{

const HASH_LENGTH = 40;

const TOKEN_LENGTH = 20;

/**

protected $dbh;

/**

public $config;

/**

public $isAuthenticated = false;

/**

protected $currentuser = null;

/**

protected $messages_dictionary = [];

/**

protected $recaptcha_config = [];

/**

public function __construct(PDO $dbh, Config $config)

{

if (version_compare(phpversion(), '5.6.0', '<')) {

die('PHP 5.6.0 required for PHPAuth engine!');

}

$this->dbh = $dbh;

$this->config = $config;

$this->recaptcha_config = $this->config->recaptcha;

$this->messages_dictionary = $this->config->dictionary;

date_default_timezone_set($this->config->site_timezone);

$this->isAuthenticated = $this->isLogged();

}

/**

//@todo: => loginUser

public function login($email, $password, $remember = 0, $captcha_response = null)

{

$return['error'] = true;

$block_status = $this->isBlocked();

if ($block_status == "verify") {

if ($this->checkCaptcha($captcha_response) == false) {

$return['message'] = $this->__lang("user_verify_failed");

return $return;

}

}

if ($block_status == "block") {

$return['message'] = $this->__lang("user_blocked");

return $return;

}

$validateEmail = $this->validateEmail($email);

$validatePassword = $this->validatePassword($password);

if ($validateEmail['error'] == 1) {

$this->addAttempt();

$return['message'] = $validateEmail['message']; // ?? $this->__lang("account_email_invalid");

return $return;

} elseif ($validatePassword['error'] == 1) {

$this->addAttempt();

$return['message'] = $validatePassword['message']; // ?? $this->__lang("account_password_invalid");

return $return;

} elseif ($remember != 0 && $remember != 1) {

$this->addAttempt();

$return['message'] = $this->__lang("remember_me_invalid"); //@todo => login_remember_me_invalid

return $return;

}

$uid = $this->getUID(strtolower($email));

if (!$uid) {

$this->addAttempt();

$return['message'] = $this->__lang("account_not_found");

return $return;

}

$user = $this->getBaseUser($uid);

if (!$this->password_verify_with_rehash($password, $user['password'], $uid)) {

$this->addAttempt();

$return['message'] = $this->__lang("email_password_incorrect");

return $return;

}

if ($user['isactive'] != 1) {

$this->addAttempt();

$return['message'] = $this->__lang("account_inactive");

return $return;

}

$sessiondata = $this->addSession($user['uid'], $remember);

if ($sessiondata == false) {

$return['message'] = $this->__lang("system_error") . " #01";

return $return;

}

$return['error'] = false;

$return['message'] = $this->__lang("logged_in");

$return['hash'] = $sessiondata['hash'];

$return['expire'] = $sessiondata['expire'];

$return['cookie_name'] = $this->config->cookie_name;

return $return;

}

/**

//@todo: => registerUserAccount

public function register($email, $password, $repeatpassword, $params = [], $captcha_response = null, $use_email_activation = null)

{

$return['error'] = true;

$block_status = $this->isBlocked();

if ($block_status == "verify") {

if ($this->checkCaptcha($captcha_response) == false) {

$return['message'] = $this->__lang("user_verify_failed");

return $return;

}

}

if ($block_status == "block") {

$return['message'] = $this->__lang("user_blocked");

return $return;

}

if ($password !== $repeatpassword) {

$return['message'] = $this->__lang("password_nomatch");

return $return;

}

// Validate email

$validateEmail = $this->validateEmail($email);

if ($validateEmail['error'] == 1) {

$return['message'] = $validateEmail['message'];

return $return;

}

// Validate password

$validatePassword = $this->validatePassword($password);

if ($validatePassword['error'] == 1) {

$return['message'] = $validatePassword['message'];

return $return;

}

$zxcvbn = new Zxcvbn();

if ($zxcvbn->passwordStrength($password)['score'] < intval($this->config->password_min_score)) {

$return['message'] = $this->__lang('password_weak');

return $return;

}

if ($this->isEmailTaken($email)) {

$this->addAttempt();

$return['message'] = $this->__lang("email_taken");

return $return;

}

$addUser = $this->addUser($email, $password, $params, $use_email_activation);

if ($addUser['error'] != 0) {

$return['message'] = $addUser['message'];

return $return;

}

$return['error'] = false;

$return['message'] =

($use_email_activation == true

? $this->__lang("register_success")

: $this->__lang('register_success_emailmessage_suppressed'));

$return['uid'] = $addUser['uid'];

$return['token'] = $addUser['token'];

return $return;

}

/**

public function activate($activate_token) //@todo: rename to 'activateUserAccount'

{

$return['error'] = true;

$block_status = $this->isBlocked();

if ($block_status == "block") {

$return['message'] = $this->__lang("user_blocked");

return $return;

}

if (strlen($activate_token) !== self::TOKEN_LENGTH) {

$this->addAttempt();

$return['message'] = $this->__lang("activationkey_invalid");

return $return;

}

// 'user is already activated' will never triggered, because after successful activation token removed from DB

// NOW is no any way to determine, is this token used for activation or not?

$request_result = $this->getRequest($activate_token, "activation");

if ($request_result['error']) {

$return['message'] = $request_result['message'];

return $return;

}

if ($this->getBaseUser($request_result['uid'])['isactive'] == 1) {

$this->addAttempt();

$this->deleteRequest($request_result['id']);

$return['message'] = $this->__lang("system_error") . " #02"; // user activated, but activate token not expired

return $return;

}

$query = "UPDATE {$this->config->table_users} SET isactive = :isactive WHERE id = :id";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'isactive' => 1,

'id' => $request_result['uid']

];

$query_prepared->execute($query_params);

$this->deleteRequest($request_result['id']);

$return['error'] = false;

$return['message'] = $this->__lang("account_activated");

return $return;

}

/**

public function requestReset($email, $use_email_activation = null)

{

$state['error'] = true;

$block_status = $this->isBlocked();

if ($block_status == "block") {

$state['message'] = $this->__lang("user_blocked");

return $state;

}

$validateEmail = $this->validateEmail($email);

if ($validateEmail['error'] == 1) {

$state['message'] = $this->__lang("email_invalid");

return $state;

}

$query = "SELECT id, email FROM {$this->config->table_users} WHERE email = :email";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['email' => $email]);

$row = $query_prepared->fetch(PDO::FETCH_ASSOC);

if (!$row) {

$this->addAttempt();

$state['message'] = $this->__lang("email_incorrect");

return $state;

}

$addRequest = $this->addRequest($row['id'], $email, "reset", $use_email_activation);

if ($addRequest['error'] == 1) {

$this->addAttempt();

$state['message'] = $addRequest['message'];

return $state;

}

$state['uid'] = $row['id'];

$state['error'] = false;

$state['message'] = ($use_email_activation == true ? $this->__lang("reset_requested") : $this->__lang('reset_requested_emailmessage_suppressed'));

$state['token'] = $addRequest['token'];

$state['expire'] = $addRequest["expire"];

return $state;

}

/**

public function logout($hash)

{

if (strlen($hash) != self::HASH_LENGTH) {

return false;

}

$this->isAuthenticated = false;

$this->currentuser = null;

return $this->deleteSession($hash);

}

/**

public function logoutAll($uid)

{

$this->isAuthenticated = false;

$this->currentuser = null;

return $this->deleteExistingSessions($uid);

}

/**

public function getHash($password)

{

return password_hash($password, PASSWORD_BCRYPT, ['cost' => $this->config->bcrypt_cost]);

}

/**

public function getUID($email)

{

$query = "SELECT id FROM {$this->config->table_users} WHERE email = :email";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['email' => $email]);

if ($query_prepared->rowCount() == 0) {

return false;

}

return $query_prepared->fetchColumn();

}

/**

protected function addSession($uid, $remember)

{

$ip = $this->getIp();

$user = $this->getBaseUser($uid);

if (!$user) {

return false;

}

$data['hash'] = sha1($this->config->site_key . microtime());

$agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';

if (!$this->config->allow_concurrent_sessions) {

$this->deleteExistingSessions($uid);

}

if ($remember == true) {

$data['expire'] = strtotime($this->config->cookie_remember);

} else {

$data['expire'] = strtotime($this->config->cookie_forget);

}

$data['cookie_crc'] = sha1($data['hash'] . $this->config->site_key);

// don't use INET_ATON(:ip), use ip2long(), 'cause SQLite or PosgreSQL does not have INET_ATON() function

$query = "

";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'uid' => $uid,

'hash' => $data['hash'],

'expiredate' => date("Y-m-d H:i:s", $data['expire']),

'ip' => $ip,

'agent' => $agent,

'cookie_crc' => $data['cookie_crc']

];

if (!$query_prepared->execute($query_params)) {

return false;

}

setcookie($this->config->cookie_name, $data['hash'], $data['expire'], $this->config->cookie_path, $this->config->cookie_domain, $this->config->cookie_secure, $this->config->cookie_http);

$_COOKIE[$this->config->cookie_name] = $data['hash'];

return $data;

}

//@todo: delete cookie at deleteSession

/**

protected function deleteExistingSessions($uid)

{

$query = "DELETE FROM {$this->config->table_sessions} WHERE uid = :uid";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['uid' => $uid]);

return $query_prepared->rowCount() > 0;

}

/**

protected function deleteSession($hash)

{

$query = "DELETE FROM {$this->config->table_sessions} WHERE hash = :hash";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['hash' => $hash]);

return $query_prepared->rowCount() == 1;

}

/**

public function checkSession($hash, $device_id = null)

{

$ip = $this->getIp();

$block_status = $this->isBlocked();

if ($block_status == "block") {

$return['message'] = $this->__lang("user_blocked");

return false;

}

if (strlen($hash) != self::HASH_LENGTH) {

return false;

}

// INET_NTOA(ip)

$query = "SELECT id, uid, expiredate, ip, agent, cookie_crc, device_id FROM {$this->config->table_sessions} WHERE hash = :hash";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'hash' => $hash

];

$query_prepared->execute($query_params);

if ($query_prepared->rowCount() == 0) {

return false;

}

$row = $query_prepared->fetch(PDO::FETCH_ASSOC);

$uid = $row['uid'];

$expiredate = strtotime($row['expiredate']);

$currentdate = strtotime(date("Y-m-d H:i:s"));

$db_ip = $row['ip'];

$db_cookie = $row['cookie_crc'];

$db_device_id = $row['device_id'];

if ($currentdate > $expiredate) {

$this->deleteSession($hash);

return false;

}

if ($device_id != null) {

if ($db_device_id !== $device_id) {

return false;

}

} else {

if ($ip !== $db_ip) {

return false;

}

}

if ($db_cookie == sha1($hash . $this->config->site_key)) {

if ($expiredate - $currentdate < strtotime($this->config->cookie_renew) - $currentdate) {

$this->deleteSession($hash);

$this->addSession($uid, false);

}

return true;

}

return false;

}

/**

public function getSessionUID($hash)

{

$query = "SELECT uid FROM {$this->config->table_sessions} WHERE hash = :hash";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'hash' => $hash

];

$query_prepared->execute($query_params);

if ($query_prepared->rowCount() == 0) {

return false;

}

return $query_prepared->fetch(PDO::FETCH_ASSOC)['uid'];

}

/**

public function isEmailTaken($email)

{

$query = "SELECT count(*) FROM {$this->config->table_users} WHERE email = :email";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['email' => $email]);

if ($query_prepared->fetchColumn() == 0) {

return false;

}

return true;

}

/**

public function isEmailBanned($email)

{

try {

$this->dbh->query("SELECT * FROM {$this->config->table_emails_banned} LIMIT 1;");

} catch (PDOException $e) {

return false;

}

$query = "SELECT count(*) FROM {$this->config->table_emails_banned} WHERE domain = :domain";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute([

'domain' => (strtolower(explode('@', $email)[1]))

]);

if ($query_prepared->fetchColumn() == 0) {

return false;

}

return true;

}

/**

protected function addUser($email, $password, $params = [], &$use_email_activation)

{

$return['error'] = true;

$query = "INSERT INTO {$this->config->table_users} (isactive) VALUES (0)";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute()) {

$return['message'] = $this->__lang("system_error") . " #03";

return $return;

}

$uid = $this->dbh->lastInsertId("{$this->config->table_users}_id_seq");

$email = htmlentities(strtolower($email));

$token = '';

if ($use_email_activation) {

$addRequest = $this->addRequest($uid, $email, "activation", $use_email_activation);

$token = $addRequest['token'];

if ($addRequest['error'] == 1) {

$query = "DELETE FROM {$this->config->table_users} WHERE id = :id";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'id' => $uid

];

$query_prepared->execute($query_params);

$return['message'] = $addRequest['message'];

return $return;

}

$isactive = 0;

} else {

$isactive = 1;

}

$password = $this->getHash($password);

if (is_array($params) && count($params) > 0) {

$customParamsQueryArray = [];

foreach ($params as $paramKey => $paramValue) {

$customParamsQueryArray[] = ['value' => $paramKey . ' = ?'];

}

$setParams = ', ' . implode(', ', array_map(function ($entry) {

return $entry['value'];

}, $customParamsQueryArray));

} else {

$setParams = '';

}

$query = "UPDATE {$this->config->table_users} SET email = ?, password = ?, isactive = ? {$setParams} WHERE id = ?";

$query_prepared = $this->dbh->prepare($query);

$bindParams = array_values(array_merge([$email, $password, $isactive], $params, [$uid]));

if (!$query_prepared->execute($bindParams)) {

$query = "DELETE FROM {$this->config->table_users} WHERE id = ?";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute([$uid]);

$return['message'] = $this->__lang("system_error") . " #04";

return $return;

}

$return['uid'] = $uid;

$return['error'] = false;

$return['token'] = $token;

return $return;

}

/**

protected function getBaseUser($uid)

{

$query = "SELECT email, password, isactive FROM {$this->config->table_users} WHERE id = :id";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['id' => $uid]);

$data = $query_prepared->fetch(PDO::FETCH_ASSOC);

if (!$data) {

return false;

}

$data['uid'] = $uid;

return $data;

}

/**

public function getUser($uid, $withpassword = false)

{

$query = "SELECT * FROM {$this->config->table_users} WHERE id = :id";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['id' => $uid]);

$data = $query_prepared->fetch(PDO::FETCH_ASSOC);

if (!$data) {

return false;

}

$data['uid'] = $uid;

if (!$withpassword)

unset($data['password']);

return $data;

}

/**

public function deleteUser($uid, $password, $captcha_response = null)

{

$return['error'] = true;

$block_status = $this->isBlocked();

if ($block_status == "verify") {

if ($this->checkCaptcha($captcha_response) == false) {

$return['message'] = $this->__lang("user_verify_failed");

return $return;

}

}

if ($block_status == "block") {

$return['message'] = $this->__lang("user_blocked");

return $return;

}

$validatePassword = $this->validatePassword($password);

if ($validatePassword['error'] == 1) {

$this->addAttempt();

$return['message'] = $validatePassword['message'];

return $return;

}

$user = $this->getBaseUser($uid);

if (!password_verify($password, $user['password'])) {

$this->addAttempt();

$return['message'] = $this->__lang("password_incorrect");

return $return;

}

$query = "DELETE FROM {$this->config->table_users} WHERE id = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #05";

return $return;

}

$query = "DELETE FROM {$this->config->table_sessions} WHERE uid = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #06";

return $return;

}

$query = "DELETE FROM {$this->config->table_requests} WHERE uid = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #07";

return $return;

}

$return['error'] = false;

$return['message'] = $this->__lang("account_deleted");

return $return;

}

/**

public function deleteUserForced($uid)

{

$return['error'] = true;

$query = "DELETE FROM {$this->config->table_users} WHERE id = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #05";

return $return;

}

$query = "DELETE FROM {$this->config->table_sessions} WHERE uid = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #06";

return $return;

}

$query = "DELETE FROM {$this->config->table_requests} WHERE uid = :uid";

$query_prepared = $this->dbh->prepare($query);

if (!$query_prepared->execute(['uid' => $uid])) {

$return['message'] = $this->__lang("system_error") . " #07";

return $return;

}

$return['error'] = false;

$return['message'] = $this->__lang("account_deleted");

return $return;

}

// protected function add

/**

protected function addRequest($uid, $email, $type, &$use_email_activation)

{

$return['error'] = true;

$dictionary_key__request_exists = '';

if ($type == 'activation') {

$dictionary_key__request_exists = 'activation_exists';

} elseif ($type == 'reset') {

$dictionary_key__request_exists = 'reset_exists';

} else {

$return['message'] = $this->__lang("system_error") . " #08";

return $return;

}

$send_email = true;

// if not set up manually, check config data

if (false !== $use_email_activation) {

$use_email_activation = true;

if ($type == "reset" && !!$this->config->emailmessage_suppress_reset) {

$send_email = false;

}

if ($type == "activation" && !!$this->config->emailmessage_suppress_activation) {

$send_email = false;

}

}

$query = "SELECT id, expire FROM {$this->config->table_requests} WHERE uid = :uid AND type = :type";

$query_prepared = $this->dbh->prepare($query);

$query_prepared->execute(['uid' => $uid, 'type' => $type]);

$row_count = $query_prepared->rowCount();

if ($row_count > 0) {

$row = $query_prepared->fetch(PDO::FETCH_ASSOC);

$expiredate = strtotime($row['expire']);

$currentdate = strtotime(date("Y-m-d H:i:s"));

if ($currentdate < $expiredate) {

$return['message'] = $this->__lang($dictionary_key__request_exists, date($this->config->custom_datetime_format, $expiredate));

return $return;

}

$this->deleteRequest($row['id']);

}

/*// uneffective call. And, never be called, 'cause "Activation key is incorrect." throwen before

$token = $this->getRandomKey(self::TOKEN_LENGTH); // use GUID for tokens?

$expire = date("Y-m-d H:i:s", strtotime($this->config->request_key_expiration));

$query = "INSERT INTO {$this->config->table_requests} (uid, token, expire, type) VALUES (:uid, :token, :expire, :type)";

$query_prepared = $this->dbh->prepare($query);

$query_params = [

'uid' => $uid,

'token' => $token,

'expire' => $expire,

'type' => $type

];

if (!$query_prepared->execute($query_params)) {

$return['message'] = $this->__lang("system_error") . " #09";

return $return;

}

$request_id = $this->dbh->lastInsertId();

if ($use_email_activation === true && $send_email) {

$sendmail_status = $this->do_SendMail($email, $type, $token);