/**
* Function for user to log-in forcefully i.e without providing user-credentials
*
* @param integer $userId
* @return boolean
* @throws Exception\UserNotExists
*/
public function forceLogin($userId)
{
$user = \App_Model_User::first(array('id = ?' => (int) $userId));
if ($user === null) {
throw new Exception\UserNotExists('User not found');
}
$this->setUser($user);
return true;
}
/**
* @before _secured, _admin
*/
public function deleteUserMainPhoto($id)
{
$this->willRenderActionView = false;
$this->willRenderLayoutView = false;
if ($this->checkCSRFToken()) {
$user = App_Model_User::first(array('id = ?' => (int) $id));
if ($user === null) {
echo self::ERROR_MESSAGE_2;
} else {
$unlinkMainImg = $user->getUnlinkPath();
$unlinkThumbImg = $user->getUnlinkThumbPath();
$user->imgMain = '';
$user->imgThumb = '';
if ($user->validate()) {
$user->save();
@unlink($unlinkMainImg);
@unlink($unlinkThumbImg);
Event::fire('admin.log', array('success', 'User id: ' . $user->getId()));
echo 'success';
} else {
Event::fire('admin.log', array('fail', 'User id: ' . $user->getId()));
echo self::ERROR_MESSAGE_1;
}
}
} else {
echo self::ERROR_MESSAGE_1;
}
}
/**
* Method generates 40-chars lenght salt for salting passwords
*
* @return string
*/
public static function createSalt()
{
$newSalt = Rand::randStr(40);
$user = \App_Model_User::first(array('salt = ?' => $newSalt));
if ($user === null) {
return $newSalt;
} else {
for ($i = 0; $i < 100; $i++) {
$newSalt = Rand::randStr(40);
$user = \App_Model_User::first(array('salt = ?' => $newSalt));
if ($i == 99) {
throw new Exception('Salt could not be created');
}
if ($user === null) {
return $newSalt;
} else {
continue;
}
}
}
}
/**
* Main authentication method which is used for user authentication
* based on two credentials such as username and password. These login
* credentials are set in database.
*
* @param string $name Username or email
* @param string $pass Password
*/
public function authenticate($name, $pass)
{
$errMessage = sprintf('%s and/or password are incorrect', ucfirst($this->_name));
$errMessageNotActive = 'Account is not active';
$user = \App_Model_User::first(array("{$this->_name} = ?" => $name));
if ($user === null) {
throw new Exception\UserNotExists($errMessage);
}
$passVerify = PasswordManager::validatePassword($pass, $user->getPassword(), $user->getSalt());
if ($passVerify === true) {
if ($user instanceof AdvancedUser) {
if (!$user->isActive()) {
throw new Exception\UserInactive($errMessageNotActive);
} elseif ($user->isAccountExpired()) {
throw new Exception\UserExpired($errMessage);
} elseif ($user->isPasswordExpired()) {
throw new Exception\UserPassExpired($errMessage);
} else {
$user->setLastLogin();
$user->setTotalLoginAttempts(0);
$user->setLastLoginAttempt(0);
$user->setFirstLoginAttempt(0);
$user->save();
$user->password = null;
$user->salt = null;
return $user;
}
} elseif ($user instanceof BasicUser) {
if (!$user->isActive()) {
throw new Exception\UserInactive($errMessageNotActive);
} else {
$user->setLastLogin();
$user->setTotalLoginAttempts(0);
$user->setLastLoginAttempt(0);
$user->setFirstLoginAttempt(0);
$user->save();
$user->password = null;
$user->salt = null;
return $user;
}
} else {
throw new Exception\Implementation(sprintf('%s is not implementing BasicUser', get_class($user)));
}
} else {
if ($this->_bruteForceDetection === true) {
if ($this->isBruteForce($user)) {
$identifier = $this->_name;
Core::getLogger()->log(sprintf('Brute Force Attack Detected for account %s', $user->{$identifier}));
throw new Exception\BruteForceAttack('WARNING: Brute Force Attack Detected. We Recommend you use captcha.');
} else {
throw new Exception\WrongPassword($errMessage);
}
} else {
throw new Exception\WrongPassword($errMessage);
}
}
}
