['api_key'])) {
                 $this->_api_key = $in_db_result['api_key'];
             }
         
             if (isset($in_db_result['ids']) && $in_db_result['ids']) {
                 if ($this->_db_object) {
                     if (isset($in_db_result['ids']) && $in_db_result['ids']) {
                         $temp = $in_db_result['ids'];
                         if (isset ($temp) && $temp) {
                             $tempAr = explode(',', $temp);
                             if (is_array($tempAr) && count($tempAr)) {
                                 $tempAr = array_map('intval', $tempAr);
                                 sort($tempAr);
                                 $tempAr = array_unique(array_merge($this->_ids, $tempAr));
                                 if (isset($tempAr) && is_array($tempAr) && count($tempAr)) {
                                     $this->_ids = $tempAr;
                                 }
                             }
                         }
                     }
                 }
             }
                   
             if (CO_Config::use_personal_tokens() && isset($in_db_result['personal_ids']) || isset($in_db_result['personal_ids'])) {
                 $temp = $in_db_result['personal_ids'];
                 if (isset ($temp) && $temp) {
                     $tempAr = explode(',', $temp);
                     if (is_array($tempAr) && count($tempAr)) {
                         $tempAr = array_unique(array_map('intval', $tempAr));
                         sort($tempAr);
                         if (isset($tempAr) && is_array($tempAr) && count($tempAr)) {
                             $this->_personal_ids = $tempAr;
                         }
                     }
                 }
             }
         }
         
         return $ret;
     }

References $lang.

◆ personal_ids()

CO_Security_Login::personal_ids ( )

This does a security vetting. If logged in as God, then all IDs are returned. Otherwise, only IDs that our login can see are returned, whether or not they are in the object.

Returns: The current personal IDs.

Definition at line 576 of file co_security_login.class.php.

                                    {
         if (!CO_Config::use_personal_tokens()) {
             return [];
         }
         
         if ($this->get_access_object()->god_mode()) {
             return $this->_personal_ids;
         } else {
             $my_ids = $this->get_access_object()->get_security_ids();
             $ret = [];
             if (isset($this->_personal_ids) && is_array($this->_personal_ids) && count($this->_personal_ids)) {
                 foreach ($this->_personal_ids as $id) {
                     if (in_array($id, $my_ids)) {
                         array_push($ret, $id);
                     }
                 }
             }
             return $ret;
         }
     }

References $_personal_ids, and A_CO_DB_Table_Base\get_access_object().

Here is the call graph for this function:

◆ remove_id()

CO_Security_Login::remove_id ( $in_id )

This allows you to remove a single ID. We can remove one of our IDs from a user that may have other IDs.

Returns: true, if successful.

Parameters

$in_id A single integer. The ID to remove.

Definition at line 448 of file co_security_login.class.php.

                               {
         $ret = false;
         
         if ($this->user_can_edit_ids()) {
             $id_pool = $this->get_access_object()->get_security_ids();
             
             if ($this->get_access_object()->god_mode() || (isset($id_pool) && is_array($id_pool) && count($id_pool) && in_array($in_id, $id_pool))) {
                 if (isset($this->_ids) && is_array($this->_ids) && count($this->_ids) && $this->user_can_edit_ids()) {
                     $new_array = Array();
             
                     foreach($this->_ids as $id) {
                         if ($id != $in_id) {
                             array_push($new_array, $id);
                         } else {
                             $ret = true;
                         }
                 
                         if ($ret) {
                             $ret = $this->set_ids($new_array);
                         }
                     }
                 }
             } else {
                 $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                                 CO_Lang::$db_error_name_user_not_authorized,
                                                 CO_Lang::$db_error_desc_user_not_authorized,
                                                 __LINE__,
                                                 __FILE__,
                                                 __METHOD__
                                             );
             }
         } else {
             $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                             CO_Lang::$db_error_name_user_not_authorized,
                                             CO_Lang::$db_error_desc_user_not_authorized,
                                             __LINE__,
                                             __FILE__,
                                             __METHOD__
                                         );
         }
         
         return $ret;
     }

References CO_Lang_Common\$db_error_code_user_not_authorized, CO_Lang\$db_error_desc_user_not_authorized, CO_Lang\$db_error_name_user_not_authorized, A_CO_DB_Table_Base\get_access_object(), set_ids(), and user_can_edit_ids().

Here is the call graph for this function:

◆ remove_personal_token_from_this_login()

CO_Security_Login::remove_personal_token_from_this_login ( $in_id )

This removes a personal token from the current logged-in ID's pool, from the regular ID pool of another ID.

Returns: true, if the operation was successful.

Parameters

$in_id The ID (personal token) to be added.

Definition at line 890 of file co_security_login.class.php.

                                                               {
         $ret = $this->get_access_object()->remove_personal_token_from_this_login($this->_id, $in_id);
  
         if ($this->get_access_object()->error) {
             $this->error = $this->get_access_object()->error;
         } else {
             $this->reload_from_db();
             return $ret;
         }
  
         return false;
     }

References A_CO_DB_Table_Base\get_access_object(), and A_CO_DB_Table_Base\reload_from_db().

Here is the call graph for this function:

◆ set_ids()

CO_Security_Login::set_ids ( $in_ids_array )

This is a setter for the ID array. It can delete the array by sending in NULL, or an empty array. No user can set IDs for which they do not have access. Since this is a "whole hog" operation, we need to be able to access every single ID in the current object before we can replace or delete them.

Returns: true, if successful.

Parameters

$in_ids_array This is a preset array of integers, containing security IDs for the row. NULL/Empty to delete all IDs.

Definition at line 328 of file co_security_login.class.php.

                               {
         $ret = false;
         $in_ids_array = array_map('intval', $in_ids_array);
         if ($this->user_can_edit_ids()) {
             $id_pool = $this->get_access_object()->get_security_ids(true);  // We get just our regular IDs. No personal ones.
             if ($this->get_access_object()->god_mode() || (isset($id_pool) && is_array($id_pool) && count($id_pool))) {
                 // First thing we do, is ensure that EVERY SINGLE ID in the current user are ones we have in our own set.
                 // An empty set is fine.
                 foreach($this->_ids as $id) {
                     if (!$this->get_access_object()->god_mode() && (isset($id) && (0 < $id) && !in_array($id, $id_pool))) {
                         // Even one failure scrags the operation.
                         $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                                         CO_Lang::$db_error_name_user_not_authorized,
                                                         CO_Lang::$db_error_desc_user_not_authorized,
                                                         __LINE__,
                                                         __FILE__,
                                                         __METHOD__
                                                     );
                         return false;
                     }
                 }
                 
                 // Next, if there is an existing array, we check our input, and add only the IDs we own.
                 if ($this->get_access_object()->god_mode() || (isset($in_ids_array) && is_array($in_ids_array) && count($in_ids_array))) {
                     $temp_ids = array_map('intval', $in_ids_array);
                     $new_ids = Array();
                     foreach($temp_ids as $in_id) {
                         if (($in_id != $this->id()) && ($this->get_access_object()->god_mode() || in_array($in_id, $id_pool))) {
                             $new_ids[] = $in_id;
                         }
                     }
                 
                     $this->_ids = $new_ids;
                 // Otherwise, we are clearing the array.
                 } else {
                     $this->_ids = Array();
                 }
         
                 $ret = $this->update_db();
             } else {
                 $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                                 CO_Lang::$db_error_name_user_not_authorized,
                                                 CO_Lang::$db_error_desc_user_not_authorized,
                                                 __LINE__,
                                                 __FILE__,
                                                 __METHOD__
                                             );
             }
         } else {
              $this->error = new LGV_Error(   CO_Lang_Common::$db_error_code_user_not_authorized,
                                             CO_Lang::$db_error_name_user_not_authorized,
                                             CO_Lang::$db_error_desc_user_not_authorized,
                                             __LINE__,
                                             __FILE__,
                                             __METHOD__
                                         );
         }
         
         return $ret;
     }

References CO_Lang_Common\$db_error_code_user_not_authorized, CO_Lang\$db_error_desc_user_not_authorized, CO_Lang\$db_error_name_user_not_authorized, A_CO_DB_Table_Base\get_access_object(), A_CO_DB_Table_Base\update_db(), and user_can_edit_ids().

Referenced by remove_id().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ set_lang()

CO_Security_Login::set_lang ( $in_lang_id = NULL )

Returns: true, if the set was successful.

Parameters

$in_lang_id The lang ID. This is not used for the low-level error handlers (which use the server setting). It is used to determine higher-level strings.

Reimplemented from A_CO_DB_Table_Base.

Definition at line 699 of file co_security_login.class.php.

                               {
         $ret = false;
         
         if ($this->user_can_write()) {
             $this->context['lang'] = strtolower(trim(strval($in_lang_id)));
             $ret = $this->update_db();
         }
         
         return $ret;
     }

References A_CO_DB_Table_Base\update_db(), and user_can_write().

Here is the call graph for this function:

◆ set_password_from_cleartext()

CO_Security_Login::set_password_from_cleartext ( $in_cleartext_password )

This encrypts a cleartext password, and sets it into the record.

Returns: true, if the set was successful.

Parameters

$in_cleartext_password The cleartext password. It will not be saved. Instead, the hashed password will be saved.

Definition at line 733 of file co_security_login.class.php.

                                                   {
         $ret = false;
         
         if ($this->user_can_write()) {
             $this->context['hashed_password'] = $this->get_crypted_password($in_cleartext_password);
             $ret = $this->update_db();
         }
         
         return $ret;
     }

References get_crypted_password(), A_CO_DB_Table_Base\update_db(), and user_can_write().

Here is the call graph for this function:

◆ set_personal_ids()

CO_Security_Login::set_personal_ids ( $in_personal_ids = [] )

This sets just the "personal" IDs for the given ID.

This should only be called by the "God" admin, and will fail, otherwise (returns empty array).

This is not an atomic operation. If any of the given IDs are also in the regular ID list, they will be removed from the personal IDs.

Returns: an array of integers, with the new personal security IDs (usually a copy of the input Array). It will be empty, if the procedure fails.

Parameters

$in_personal_ids An Array of Integers, with the new personal IDs. This replaces any previous ones. If empty, then the IDs are removed.

Reimplemented in CO_Cobra_Login.

Definition at line 538 of file co_security_login.class.php.

                                       {
         $personal_ids_temp = array_unique(array_map('intval', $in_personal_ids));
         $this->_personal_ids = [];
         $access_object = $this->get_access_object();
         
         if (CO_Config::use_personal_tokens() && isset($access_object) && $access_object->god_mode()) {
             if (0 < count($personal_ids_temp)) {
                 $personal_ids = [];
                 $my_ids = $this->_ids;
                 // None of the ids can be in the regular IDs, and will be removed from the set, if so.
                 // They also cannot be anyone else's personal ID, or anyone's login ID. Personal IDs can ONLY be regular (non-login) security objects.
                 foreach($personal_ids_temp as $id) {
                     // Make sure that we don't have this personal token in our regular ID array.
                     if (($key = array_search($id, $my_ids)) !== false) {
                         unset($my_ids[$key]);
                     }
                     if (!$this->get_access_object()->is_this_a_login_id($id) || in_array($id, $this->_personal_ids)) {
                         array_push($personal_ids, $id);
                     }
                 }
                 $this->_ids = $my_ids;
                 sort($personal_ids);
                 $this->_personal_ids = $personal_ids;
             }
         }
             
         $this->update_db();
         
         return $this->_personal_ids;
     }

References $_ids, $_personal_ids, A_CO_DB_Table_Base\get_access_object(), and A_CO_DB_Table_Base\update_db().

Here is the call graph for this function:

◆ user_can_edit_ids()

CO_Security_Login::user_can_edit_ids ( )

We check to see if we can edit the IDs for this record. We cannot edit our own IDs, and have to own all of the IDs in the object in order to be able to change them. Of course, God can do whatever God wants...

Returns: true, if the current logged-in user can edit IDs for this login.

Definition at line 522 of file co_security_login.class.php.

                                         {
         $ret = ($this->get_access_object()->get_login_id() != $this->_id) && ($this->get_access_object()->god_mode() || $this->_db_object->i_have_all_ids($this->_id));
         
         return $ret;
     }

References A_CO_DB_Table_Base\$_id, and A_CO_DB_Table_Base\get_access_object().

Referenced by add_id(), remove_id(), and set_ids().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_can_write()

CO_Security_Login::user_can_write ( )

We override this, because the God login can only be modified by itself. No one else.

Returns: true, if the current logged-in user has write permission on this record.

Reimplemented from A_CO_DB_Table_Base.

Definition at line 920 of file co_security_login.class.php.

                                      {
         $ret = false;
         
         // Only God can edit God.
         if ($this->i_am_a_god() && !$this->get_access_object()->god_mode()) {
             return false;
         } else {
             $ids = $this->get_access_object()->get_security_ids();
         
             $my_write_item = intval($this->write_security_id);
         
             if ((0 == $my_write_item) || $this->get_access_object()->god_mode()) {
                 $ret = true;
             } else {
                 if (isset($ids) && is_array($ids) && count($ids)) {
                     $ret = in_array($my_write_item, $ids);
                 }
             }
         
         return $ret;
         }
     }

References A_CO_DB_Table_Base\get_access_object(), and i_am_a_god().

Referenced by delete_from_db(), set_lang(), and set_password_from_cleartext().

Here is the call graph for this function:

Here is the caller graph for this function:

Member Data Documentation

◆ $_api_key

CO_Security_Login::$_api_key

protected

This is an API key for REST.

Definition at line 40 of file co_security_login.class.php.

Referenced by _build_parameter_array(), and _default_setup().

◆ $_ids

CO_Security_Login::$_ids

protected

These are security tokens, available to this ID.

Definition at line 42 of file co_security_login.class.php.

Referenced by _default_setup(), ids(), and set_personal_ids().

◆ $_override_access_class

CO_Security_Login::$_override_access_class

private

This is a special "one-shot" semaphore telling the save to override the access class.

Definition at line 39 of file co_security_login.class.php.

◆ $_personal_ids

CO_Security_Login::$_personal_ids

protected

These are personal IDs (special IDs, unique to the login).

Definition at line 41 of file co_security_login.class.php.

Referenced by _default_setup(), personal_ids(), and set_personal_ids().

◆ $login_id

CO_Security_Login::$login_id

Definition at line 44 of file co_security_login.class.php.

Referenced by _build_parameter_array(), and _default_setup().

Public Member Functions

Public Attributes

Protected Member Functions

Static Protected Member Functions

Protected Attributes

Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ _build_parameter_array()

◆ _default_setup()

◆ _random_str()

◆ _set_up_api_key()

◆ add_id()

◆ add_personal_token_from_current_login()

◆ clear_api_key()

◆ delete_from_db()

◆ get_api_key()

◆ get_api_key_age_in_seconds()

◆ get_crypted_password()

◆ get_lang()

◆ get_logins_that_have_any_of_my_ids()

◆ get_remaining_time()

◆ get_user_object()

◆ i_am_a_god()

◆ ids()

◆ is_api_key_valid()

◆ is_god()

◆ is_login_valid()

◆ is_manager()

◆ load_from_db()

◆ personal_ids()

◆ remove_id()

◆ remove_personal_token_from_this_login()

◆ set_ids()

◆ set_lang()

◆ set_password_from_cleartext()

◆ set_personal_ids()

◆ user_can_edit_ids()

◆ user_can_write()

Member Data Documentation

◆ $_api_key

◆ $_ids

◆ $_override_access_class

◆ $_personal_ids

◆ $login_id