extensions/Auth.php

   1 <?php
   2         // @title       Auth class
   3         // @author      Matt Todd <matt@matttoddphoto.com>
   4         // @created     2005-12-22
   5         // @desc        Handles authentication. Simple, no? However, this needs to be
   6         //                      altered to integrate with the current authentication system
   7         // @requires stdexception.php (StdException class)
   8         // @requires modles/user.php (User model)
   9
  10         include_once 'extexception.php';
  11
  12         // classes
  13         class Auth {
  14                 // functions
  15                 public static function authenticate($username, $password) {
  16                         // LDAP authentication for username and password
  17                 }
  18
  19                 public static function find_login_or_session_data(&$username, &$password) {
  20                         // retreive the current session
  21                         $session = Session::retreive();
  22                         $session_auth = $session->auth;
  23
  24                         if(!empty($session_auth)) {
  25                                 $login = $session->auth;
  26                         } elseif(!empty($_POST['login'])) {
  27                                 $login = $_POST['login'];
  28                                 // Make an MD5 hash of the password from the form:
  29                                 // this is a security risk if we just execute a plain query
  30                                 // with the password from the form because the password
  31                                 // will be stored in the logs (yikes!).
  32                                 // Plus, it reduces it down to one query, either from
  33                                 // the login form or from sessions!
  34                                 $login['password'] = md5($login['password']);
  35                         } else {
  36                                 return false;
  37                         }
  38
  39                         $username = $login['username'];
  40                         $password = $login['password'];
  41
  42                         return true;
  43                 }
  44
  45                 public static function authenticated() {
  46                                 $session = Session::retreive();
  47                                 $auth = $session->auth;
  48                                 if(!empty($auth)) return true;
  49                                 return false;
  50                 }
  51
  52                 public static function check_role($username, $role) {
  53                         $user = new user();
  54
  55                         try {
  56                                 $user->find_by_username($username);
  57                         } catch(Exception $e) {
  58                                 return false;
  59                         }
  60
  61                         if($user->role['role'] == $role) return true;
  62                         return false;
  63                 }
  64         }
  65
  66         class AuthException extends ExtException {}
  67 ?>