2 // This program is free software; you can redistribute it and/or
3 // modify it under the terms of the GNU General Public License
4 // as published by the Free Software Foundation; either version 2
5 // of the License, or (at your option) any later version.
7 //----------THINGS WE ALWAYS DO
9 require_once("{$GLOBALS['srcdir']}/log.inc");
10 require_once("{$GLOBALS['srcdir']}/sql.inc");
11 // added for the phpGACL group check -- JRM
12 require_once("{$GLOBALS['srcdir']}/acl.inc");
13 require_once("$srcdir/formdata.inc.php");
15 $incoming_site_id = '';
17 if (isset($_GET['auth']) && ($_GET['auth'] == "login") && isset($_POST['authUser']) &&
18 isset($_POST['authPass']) && isset($_POST['authProvider']))
21 if (!empty($_POST['languageChoice'])) {
22 $_SESSION['language_choice'] = $_POST['languageChoice'];
25 $_SESSION['language_choice'] = 1;
27 //If password expiration option is enabled call authCheckExpired() to check whether login user password is expired or not
28 if($GLOBALS['password_expiration_days'] != 0){
31 $ip=$_SERVER['REMOTE_ADDR'];
32 if (!authNewSession($_POST['authUser'], $_POST['authPass'], $_POST['authProvider']))
34 $_SESSION['loginfailure'] = 1;
37 $_SESSION['loginfailure'] = null;
38 unset($_SESSION['loginfailure']);
39 //store the very first initial timestamp for timeout errors
40 $_SESSION["last_update"] = time();
42 else if ( (isset($_GET['auth'])) && ($_GET['auth'] == "logout") )
44 newEvent("logout", $_SESSION['authUser'], $_SESSION['authProvider'], 1, "success");
50 if (authCheckSession())
52 if (isset($_SESSION['pid']) && empty($GLOBALS['DAEMON_FLAG']))
54 require_once("{$GLOBALS['srcdir']}/patient.inc");
56 $logpatient = getPatientData($_SESSION['pid'], "lname, fname, mname");
57 newEvent("view", $_SESSION['authUser'], $_SESSION['authProvider'],
58 "{$logpatient['lname']}, {$logpatient['fname']} {$logpatient['mname']} :: encounter " .
59 $_SESSION['encounter']);
63 //newEvent("view", $_SESSION['authUser'], $_SESSION['authProvider'], $_SERVER['REQUEST_URI']);
66 newEvent("login",$_POST['authUser'], $_POST['authProvider'], 0, "insufficient data sent");
71 if (!isset($_SESSION["last_update"])) {
74 //if page has not been updated in a given period of time, we call login screen
75 if ((time() - $_SESSION["last_update"]) > $timeout) {
76 newEvent("logout", $_SESSION['authUser'], $_SESSION['authProvider'], 0, "timeout");
80 if (empty($GLOBALS['DAEMON_FLAG'])) $_SESSION["last_update"] = time();
84 //----------THINGS WE DO IF WE STILL LIKE YOU
86 function authNewSession ($user, $pass, $provider)
88 $ip = $_SERVER['REMOTE_ADDR'];
89 // check to see if the user belongs to *any* OpenEMR groups in phpGACL -- JRM
90 global $phpgacl_location;
91 if (isset ($phpgacl_location)) {
92 if (acl_get_group_titles($user) == 0) {
93 newEvent( 'login', $user, $provider, 0, "failure: $ip. user not in any phpGACL groups. (bad username?)");
98 // get details about the user
99 $authDB = sqlQuery("select id, password, authorized, see_auth".
101 " from users where username = '$user'");
103 // if the user is NOT active, get out
104 if ($authDB['active'] != 1) {
105 newEvent( 'login', $user, $provider, 0, "failure: $ip. user not active or not found in users table");
109 // compare the submitted password with the stored password
110 if ($authDB['password'] == $pass)
112 //here, we check to see if the user is in fact a member of the correct group:
113 if ($authGroup = sqlQuery("select * from groups where user='$user' and name='$provider'"))
115 $_SESSION['authUser'] = $user;
116 $_SESSION['authGroup'] = $authGroup['name'];
117 $_SESSION['authUserID'] = $authDB['id'];
118 $_SESSION['authPass'] = $pass;
119 $_SESSION['authProvider'] = $provider;
120 $_SESSION['authId'] = $authDB{'id'};
121 $_SESSION['cal_ui'] = $authDB['cal_ui'];
122 $_SESSION['userauthorized'] = $authDB['authorized'];
123 // Some users may be able to authorize without being providers:
124 if ($authDB['see_auth'] > '2') $_SESSION['userauthorized'] = '1';
125 newEvent( 'login', $user, $provider, 1, "success: $ip");
128 newEvent( 'login', $user, $provider, 0, "failure: $ip. user not in group: $provider");
133 newEvent( 'login', $user, $provider, 0, "failure: $ip. user password mismatch ($pass)");
137 function authCheckSession ()
139 if (isset($_SESSION['authId'])) {
140 $authDB = sqlQuery("select username, password from users where id = '" .
141 $_SESSION['authId']."'");
142 if ($_SESSION['authUser'] == $authDB['username'] &&
143 $_SESSION['authPass'] == $authDB['password'])
156 function authCloseSession ()
158 // Before destroying the session, save its site_id so that the next
159 // login will default to that same site.
160 global $incoming_site_id;
161 $incoming_site_id = $_SESSION['site_id'];
165 unset($_COOKIE[session_name()]);
168 function authLoginScreen()
170 // See comment in authCloseSession().
171 global $incoming_site_id;
172 header("Location: {$GLOBALS['login_screen']}?error=1&site=$incoming_site_id");
176 // Check if the user's password has expired beyond the grace limit.
177 // If so, deactivate the user
178 function authCheckExpired()
180 $auser=formData('authUser','P');
181 $result = sqlStatement("select pwd_expiration_date from users where username = '".$auser."'");
182 if($row = sqlFetchArray($result))
184 $pwd_expires = $row['pwd_expiration_date'];
186 $current_date = date("Y-m-d");
187 if($pwd_expires != "0000-00-00")
189 $grace_time1 = date("Y-m-d", strtotime($pwd_expires . "+".$GLOBALS['password_grace_time'] ."days"));
191 if(($grace_time1 != "") && strtotime($current_date) > strtotime($grace_time1))
193 sqlStatement("update users set active=0 where username = '".$auser."'");
194 $_SESSION['loginfailure'] = 1;
199 function addUser ($username, $password_md5, $info, $authorized = 'yes')
201 return sqlInsert("insert into users (username, password, info, authorized) values ('$username', '$password_md5', '$info', '$authorized')");
204 function delUser ($id)
206 return sqlQuery("delete from users where id = '$id' limit 0,1");
209 function changePasword ($id, $new_md5)
211 return sqlQuery("update users set password = '$new_md5' where id = '$id'");
214 function getUserList ($cols = '*', $limit = 'all', $start = '0')
217 $rez = sqlStatement("select $cols from users where username != '' order by date DESC");
219 $rez = sqlStatement("select $cols from users where username != '' order by date DESC limit $limit, $start");
220 for ($iter = 0; $row = sqlFetchArray($rez); $iter++)
225 function getProviderList ($cols = '*', $limit= 'all', $start = '0')
228 $rez = sqlStatement("select $cols from groups order by date DESC");
230 $rez = sqlStatement("select $cols from groups order by date DESC limit $limit, $start");
231 for ($iter = 0; $row = sqlFetchArray($rez); $iter++)
236 function addGroup ($groupname)
238 return sqlInsert("insert into groups (name) values ('$groupname')");
241 function delGroup ($group_id)
243 return sqlQuery("delete from groups where id = '$group_id' limit 0,1");
246 /***************************************************************
248 //Function currently user by new post calendar code to determine
249 //if a given user is in a group with another user
250 //and if so to allow editing of that users events
252 //*************************************************************/
254 function validateGroupStatus ($user_to_be_checked, $group_user) {
255 if (isset($user_to_be_checked) && isset($group_user)) {
256 if ($user_to_be_checked == $group_user) {
260 elseif ($_SESSION['authorizeduser'] == 1)
263 $query = "SELECT groups.name FROM users,groups WHERE users.username = \"" . mysql_real_escape_string($user_to_be_checked) . "\" " .
264 "AND users.username = groups.user group by groups.name";
265 $result = sqlStatement($query);
267 $usertbcGroups = array();
269 while ($row = mysql_fetch_array($result)) {
270 $usertbcGroups[] = $row[0];
273 $query = "SELECT groups.name FROM users,groups WHERE users.username = \"" . mysql_real_escape_string($group_user) . "\" " .
274 "AND users.username = groups.user group by groups.name";
275 $result = sqlStatement($query);
277 $usergGroups = array();
279 while ($row = mysql_fetch_array($result)) {
280 $usergGroups[] = $row[0];
282 foreach ($usertbcGroups as $group) {
283 if(in_array($group,$usergGroups)) {
294 // Attempt to update the user's password, password history, and password expiration.
295 // Verify that the new password does not match the last three passwords used.
296 // Return true if successfull, false on failure
297 function UpdatePasswordHistory($userid,$pwd)
299 $result = sqlStatement("select password, pwd_history1, pwd_history2 from users where id = $userid");
300 if ($row = sqlFetchArray($result)) {
301 $previous_pwd1=$row['password'];
302 $previous_pwd2=$row['pwd_history1'];
303 $previous_pwd3=$row['pwd_history2'];
305 if (($pwd != $previous_pwd1) && ($pwd != $previous_pwd2) && ($pwd != $previous_pwd3)) {
306 sqlStatement("update users set pwd_history2='$previous_pwd2', pwd_history1='$previous_pwd1',password='$pwd' where id=$userid");
307 if($GLOBALS['password_expiration_days'] != 0){
308 $exp_days=$GLOBALS['password_expiration_days'];
309 $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
310 sqlStatement("update users set pwd_expiration_date='$exp_date' where id=$userid");