The $result must be a validated user with the appropriate variables set.
+ * The associative array
+ * @global database $database
+ * @global string $conf
+ * @param array|bool $result Associative array containing: domain_uuid, domain_name, user_uuid, username. Contact keys can be empty, but should still be present. They include: contact_uuid, contact_name_given, contact_name_family, contact_image.
+ * @param array $user_settings User settings from the v_user_settings table or an empty array.
+ * @return void
+ */
+ public static function create_user_session($result = [], $user_settings = []): void {
+ global $database;
+
+ //
+ // Validate data
+ //
+ if (empty($result)) {
+ return;
+ }
+
+ // Required keys
+ $required_keys = [
+ 'domain_uuid' => true,
+ 'domain_name' => true,
+ 'user_uuid' => true,
+ 'username' => true,
+ ];
+
+ // Any missing required_fields are left in the $diff array.
+ // When all keys are present the $diff array will be empty.
+ $diff = array_diff_key($required_keys, $result);
+
+ // All required keys must be present in the $result associative array
+ if (!empty($diff)) {
+ return;
+ }
+
+ // Domain and User UUIDs must be valid UUIDs
+ if (!is_uuid($result['domain_uuid']) || !is_uuid($result['user_uuid'])) {
+ return;
+ }
+
+ // If Contact UUID has a value it must be a valid UUID
+ if (!empty($result['contact_uuid']) && !is_uuid($result['contact_uuid'])) {
+ return;
+ }
+
+ //
+ // All data validated continue to create session
+ //
+
+ // Set project root directory
+ $project_root = dirname(__DIR__, 4);
+
+ // Set the session variables
+ $_SESSION["domain_uuid"] = $result["domain_uuid"];
+ $_SESSION["domain_name"] = $result["domain_name"];
+ $_SESSION["user_uuid"] = $result["user_uuid"];
+ $_SESSION["context"] = $result['domain_name'];
+
+ // Build the session server array to validate the session
+ global $conf;
+ if (!isset($conf['session.validate'])) {
+ $conf['session.validate'][] = 'HTTP_USER_AGENT';
+ }
+ foreach ($conf['session.validate'] as $name) {
+ $server_array[$name] = $_SERVER[$name];
+ }
+
+ // Save the user hash to be used in check_auth
+ $_SESSION["user_hash"] = hash('sha256', implode($server_array));
+
+ // User session array
+ $_SESSION["user"]["domain_uuid"] = $result["domain_uuid"];
+ $_SESSION["user"]["domain_name"] = $result["domain_name"];
+ $_SESSION["user"]["user_uuid"] = $result["user_uuid"];
+ $_SESSION["user"]["username"] = $result["username"];
+ $_SESSION["user"]["contact_uuid"] = $result["contact_uuid"] ?? null; //contact_uuid is optional
+
+ // Check for contacts
+ if (file_exists($project_root . '/core/contacts/')) {
+ $_SESSION["user"]["contact_organization"] = $result["contact_organization"] ?? null;
+ $_SESSION["user"]["contact_name"] = trim(($result["contact_name_given"] ?? '') . ' ' . ($result["contact_name_family"] ?? ''));
+ $_SESSION["user"]["contact_name_given"] = $result["contact_name_given"] ?? null;
+ $_SESSION["user"]["contact_name_family"] = $result["contact_name_family"] ?? null;
+ $_SESSION["user"]["contact_image"] = !empty($result["contact_image"]) && is_uuid($result["contact_image"]) ? $result["contact_image"] : null;
+ }
+
+ //empty the permissions
+ if (isset($_SESSION['permissions'])) {
+ unset($_SESSION['permissions']);
+ }
+
+ //get the groups assigned to the user
+ $group = new groups($database, $result["domain_uuid"], $result["user_uuid"]);
+ $group->session();
+
+ //get the permissions assigned to the user through the assigned groups
+ $permission = new permissions($database, $result["domain_uuid"], $result["user_uuid"]);
+ $permission->session();
+
+ //get the domains
+ if (file_exists($project_root . '/app/domains/resources/domains.php') && !is_cli()) {
+ require_once $project_root . 'app/domains/resources/domains.php';
+ }
+
+ //store user settings in the session when available
+ if (is_array($user_settings)) {
+ foreach ($user_settings as $row) {
+ $name = $row['user_setting_name'];
+ $category = $row['user_setting_category'];
+ $subcategory = $row['user_setting_subcategory'];
+ if (!empty($row['user_setting_value'])) {
+ if (empty($subcategory)) {
+ //$$category[$name] = $row['domain_setting_value'];
+ if ($name == "array") {
+ $_SESSION[$category][] = $row['user_setting_value'];
+ } else {
+ $_SESSION[$category][$name] = $row['user_setting_value'];
+ }
+ } else {
+ //$$category[$subcategory][$name] = $row['domain_setting_value'];
+ if ($name == "array") {
+ $_SESSION[$category][$subcategory][] = $row['user_setting_value'];
+ } else {
+ $_SESSION[$category][$subcategory][$name] = $row['user_setting_value'];
+ }
+ }
+ }
+ }
+ }
+
+ //get the extensions that are assigned to this user
+ if (file_exists($project_root . '/app/extensions/app_config.php')) {
+ if (isset($_SESSION["user"]) && is_uuid($_SESSION["user_uuid"]) && is_uuid($_SESSION["domain_uuid"]) && !isset($_SESSION['user']['extension'])) {
+ $parameters = [];
+ //get the user extension list
+ $_SESSION['user']['extension'] = null;
+ $sql = "select ";
+ $sql .= "e.extension_uuid, ";
+ $sql .= "e.extension, ";
+ $sql .= "e.number_alias, ";
+ $sql .= "e.user_context, ";
+ $sql .= "e.outbound_caller_id_name, ";
+ $sql .= "e.outbound_caller_id_number, ";
+ $sql .= "e.description ";
+ $sql .= "from ";
+ $sql .= "v_extension_users as u, ";
+ $sql .= "v_extensions as e ";
+ $sql .= "where ";
+ $sql .= "e.domain_uuid = :domain_uuid ";
+ $sql .= "and e.extension_uuid = u.extension_uuid ";
+ $sql .= "and u.user_uuid = :user_uuid ";
+ $sql .= "and e.enabled = 'true' ";
+ $sql .= "order by ";
+ $sql .= "e.extension asc ";
+ $parameters['domain_uuid'] = $_SESSION['domain_uuid'];
+ $parameters['user_uuid'] = $_SESSION['user_uuid'];
+ $extensions = $database->select($sql, $parameters, 'all');
+ if (!empty($extensions)) {
+ foreach ($extensions as $x => $row) {
+ //set the destination
+ $destination = $row['extension'];
+ if (!empty($row['number_alias'])) {
+ $destination = $row['number_alias'];
+ }
+
+ //build the user array
+ $_SESSION['user']['extension'][$x]['user'] = $row['extension'];
+ $_SESSION['user']['extension'][$x]['number_alias'] = $row['number_alias'];
+ $_SESSION['user']['extension'][$x]['destination'] = $destination;
+ $_SESSION['user']['extension'][$x]['extension_uuid'] = $row['extension_uuid'];
+ $_SESSION['user']['extension'][$x]['outbound_caller_id_name'] = $row['outbound_caller_id_name'];
+ $_SESSION['user']['extension'][$x]['outbound_caller_id_number'] = $row['outbound_caller_id_number'];
+ $_SESSION['user']['extension'][$x]['user_context'] = $row['user_context'];
+ $_SESSION['user']['extension'][$x]['description'] = $row['description'];
+
+ //set the context
+ $_SESSION['user']['user_context'] = $row["user_context"];
+ $_SESSION['user_context'] = $row["user_context"];
+ }
+ }
+ }
+ }
+
+ //set the time zone
+ if (!isset($_SESSION["time_zone"]["user"])) {
+ $_SESSION["time_zone"]["user"] = null;
+ }
+ if (strlen($_SESSION["time_zone"]["user"] ?? '') === 0) {
+ //set the domain time zone as the default time zone
+ date_default_timezone_set($_SESSION['domain']['time_zone']['name']);
+ } else {
+ //set the user defined time zone
+ date_default_timezone_set($_SESSION["time_zone"]["user"]);
+ }
+
+ //regenerate the session on login
+ //session_regenerate_id(true);
+
+ //add the username to the session - username session could be set so check_auth uses an authorized session variable instead
+ $_SESSION['username'] = $_SESSION['user']["username"];
+ return;
+ }
+
/**
* get_domain used to get the domain name from the URL or username and then sets both domain_name and domain_uuid
*/
diff --git a/core/authentication/resources/classes/plugins/database.php b/core/authentication/resources/classes/plugins/database.php
index f44649eda0..8bbf487c9a 100644
--- a/core/authentication/resources/classes/plugins/database.php
+++ b/core/authentication/resources/classes/plugins/database.php
@@ -122,6 +122,26 @@ class plugin_database {
$view->assign("login_password_description", $text['label-password_description']);
$view->assign("button_cancel", $text['button-cancel']);
$view->assign("button_forgot_password", $text['button-forgot_password']);
+
+ //assign openid values to the template
+ if ($settings->get('open_id', 'enabled', false)) {
+ $classes = $settings->get('open_id', 'methods', []);
+ $banners = [];
+ foreach ($classes as $open_id_class) {
+ if (class_exists($open_id_class)) {
+ $banners[] = [
+ 'name' => $open_id_class,
+ 'image' => $open_id_class::get_banner_image(),
+ 'url' => '/app/open_id/open_id.php?action=' . $open_id_class,
+ ];
+ }
+ }
+ if (count($banners) > 0) {
+ $view->assign('banners', $banners);
+ }
+ }
+
+ //assign user to the template
if (!empty($_SESSION['username'])) {
$view->assign("username", $_SESSION['username']);
}
diff --git a/core/authentication/resources/views/login.htm b/core/authentication/resources/views/login.htm
index 4ea057ccfc..2b10129c5a 100644
--- a/core/authentication/resources/views/login.htm
+++ b/core/authentication/resources/views/login.htm
@@ -99,6 +99,18 @@
{if !empty($username)}
{$button_cancel}
{/if}
+ {if isset($banners)}
+
Performs a case-sensitive check indicating if needle is contained in haystack.
+ * @param string $haystack The string to search in. + * @param string $needle The substring to search for in the haystack. + * @return bool Returns true if needle is in haystack, false otherwise + * @link https://www.php.net/manual/en/function.str-contains.php Official PHP documentation + * @see str_ends_with(), str_starts_with(), strpos(), stripos(), strrpos(), strripos(), strstr(), strpbrk(), substr(), preg_match() + */ + function str_contains(string $haystack, string $needle): bool { + return strpos($haystack, $needle) !== false; + } + } + if (!function_exists('str_starts_with')) { /** * Checks if a string starts with a given substring @@ -116,13 +131,35 @@ if (!function_exists('check_cidr')) { + /** + * Checks if the $ip_address is within the range of the given $cidr + * @param string|array $cidr + * @param string $ip_address + * @return bool return true if the IP address is in CIDR or if it is empty + */ function check_cidr($cidr, $ip_address) { - if (isset($cidr) && !empty($cidr)) { - list ($subnet, $mask) = explode('/', $cidr); - return ( ip2long($ip_address) & ~((1 << (32 - $mask)) - 1) ) == ip2long($subnet); - } else { - return false; + + //no cidr restriction + if (empty($cidr)) { + return true; } + + //check to see if the user's remote address is in the cidr array + if (is_array($cidr) { + //cidr is an array + foreach ($cidr as $value) { + if (check_cidr($value, $ip_address)) { + return true; + } + } + } else { + //cidr is a string + list ($subnet, $mask) = explode('/', $cidr); + return (ip2long($ip_address) & ~((1 << (32 - $mask)) - 1)) == ip2long($subnet); + } + + //value not found in cidr + return false; } }