User.php

<?php

/**
 * PHP Server Monitor
 * Monitor your servers and websites.
 *
 * This file is part of PHP Server Monitor.
 * PHP Server Monitor is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * PHP Server Monitor is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with PHP Server Monitor.  If not, see <http://www.gnu.org/licenses/>.
 *
 * @package     phpservermon
 * @author      Panique <https://github.com/panique/php-login-advanced/>
 * @author      Pepijn Over <pep@mailbox.org>
 * @copyright   Copyright (c) 2008-2017 Pepijn Over <pep@mailbox.org>
 * @license     http://www.gnu.org/licenses/gpl.txt GNU GPL v3
 * @version     Release: @package_version@
 * @link        http://www.phpservermonitor.org/
 * @since       phpservermon 3.0.0
 **/

namespace psm\Service;

use Symfony\Component\HttpFoundation\Session\Session;
use Symfony\Component\HttpFoundation\Session\SessionInterface;

/**
 * This is a heavily modified version of the php-login-advanced project by Panique.
 *
 * It uses the Session classes from the Symfony HttpFoundation component.
 *
 * @author Panique
 * @author Pepijn Over
 * @link http://www.php-login.net
 * @link https://github.com/panique/php-login-advanced/
 * @license http://opensource.org/licenses/MIT MIT License
 */
class User
{

    /**
     * The database connection
     * @var \PDO $db_connection
     */
    protected $db_connection = null;

    /**
     * Local cache of user data
     * @var array $user_data
     */
    protected $user_data = array();

    /**
     * Session object
     * @var \Symfony\Component\HttpFoundation\Session\Session $session
     */
    protected $session;

    /**
     * Current user id
     * @var int $user_id
     */
    protected $user_id;

    /**
     * Current user preferences
     * @var array $user_preferences
     */
    protected $user_preferences;

    /**
     * The user's login status
     * @var boolean $user_is_logged_in
     */
    protected $user_is_logged_in = false;

    /**
     * Open a new user service
     *
     * @param \psm\Service\Database $db
     * @param \Symfony\Component\HttpFoundation\Session\SessionInterface $session if NULL, one will be created
     */
    public function __construct(Database $db, SessionInterface $session = null)
    {
        $this->db_connection = $db->pdo();

        if (!psm_is_cli()) {
            if ($session == null) {
                $session = new Session();
                $session->start();
            }
            $this->session = $session;

            if (PSM_PUBLIC === true && PSM_PUBLIC_PAGE === true) {
                $query_user = $this->db_connection->prepare('SELECT * FROM ' .
                    PSM_DB_PREFIX . 'users WHERE user_name = :user_name and level = :level');
                $query_user->bindValue(':user_name', "__PUBLIC__", \PDO::PARAM_STR);
                $query_user->bindValue(':level', PSM_USER_ANONYMOUS, \PDO::PARAM_STR);
                $query_user->execute();

                // get result row (as an object)
                $this->setUserLoggedIn($query_user->fetchObject()->user_id);
            }

            if ((!defined('PSM_INSTALL') || !PSM_INSTALL)) {
                // check the possible login actions:
                // 1. login via session data (happens each time user opens a page on your php project AFTER
                // he has successfully logged in via the login form)
                // 2. login via cookie

                // if user has an active session on the server
                if (!$this->loginWithSessionData()) {
                    $this->loginWithCookieData();
                }
            }
        }
    }

    /**
     * Get user by id, or get current user.
     * @param int $user_id if null it will attempt current user id
     * @param boolean $flush if TRUE it will query db regardless of whether we already have the data
     * @return object|boolean FALSE if user not found, object otherwise
     */
    public function getUser($user_id = null, $flush = false)
    {
        if ($user_id == null) {
            if (!$this->isUserLoggedIn()) {
                return false;
            } else {
                $user_id = $this->getUserId();
            }
        }

        if (!isset($this->user_data[$user_id]) || $flush) {
            $query_user = $this->db_connection->prepare('SELECT * FROM ' .
                PSM_DB_PREFIX . 'users WHERE user_id = :user_id');
            $query_user->bindValue(':user_id', $user_id, \PDO::PARAM_INT);
            $query_user->execute();
            // get result row (as an object)
            $this->user_data[$user_id] = $query_user->fetchObject();
        }
        return $this->user_data[$user_id];
    }

    /**
     * Search into database for the user data of user_name specified as parameter
     * @return object|boolean user data as an object if existing user
     */
    public function getUserByUsername($user_name)
    {
        // database query, getting all the info of the selected user
        $query_user = $this->db_connection->prepare('SELECT * FROM ' .
            PSM_DB_PREFIX . 'users WHERE user_name = :user_name');
        $query_user->bindValue(':user_name', $user_name, \PDO::PARAM_STR);
        $query_user->execute();
        // get result row (as an object)
        return $query_user->fetchObject();
    }

    /**
     * Logs in with SESSION data.
     *
     * @return boolean
     */
    protected function loginWithSessionData()
    {
        if (!$this->session->has('user_id')) {
            return false;
        }
        $user = $this->getUser($this->session->get('user_id'));

        if (!empty($user)) {
            $this->setUserLoggedIn($user->user_id);
            return true;
        } else {
            // user no longer exists in database
            // call logout to clean up session vars
            $this->doLogout();
            return false;
        }
    }

    /**
     * Logs in via the Cookie
     * @return bool success state of cookie login
     */
    private function loginWithCookieData()
    {
        if (isset($_COOKIE['rememberme'])) {
            // extract data from the cookie
            list($user_id, $token, $hash) = explode('_', $_COOKIE['rememberme']);
            // check cookie hash validity
            if ($hash == hash('sha256', $user_id . '_' . $token . PSM_LOGIN_COOKIE_SECRET_KEY) && !empty($token)) {
                // cookie looks good, try to select corresponding user
                // get real token from database (and all other data)
                $user = $this->getUser($user_id);

                if (!empty($user) && $token === $user->rememberme_token) {
                    $this->setUserLoggedIn($user->user_id, true);

                    // Cookie token usable only once
                    $this->newRememberMeCookie();
                    return true;
                }
            }
            // call logout to remove invalid cookie
            $this->doLogout();
        }
        return false;
    }

    /**
     * Logs in with the data provided in $_POST, coming from the login form
     * @param string $user_name
     * @param string $user_password
     * @param boolean $user_rememberme
     * @return boolean
     */
    public function loginWithPostData($user_name, $user_password, $user_rememberme = false)
    {
        $user_name = trim($user_name);
        $user_password = trim($user_password);
        $ldapauthstatus = false;

        if (empty($user_name) && empty($user_password)) {
            return false;
        }

        $dirauthconfig = psm_get_conf('dirauth_status');

        // LDAP auth enabled
        if ($dirauthconfig === '1') {
            $ldaplibpath = realpath(
                PSM_PATH_SRC . '..' . DIRECTORY_SEPARATOR .
                    'vendor' . DIRECTORY_SEPARATOR .
                    'viharm' . DIRECTORY_SEPARATOR .
                    'psm-ldap-auth' . DIRECTORY_SEPARATOR .
                    'psmldapauth.php'
            );
            // If the library is found
            if ($ldaplibpath) {
                // Delegate the authentication to the PsmLDAPauth module.
                // If LDAP auth fails or if library not found, fall back to native auth
                include_once($ldaplibpath);
                $ldapauthstatus = psmldapauth($user_name, $user_password, $GLOBALS['sm_config'], $this->db_connection);
            }
        }

        $user = $this->getUserByUsername($user_name);

        // Authenticated
        if ($ldapauthstatus === true) {
            // Remove password to prevent it from being saved in the DB.
            // Otherwise, user may still be authenticated if LDAP is disabled later.
            $user_password = null;
            @fn_Debug('Authenticated', $user);
        } else {

            // using PHP 5.5's password_verify() function to check if the provided passwords
            // fits to the hash of that user's password
            if (!isset($user->user_id)) {
                password_verify($user_password, 'dummy_call_against_timing');
                return false;
            } elseif (!password_verify($user_password, $user->password)) {
                return false;
            }
        } // not authenticated

        $this->setUserLoggedIn($user->user_id, true);

        // if user has check the "remember me" checkbox, then generate token and write cookie
        if ($user_rememberme) {
            $this->newRememberMeCookie();
        }

        // recalculate the user's password hash
        // DELETE this if-block if you like, it only exists to recalculate
        // users's hashes when you provide a cost factor,
        // by default the script will use a cost factor of 10 and never change it.
        // check if the have defined a cost factor in config/hashing.php
        if (defined('PSM_LOGIN_HASH_COST_FACTOR')) {
            // check if the hash needs to be rehashed
            if (password_needs_rehash($user->password, PASSWORD_DEFAULT, array('cost' => PSM_LOGIN_HASH_COST_FACTOR))) {
                $this->changePassword($user->user_id, $user_password);
            }
        }
        return true;
    }

    /**
     * Set the user logged in
     * @param int $user_id
     * @param boolean $regenerate regenerate session id against session fixation?
     */
    protected function setUserLoggedIn($user_id, $regenerate = false)
    {
        if ($regenerate) {
            $this->session->invalidate();
        }
        $this->session->set('user_id', $user_id);
        $this->session->set('user_logged_in', 1);

        // declare user id, set the login status to true
        $this->user_id = $user_id;
        $this->user_is_logged_in = true;
    }

    /**
     * Create all data needed for remember me cookie connection on client and server side
     */
    protected function newRememberMeCookie()
    {
        // generate 64 char random string and store it in current user data
        $random_token_string = hash('sha256', random_bytes(64));
        $sth = $this->db_connection->prepare('UPDATE ' .
            PSM_DB_PREFIX . 'users SET rememberme_token = :user_rememberme_token WHERE user_id = :user_id');
        $sth->execute(array(':user_rememberme_token' => $random_token_string, ':user_id' => $this->getUserId()));

        // generate cookie string that consists of userid, randomstring and combined hash of both
        $cookie_string_first_part = $this->getUserId() . '_' . $random_token_string;
        $cookie_string_hash = hash('sha256', $cookie_string_first_part . PSM_LOGIN_COOKIE_SECRET_KEY);
        $cookie_string = $cookie_string_first_part . '_' . $cookie_string_hash;

        // set cookie
        setcookie('rememberme', $cookie_string, time() + PSM_LOGIN_COOKIE_RUNTIME, "/", PSM_LOGIN_COOKIE_DOMAIN);
    }

    /**
     * Delete all data needed for remember me cookie connection on client and server side
     */
    protected function deleteRememberMeCookie()
    {
        // Reset rememberme token
        if ($this->session->has('user_id')) {
            $sth = $this->db_connection->prepare('UPDATE ' .
                PSM_DB_PREFIX . 'users SET rememberme_token = NULL WHERE user_id = :user_id');
            $sth->execute(array(':user_id' => $this->session->get('user_id')));
        }

        // set the rememberme-cookie to ten years ago (3600sec * 365 days * 10).
        // that's obivously the best practice to kill a cookie via php
        // @see http://stackoverflow.com/a/686166/1114320
        setcookie('rememberme', false, time() - (3600 * 3650), '/', PSM_LOGIN_COOKIE_DOMAIN);
    }

    /**
     * Perform the logout, resetting the session
     */
    public function doLogout()
    {
        $this->deleteRememberMeCookie();

        $this->session->clear();
        $this->session->invalidate();

        $this->user_is_logged_in = false;
    }

    /**
     * Simply return the current state of the user's login
     * @return bool user's login status
     */
    public function isUserLoggedIn()
    {
        return $this->user_is_logged_in;
    }

    /**
     * Sets a random token into the database (that will verify the user when he/she comes back via the link
     * in the email) and returns it
     * @param int $user_id
     * @return string|boolean FALSE on error, string otherwise
     */
    public function generatePasswordResetToken($user_id)
    {
        $user_id = intval($user_id);

        if ($user_id == 0) {
            return false;
        }
        // generate timestamp (to see when exactly the user (or an attacker) requested the password reset mail)
        $temporary_timestamp = time();
        // generate random hash for email password reset verification (64 char string)
        $user_password_reset_hash = hash('sha256', uniqid(random_bytes(64), true));

        $query_update = $this->db_connection->prepare('UPDATE ' .
            PSM_DB_PREFIX . 'users SET password_reset_hash = :user_password_reset_hash,
            password_reset_timestamp = :user_password_reset_timestamp
            WHERE user_id = :user_id');
        $query_update->bindValue(':user_password_reset_hash', $user_password_reset_hash, \PDO::PARAM_STR);
        $query_update->bindValue(':user_password_reset_timestamp', $temporary_timestamp, \PDO::PARAM_INT);
        $query_update->bindValue(':user_id', $user_id, \PDO::PARAM_INT);
        $query_update->execute();

        // check if exactly one row was successfully changed:
        if ($query_update->rowCount() == 1) {
            return $user_password_reset_hash;
        } else {
            return false;
        }
    }

    /**
     * Checks if the verification string in the account verification mail is valid and matches to the user.
     *
     * Please note it is valid for 1 hour.
     * @param int $user_id
     * @param string $token
     * @return boolean
     */
    public function verifyPasswordResetToken($user_id, $token)
    {
        $user_id = intval($user_id);

        if (empty($user_id) || empty($token)) {
            return false;
        }
        $user = $this->getUser($user_id);

        if (isset($user->user_id) && $user->password_reset_hash == $token) {
            $runtime = (defined('PSM_LOGIN_RESET_RUNTIME')) ? PSM_LOGIN_RESET_RUNTIME : 3600;
            $timestamp_max_interval = time() - $runtime;

            if ($user->password_reset_timestamp > $timestamp_max_interval) {
                return true;
            }
        }
        return false;
    }

    /**
     * Change the password of a user
     * @param int|\PDOStatement $user_id
     * @param string $password
     * @return boolean TRUE on success, FALSE on failure
     */
    public function changePassword($user_id, $password)
    {
        $user_id = intval($user_id);

        if (empty($user_id) || empty($password)) {
            return false;
        }
        // now it gets a little bit crazy: check if we have a constant
        // PSM_LOGIN_HASH_COST_FACTOR defined (in src/includes/psmconfig.inc.php),
        // if so: put the value into $hash_cost_factor, if not, make $hash_cost_factor = null
        $hash_cost_factor = (defined('PSM_LOGIN_HASH_COST_FACTOR') ? PSM_LOGIN_HASH_COST_FACTOR : null);

        // crypt the user's password with the PHP 5.5's password_hash() function, results in a 60 character hash string
        // the PASSWORD_DEFAULT constant is defined by the PHP 5.5,
        // or if you are using PHP 5.3/5.4, by the password hashing
        // compatibility library. the third parameter looks a little bit shitty, but that's how those PHP 5.5 functions
        // want the parameter: as an array with, currently only used with 'cost' => XX.
        $user_password_hash = password_hash($password, PASSWORD_DEFAULT, array('cost' => $hash_cost_factor));

        // write users new hash into database
        $query_update = $this->db_connection->prepare('UPDATE ' .
            PSM_DB_PREFIX . 'users SET password = :user_password_hash,
				password_reset_hash = NULL, password_reset_timestamp = NULL
				WHERE user_id = :user_id');
        $query_update->bindValue(':user_password_hash', $user_password_hash, \PDO::PARAM_STR);
        $query_update->bindValue(':user_id', $user_id, \PDO::PARAM_STR);
        $query_update->execute();

        // check if exactly one row was successfully changed:
        if ($query_update->rowCount() == 1) {
            return true;
        } else {
            return false;
        }
    }

    /**
     * Gets the user id
     * @return int
     */
    public function getUserId()
    {
        return $this->user_id;
    }

    /**
     * Gets the username
     * @return string
     */
    public function getUsername()
    {
        $user = $this->getUser();
        return (isset($user->user_name) ? $user->user_name : null);
    }

    /**
     * Gets the user level
     * @return int
     */
    public function getUserLevel()
    {
        $user = $this->getUser();

        if (isset($user->level)) {
            return $user->level;
        } else {
            return PSM_USER_ANONYMOUS;
        }
    }

    /**
     * read current user preferences from the database
     * @return boolean return false is user not connected
     */
    protected function loadPreferences()
    {
        if ($this->user_preferences === null) {
            if (!$this->getUser()) {
                return false;
            }

            $this->user_preferences = array();
            foreach ($this->db_connection->query('SELECT `key`,`value` FROM `' .
                PSM_DB_PREFIX . 'users_preferences` WHERE `user_id` = ' . $this->user_id) as $row) {
                $this->user_preferences[$row['key']] = $row['value'];
            }
        }
        return true;
    }

    /**
     * Get a user preference value
     * @param string $key
     * @param mixed $default
     * @return mixed
     */
    public function getUserPref($key, $default = '')
    {
        if (!$this->loadPreferences() || !isset($this->user_preferences[$key])) {
            return $default;
        }

        $value = $this->user_preferences[$key];
        settype($value, gettype($default));
        return $value;
    }

    /**
     * Set a user preference value
     * @param string $key
     * @param mixed $value
     */
    public function setUserPref($key, $value)
    {
        if ($this->loadPreferences()) {
            if (isset($this->user_preferences[$key])) {
                if ($this->user_preferences[$key] == $value) {
                    return; // no change
                }
                $sql = 'UPDATE `' . PSM_DB_PREFIX . 'users_preferences` SET `key` = ?, `value` = ? WHERE `user_id` = ?';
            } else {
                $sql = 'INSERT INTO `' . PSM_DB_PREFIX . 'users_preferences` SET `key` = ?, `value` = ?, `user_id` = ?';
            }
            $sth = $this->db_connection->prepare($sql);
            $sth->execute(array($key, $value, $this->user_id));
            $this->user_preferences[$key] = $value;
        }
    }

    /**
     * Get session object
     * @return \Symfony\Component\HttpFoundation\Session\SessionInterface
     */
    public function getSession()
    {
        return $this->session;
    }
}