function util_doDigitalFieldNotebooksIdSecurityCheck()
{
if (!isset($_COOKIE["digitalfieldnotebooks_id"]) || !$_COOKIE["digitalfieldnotebooks_id"]) {
if (isset($_SESSION['digitalfieldnotebooks_id']) && $_SESSION['digitalfieldnotebooks_id']) {
// the session has an digitalfieldnotebooks id, but there was no cookie set for it - highly suspicious
// TODO: log and/or message?
util_redirectToAppHomeWithPrejudice();
}
$digitalfieldnotebooks_id = util_genRandomIdString(300);
setcookie("digitalfieldnotebooks_id", $digitalfieldnotebooks_id);
$_SESSION['digitalfieldnotebooks_id'] = $digitalfieldnotebooks_id;
} elseif (!isset($_SESSION['digitalfieldnotebooks_id']) || $_COOKIE["digitalfieldnotebooks_id"] != $_SESSION['digitalfieldnotebooks_id']) {
// there was an appropriately named cookie, but the value doesn't match the one associated with this session
// TODO: log and/or message?
util_redirectToAppHomeWithPrejudice();
}
}
util_redirectToAppHome('failure', 'msg_failed_sign_in');
}
}
// NOTE: handling of non-logged-in users is delegated to individual app code pages - the application does NOT automatically require users to be logged in
// else {
// // SECTION: must be signed in to view pages; otherwise, redirect to index splash page
// if (!strpos(APP_FOLDER . "/index.php", $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'])) {
// // TODO: add logging?
// util_redirectToAppHome('info', 'msg_do_sign_in');
// }
// }
} else {
// SECTION: authenticated
if ($_SESSION['fingerprint'] != $FINGERPRINT) {
// TODO: add logging?
util_redirectToAppHomeWithPrejudice();
}
if (isset($_REQUEST['submit_signout'])) {
// SECTION: wants to log out
util_wipeSession();
util_redirectToAppHome();
// NOTE: the above is the same as util_redirectToAppHomeWithPrejudice, but this code is easier to follow/read when the two parts are shown here
}
}
$IS_AUTHENTICATED = util_checkAuthentication();
if ($IS_AUTHENTICATED) {
// SECTION: is signed in
// now create user object
$USER = new User(['username' => $_SESSION['userdata']['username'], 'DB' => $DB]);
//echo "<pre>"; print_r($USER); echo "</pre>";
// now check if user data differs from session data, and if so, update the users db record (this might be a part of the User construct method)