<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 * sessions.php - everything related to security and user management

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

/**

 * Anything and everything related to security and user management. This includes AES encryption, which is illegal in some countries.

 * Documenting the API was not easy - I hope you folks enjoy it.

 * @package Enano

 * @subpackage Session manager

 * @category security, user management, logins, etc.

 */

class sessionManager {

	# Variables

	/**

	var $user_logged_in = false;

	/**

	var $sid;

	/**

	var $username;

	/**

	var $user_id = 1;

	/**

	var $real_name;

	/**

	var $email;

	/**

	var $user_extra;

	/**

	var $user_level;

	/**

	var $sid_super;

	/**

	var $theme;

	/**

	var $style;

	/**

	var $signature;

	/**

	var $reg_time;

	/**

	var $unread_pms = 0;

	/**

	protected $private_key;

	/**

	var $valid_username = '([^<>&\?\'"%\n\r\t\a\/]+)';

	/**

	var $user_title = null;

	/**

	var $auth_level = 1;

	/**

	var $date_format = DATE_4;

	/**

	var $time_format = TIME_24_NS;

	/**

	var $sw_timed_out = false;

	/**

	var $csrf_token = false;

	/**

	var $password_change_disabled = false;

	/**

	var $password_change_dest = array('url' => '', 'title' => '');

	/**

	var $started = false;

	/**

	var $compat = false;

	/**

	var $acl_types = Array();

	/**

	var $acl_descs = Array();

	/**

	var $acl_deps = Array();

	/**

	var $perms = Array();

	/**

	var $acl_base_cache = Array();

	/**

	var $acl_scope = Array();

	/**

	var $acl_defaults_used = Array();

	/**

	var $groups = Array();

	/**

	var $group_mod = Array();

	/**

	var $level_rank_table = array(

			USER_LEVEL_ADMIN  => RANK_ID_ADMIN,

			USER_LEVEL_MOD    => RANK_ID_MOD,

			USER_LEVEL_MEMBER => RANK_ID_MEMBER,

			USER_LEVEL_CHPREF => RANK_ID_MEMBER,

			USER_LEVEL_GUEST  => RANK_ID_GUEST

		);

	/**

	var $acl_inherit_lang_table = array(

			ACL_INHERIT_ENANO_DEFAULT   => 'acl_inherit_enano_default',

			ACL_INHERIT_GLOBAL_EVERYONE => 'acl_inherit_global_everyone',

			ACL_INHERIT_GLOBAL_GROUP    => 'acl_inherit_global_group',

			ACL_INHERIT_GLOBAL_USER     => 'acl_inherit_global_user',

			ACL_INHERIT_PG_EVERYONE     => 'acl_inherit_pg_everyone',

			ACL_INHERIT_PG_GROUP        => 'acl_inherit_pg_group',

			ACL_INHERIT_PG_USER         => 'acl_inherit_pg_user',

			ACL_INHERIT_LOCAL_EVERYONE  => 'acl_inherit_local_everyone',

			ACL_INHERIT_LOCAL_GROUP     => 'acl_inherit_local_group',

			ACL_INHERIT_LOCAL_USER      => 'acl_inherit_local_user'

		);

	# Basic functions

	/**

	function __construct()

	{

		global $db, $session, $paths, $template, $plugins; // Common objects

		if ( defined('IN_ENANO_INSTALL') && !defined('IN_ENANO_UPGRADE') )

		{

			@include(ENANO_ROOT.'/config.new.php');

		}

		else

		{

			@include(ENANO_ROOT.'/config.php');

		}

		unset($dbhost, $dbname, $dbuser, $dbpasswd);

		if(isset($crypto_key))

		{

			$this->private_key = $crypto_key;

			$this->private_key = hexdecode($this->private_key);

		}

		else

		{

			if(is_writable(ENANO_ROOT.'/config.php'))

			{

				// Generate and stash a private key

				// This should only happen during an automated silent gradual migration to the new encryption platform.

				$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

				$this->private_key = $aes->gen_readymade_key();

				$config = file_get_contents(ENANO_ROOT.'/config.php');

				if(!$config)

				{

					die('$session->__construct(): can\'t get the contents of config.php');

				}

				$config = str_replace("?>", "\$crypto_key = '{$this->private_key}';\n?>", $config);

				// And while we're at it...

				$config = str_replace('MIDGET_INSTALLED', 'ENANO_INSTALLED', $config);

				$fh = @fopen(ENANO_ROOT.'/config.php', 'w');

				if ( !$fh ) 

				{

					die('$session->__construct(): Couldn\'t open config file for writing to store the private key, I tried to avoid something like this...');

				}

				fwrite($fh, $config);

				fclose($fh);

			}

			else

			{

				die_semicritical('Crypto error', '<p>No private key was found in the config file, and we can\'t generate one because we don\'t have write access to the config file. Please CHMOD config.php to 666 or 777 and reload this page.</p>');

			}

		}

		// Check for compatibility mode

		if(defined('IN_ENANO_INSTALL'))

		{

			$q = $db->sql_query('SELECT old_encryption FROM '.table_prefix.'users LIMIT 1;');

			if(!$q)

			{

				$error = mysql_error();

				if(strstr($error, "Unknown column 'old_encryption'"))

					$this->compat = true;

				else

					$db->_die('This should never happen and is a bug - the only error that was supposed to happen here didn\'t happen. (sessions.php in constructor, during compat mode check)');

			}

			$db->free_result();

		}

	}

	/**

	/*