X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;ds=sidebyside;f=includes%2Fsession.inc;h=c9e0becb80fc8103d2b5ed389fd7990ddf985144;hb=50c10c8d64132ff5c269b23e62693db985dfe3f8;hp=d3ddf6009ed36bbe5645a12e49fe00611659b9c7;hpb=da8311619dd73feae101d246a1957b972e00cbd2;p=fa-stable.git

diff --git a/includes/session.inc b/includes/session.inc
index d3ddf600..c9e0becb 100644
--- a/includes/session.inc
+++ b/includes/session.inc
@@ -1,117 +1,245 @@
 <?php
-	/*--------------------------------------------------\
-	|               |               | session.inc       |
-	|---------------------------------------------------|
-    | front_accounting 									|
-    | http://open-accounting.sourceforge.net/  			|
-    | by KylieTech Consulting                           |
-    | http://frontaccounting.com/           			|
-    | by Joe Hunt Consulting         |
-	\--------------------------------------------------*/
-
-	if (!isset($path_to_root)) 
+/**********************************************************************
+	Copyright (C) FrontAccounting, LLC.
+	Released under the terms of the GNU General Public License, GPL,
+	as published by the Free Software Foundation, either version 3
+	of the License, or (at your option) any later version.
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+	See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+function output_html($text)
+{
+	global $before_box, $Ajax, $messages;
+	// Fatal errors are not send to error_handler,
+	// so we must check the output
+	if ($text && preg_match('/\bFatal error(<.*?>)?:(.*)/i', $text, $m)) {
+		$Ajax->aCommands = array();  // Don't update page via ajax on errors
+		$text = preg_replace('/\bFatal error(<.*?>)?:(.*)/i','', $text);
+		$messages[] = array(E_ERROR, $m[2], null, null);
+	}
+	$Ajax->run();
+	return  in_ajax() ? fmt_errors() : ($before_box.fmt_errors().$text);
+}
+//----------------------------------------------------------------------------------------
+
+function kill_login()
+{
+	session_unset();
+	session_destroy();
+}
+//----------------------------------------------------------------------------------------
+
+function login_fail()
+{
+	global $path_to_root;
+	
+	header("HTTP/1.1 401 Authorization Required");
+	echo "<center><br><br><font size='5' color='red'><b>" . _("Incorrect Password") . "<b></font><br><br>";
+	echo "<b>" . _("The user and password combination is not valid for the system.") . "<b><br><br>";
+
+	echo _("If you are not an authorized user, please contact your system administrator to obtain an account to enable you to use the system.");
+	echo "<br><a href='".$path_to_root.'/index.php'.">" . _("Try again") . "</a>";
+	echo "</center>";
+
+	kill_login();
+	die();
+}
+
+//----------------------------------------------------------------------------------------
+
+function check_page_security($page_security)
+{
+	if (!$_SESSION["wa_current_user"]->check_user_access())
 	{
-		$path_to_root = ".";
+		// notification after upgrade from pre-2.2 version
+		$msg = $_SESSION["wa_current_user"]->old_db ?
+			 _("Security settings have not been defined for your user account.")
+				. "<br>" . _("Please contact your system administrator.")	
+			: _("Please remove \$security_groups and \$security_headings arrays from config.php file!");
+
+		page(_("Access denied"), false);
+			display_error($msg);
+		end_page();
+		kill_login();
+		exit;
 	}
 
-    include_once($path_to_root . "/includes/current_user.inc");
+	if (!$_SESSION["wa_current_user"]->can_access_page($page_security))
+	{
+		// no_menu parameter guess here is ugly hack, but works for now.
+		// Better solution is to use global switch for menu, set before 
+		// session.inc inclusion.
+		page(_("Access denied"), strpos($_SERVER['PHP_SELF'], '/view/'));
+
+		echo "<center><br><br><br><b>";
+		echo _("The security settings on your account do not permit you to access this function");
+		echo "</b>";
+		echo "<br><br><br><br></center>";
+		end_page();
+		//kill_login();
+		exit;
+	}
+}
+
+//-----------------------------------------------------------------------------
+//	Removing magic quotes from nested arrays/variables
+//
+function strip_quotes($data)
+{
+	if(get_magic_quotes_gpc()) {
+		if(is_array($data)) {
+			foreach($data as $k => $v) {
+				$data[$k] = strip_quotes($data[$k]);
+			}
+		} else
+			return stripslashes($data);
+	}
+	return $data;
+}
+
+//============================================================================
+//
+//
+function login_timeout()
+{
+	// skip timeout on logout page
+	if ($_SESSION["wa_current_user"]->logged) {
+		$tout = $_SESSION["wa_current_user"]->timeout;
+		if ($tout && (time() > $_SESSION["wa_current_user"]->last_act + $tout))
+		{
+			$_SESSION["wa_current_user"]->logged = false;
+		}
+		$_SESSION["wa_current_user"]->last_act = time();
+	}
+}
+//============================================================================
+if (!isset($path_to_root))
+{
+	$path_to_root = ".";
+}
 
-    include_once($path_to_root . "/config.php");
+// Prevent register_globals vulnerability
+if (isset($_GET['path_to_root']) || isset($_POST['path_to_root']))
+	die("Restricted access");
 
-    include_once($path_to_root . "/includes/main.inc");
+include_once($path_to_root . "/frontaccounting.php");
+include_once($path_to_root . "/admin/db/security_db.inc");
+include_once($path_to_root . "/includes/current_user.inc");
+include_once($path_to_root . "/includes/lang/language.php");
+include_once($path_to_root . "/config_db.php");
+include_once($path_to_root . "/includes/ajax.inc");
+include_once($path_to_root . "/includes/ui/ui_msgs.inc");
 
-    //----------------------------------------------------------------------------------------
+/*
+	Uncomment the setting below when using FA on shared hosting
+	to avoid unexpeced session timeouts.
+	Make sure this directory exists and is writable!
+*/
+//ini_set('session.save_path', dirname(__FILE__).'/../tmp/');
 
-	function kill_login() 
-	{
-        session_unset();
-		session_destroy();
-	}
+ini_set('session.gc_maxlifetime', 36000); // 10hrs
 
-	//----------------------------------------------------------------------------------------
+session_name('FrontAccounting');
+session_start();
+// this is to fix the "back-do-you-want-to-refresh" issue - thanx PHPFreaks
+header("Cache-control: private");
 
-	function login_fail() 
-	{
-        echo "<center><br><br><font size='5' color='red'><b>" . _("Incorrect Password") . "<b></font><br><br>";
-        echo "<b>" . _("The user and password combination is not valid for the system.") . "<b><br><br>";
+get_text_init();
 
-        echo _("If you are not an authorized user, please contact your system administrator to obtain an account to enable you to use the system.");
-		echo "<br><a href='javascript:history.go(-1)'>" . _("Back") . "</a>";
-        echo "</center>";
+// Page Initialisation
+if (!isset($_SESSION['languages'])) 
+{
+	load_languages(); // sets also default $_SESSION['language']
+}
 
-        kill_login();
-        die();
-	}
+$_SESSION['language']->set_language($_SESSION['language']->code);
 
-	//----------------------------------------------------------------------------------------
+// include $Hooks object if locale file exists
+if(@include_once($path_to_root . "/lang/".$_SESSION['language']->code."/locale.inc")) 
+{
+	$Hooks = new Hooks();
+}
 
-	function check_page_security($page_security) 
-	{
-		if (!$_SESSION["wa_current_user"]->check_user_access()) 
-		{
-			echo "<br><br><br><center>";
-			echo "<b>" . _("Security settings have not been defined for your user account.");
-			echo "<br>" . _("Please contact your system administrator.") . "</b>";
+include_once($path_to_root . "/includes/access_levels.inc");
+include_once($path_to_root . "/config.php");
+include_once($path_to_root . "/includes/main.inc");
 
-			kill_login();
-			exit;
-		}
+// Ajax communication object
+$Ajax =& new Ajax();
 
-		if (!$_SESSION["wa_current_user"]->can_access_page($page_security)) 
-		{
-			page(_("Access denied"));
-			echo "<center><br><br><br><b>";
-			echo _("The security settings on your account do not permit you to access this function");
-			echo "</b>";
-			echo "<br><br><a href='javascript:history.go(-1)'>" . _("Back") . "</a>";
-			echo "<br><br><br><br>";
-			//echo '<script type="text/javascript">';
-			//echo 'alert("' . _("The security settings on your account do not permit you to access this function") . '");';
-			//echo 'history.go(-1)';
-			//echo '</script>'
-			end_page();
-			//kill_login();
-			exit;
-		}
-	}
+// js/php validation rules container
+$Validate = array();
+// bindings for editors
+$Editors = array();
+// page help. Currently help for function keys.
+$Pagehelp = array();
 
-	//----------------------------------------------------------------------------------------
+$SysPrefs = new sys_prefs();
 
-	if (!isset($_SESSION["wa_current_user"]) ||
-		(isset($_SESSION["wa_current_user"]) && !$_SESSION["wa_current_user"]->logged_in())) 
-	{
+$Refs = new references();
+
+// intercept all output to destroy it in case of ajax call
+register_shutdown_function('end_flush');
+ob_start('output_html',0);
 
-		$_SESSION["wa_current_user"] = new current_user();
+// colect all error msgs
+set_error_handler('error_handler' /*, errtypes */);
 
-        // Show login screen
-        if (!isset($_POST["user_name_entry_field"]) or $_POST["user_name_entry_field"] == "") 
-        {
-	        include($path_to_root . "/access/login.php");
-            exit;
-        }
-   	}
+if (!isset($_SESSION["wa_current_user"]))
+	$_SESSION["wa_current_user"] = new current_user();
 
-   	if (isset($_POST["user_name_entry_field"])) 
-   	{
-		$succeed = $_SESSION["wa_current_user"]->login($_POST["company_login_name"],
-			$_POST["user_name_entry_field"],
-			md5($_POST["password"]));
+set_global_connection();
 
-		if (!$succeed) 
+// logout.php is the only page we should have always 
+// accessable regardless of access level and current login status.
+if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
+
+	login_timeout();
+
+	if (!$_SESSION["wa_current_user"]->logged_in())
+	{
+		// Show login screen
+		if (!isset($_POST["user_name_entry_field"]) or $_POST["user_name_entry_field"] == "")
 		{
+			$_SESSION['timeout'] = array( 'uri'=> $_SERVER['REQUEST_URI'],
+				'post' => $_POST);
+
+			if (!in_ajax()) {
+				include($path_to_root . "/access/login.php");
+			} else {
+				// ajax update of current page elements - open login window in popup
+				// to not interfere with ajaxified page.
+				$Ajax->popup($path_to_root . "/access/timeout.php");
+			}
+			exit;
+		} else {
+			$succeed = $_SESSION["wa_current_user"]->login($_POST["company_login_name"],
+				$_POST["user_name_entry_field"], md5($_POST["password"]));
+			// select full vs fallback ui mode on login
+			$_SESSION["wa_current_user"]->ui_mode = $_POST['ui_mode'];
+			if (!$succeed)
+			{
 			// Incorrect password
-			login_fail();
+				login_fail();
+			}
+			$lang = &$_SESSION['language'];
+			$lang->set_language($_SESSION['language']->code);
 		}
-   	}
+	}
+
+	if (!isset($_SESSION["App"])) {
+		$_SESSION["App"] = new front_accounting();
+		$_SESSION["App"]->init();
+	}
 
-   	check_page_security($page_security);
+//----------------------------------------------------------------------------------------
 
-    // Run with debugging messages for the system administrator(s) but not anyone else
-    /*if (in_array(15, $security_groups[$_SESSION["AccessLevel"]])) {
-        $debug = 1;
-    } else {
-        $debug = 0;
-    }*/
+	check_page_security($page_security);
+}
+// POST vars cleanup needed for direct reuse.
+// We quote all values later with db_escape() before db update.
+	$_POST = strip_quotes($_POST);
 
-	//----------------------------------------------------------------------------------------
 ?>
\ No newline at end of file