506 lines
18 KiB
PHP
Executable File
506 lines
18 KiB
PHP
Executable File
<?php
|
||
|
||
/*
|
||
* @link http://kodcloud.com/
|
||
* @author warlee | e-mail:kodcloud@qq.com
|
||
* @copyright warlee 2014.(Shanghai)Co.,Ltd
|
||
* @license http://kodcloud.com/tools/license/license.txt
|
||
*/
|
||
|
||
class userIndex extends Controller {
|
||
private $user; //用户相关信息
|
||
function __construct() {
|
||
parent::__construct();
|
||
}
|
||
public function index(){
|
||
@ob_end_clean();
|
||
include(TEMPLATE.'user/index.html');
|
||
}
|
||
// 进入初始化; total=10ms左右;
|
||
public function init(){
|
||
Hook::trigger('globalRequestBefore');
|
||
Hook::bind('beforeShutdown','user.index.shutdownEvent');
|
||
if( !file_exists(USER_SYSTEM . 'install.lock') ){
|
||
return ActionCall('install.index.check');
|
||
}
|
||
if( !file_exists(BASIC_PATH . 'config/setting_user.php') || empty($GLOBALS['config']['database'])){
|
||
show_tips(LNG('explorer.sysSetUserError'));
|
||
}
|
||
$this->initDB(); //
|
||
Action('filter.index')->bindBefore();
|
||
$this->initSession(); //
|
||
$this->initSetting(); //
|
||
init_check_update(); // 升级检测处理;
|
||
KodIO::initSystemPath();
|
||
|
||
Action('filter.index')->bind();
|
||
$this->loginCheck();
|
||
Model('Plugin')->init();
|
||
Action('filter.index')->trigger();
|
||
if(!defined("USER_ID")){
|
||
$userID = Session::get("kodUser.userID");$userID = 0;
|
||
define("USER_ID",$userID ? $userID:0);
|
||
}
|
||
}
|
||
public function shutdownEvent(){
|
||
TaskQueue::addSubmit(); // 结束后有任务时批量加入
|
||
TaskRun::autoRun(); // 定期执行及延期任务处理;
|
||
CacheLock::unlockRuntime(); // 清空异常时退出,未解锁的加锁;
|
||
}
|
||
private function initDB(){
|
||
think_config($GLOBALS['config']['databaseDefault']);
|
||
think_config($GLOBALS['config']['database']);
|
||
}
|
||
private function initSession(){
|
||
$this->apiSignCheck();
|
||
// 入口不处理cookie,兼容服务器启用了全GET缓存情况(输出前一次用户登录的cookie,导致账号登录异常)
|
||
$action= strtolower(ACTION);
|
||
if( $action == 'user.index.index' || $action == 'user.view.call'){
|
||
Cookie::disable(true);
|
||
}
|
||
|
||
$systemPass = Model('SystemOption')->get('systemPassword');
|
||
if(isset($_REQUEST['accessToken'])){
|
||
$token = $_REQUEST['accessToken'];
|
||
if(!$token || strlen($token) > 500){show_json('token error!',false);}
|
||
|
||
$pass = substr(md5('kodbox_'.$systemPass),0,15);
|
||
$sessionSign = Mcrypt::decode($token,$pass);
|
||
if(!$sessionSign){show_json(LNG('common.loginTokenError'),ERROR_CODE_LOGOUT);}
|
||
if($action == 'user.index.index'){Cookie::disable(false);} // 带token的url跳转入口页面允许cookie输出;
|
||
Session::sign($sessionSign);
|
||
}
|
||
if(!$GLOBALS['disableSession'] && !Session::get('kod')){
|
||
Session::set('kod',1);
|
||
if(!Session::get('kod')){show_tips(LNG('explorer.sessionSaveError'));}
|
||
}
|
||
// 注意: Session设置sessionid的cookie;两个请求时间过于相近,可能导致删除cookie失败的问题;(又有sessionid请求覆盖)
|
||
// 设置csrf防护;
|
||
if(!Cookie::get('CSRF_TOKEN')){Cookie::set('CSRF_TOKEN',rand_string(16));}
|
||
}
|
||
|
||
private function initSetting(){
|
||
if(!defined('STATIC_PATH')){
|
||
define('STATIC_PATH',$GLOBALS['config']['settings']['staticPath']);
|
||
}
|
||
$sysOption = Model('SystemOption')->get();
|
||
$upload = &$GLOBALS['config']['settings']['upload'];
|
||
if(isset($sysOption['chunkSize'])){ //没有设置则使用默认;
|
||
$upload['chunkSize'] = floatval($sysOption['chunkSize']);
|
||
|
||
// 老版本升级,没有值情况处理;
|
||
if(isset($sysOption['ignoreName'])){$upload['ignoreName'] = trim($sysOption['ignoreName']);}
|
||
if(isset($sysOption['chunkRetry'])){$upload['chunkRetry'] = intval($sysOption['chunkRetry']);}
|
||
if(isset($sysOption['threads'])){$upload['threads'] = floatval($sysOption['threads']);}
|
||
if($upload['threads'] <= 0){$upload['threads'] = 1;}
|
||
|
||
// 上传限制扩展名,限制单文件大小;
|
||
$role = Action('user.authRole')->userRoleAuth();
|
||
if($role && $role['info']){
|
||
$roleInfo = $role['info'];
|
||
// if(isset($roleInfo['ignoreExt'])){
|
||
// $upload['ignoreExt'] = $roleInfo['ignoreExt'];
|
||
// }
|
||
if(isset($roleInfo['ignoreFileSize'])){
|
||
$upload['ignoreFileSize'] = $roleInfo['ignoreFileSize'];
|
||
}
|
||
}
|
||
if($sysOption['downloadSpeedOpen']){//限速大小;
|
||
$upload['downloadSpeed'] = floatval($sysOption['downloadSpeed']);
|
||
}
|
||
}
|
||
|
||
// 文件历史版本数量限制; 小于等于1则关闭,大于500则不限制;
|
||
if(isset($sysOption['fileHistoryMax'])){
|
||
$GLOBALS['config']['settings']['fileHistoryMax'] = intval($sysOption['fileHistoryMax']);
|
||
}
|
||
$upload['chunkSize'] = $upload['chunkSize']*1024*1024;
|
||
$upload['chunkSize'] = $upload['chunkSize'] <= 1024*1024*0.1 ? 1024*1024*0.4:$upload['chunkSize'];
|
||
$upload['chunkSize'] = intval($upload['chunkSize']);
|
||
}
|
||
|
||
/**
|
||
* 登录检测;并初始化数据状态
|
||
* 通过session或kodToken检测登录
|
||
*/
|
||
public function loginCheck() {
|
||
if( KodUser::isLogin() ){
|
||
return $this->userDataInit();
|
||
}
|
||
if(Session::get('kodUserLogoutTrigger')){return;} //主动设置退出,不自动登录;
|
||
$userID = Cookie::get('kodUserID');
|
||
$loginToken = Cookie::get('kodToken');
|
||
if ($userID && $loginToken ) {
|
||
$user = Model('User')->getInfoFull($userID);
|
||
if ($user && $user['status'] != '0' && $this->makeLoginToken($user['userID']) == $loginToken ) {
|
||
return $this->loginSuccess($user);
|
||
}
|
||
}
|
||
}
|
||
|
||
private function logoutError($msg,$code){
|
||
Session::destory();
|
||
Cookie::remove('kodToken');
|
||
show_json($msg,$code);
|
||
}
|
||
private function userDataInit() {
|
||
$this->user = Session::get('kodUser');
|
||
if($this->user){
|
||
$findUser = Model('User')->getInfoFull($this->user['userID']);
|
||
// 用户账号hash对比; 账号密码修改自动退出处理;
|
||
if($findUser['userHash'] != $this->user['userHash']){
|
||
$this->logoutError(LNG('common.loginTokenError').'(hash)',ERROR_CODE_LOGOUT);
|
||
}
|
||
|
||
//优化,避免频繁写入session(file缓存时容易造成并发锁); 变化时更新;或者超过10分钟写入一次;
|
||
$_lastTime = $this->user['_lastTime'];unset($this->user['_lastTime']);
|
||
if($this->user != $findUser || time() - $_lastTime > 600){
|
||
$findUser['_lastTime'] = time();
|
||
Session::set('kodUser',$findUser);
|
||
}
|
||
$this->user = $findUser;
|
||
}
|
||
if(!$this->user) {
|
||
$this->logoutError('user data error!',ERROR_CODE_LOGOUT);
|
||
}else if($this->user['status'] == 0) {
|
||
$this->logoutError(LNG('user.userEnabled'),ERROR_CODE_USER_INVALID);
|
||
}else if($this->user['roleID'] == '') {
|
||
$this->logoutError(LNG('user.roleError'),ERROR_CODE_LOGOUT);
|
||
}
|
||
|
||
$GLOBALS['isRoot'] = 0;
|
||
$role = Model('SystemRole')->listData($this->user['roleID']);
|
||
if($role['administrator'] == '1'){
|
||
$GLOBALS['isRoot'] = 1;
|
||
}
|
||
|
||
// 计划任务处理; 目录读写所有者为系统;
|
||
if( strtolower(ACTION) == 'user.view.call'){
|
||
define('USER_ID',0);
|
||
define('MY_HOME','');
|
||
define('MY_DESKTOP','');
|
||
return;
|
||
}
|
||
|
||
define('USER_ID',$this->user['userID']);
|
||
define('MY_HOME',KodIO::make($this->user['sourceInfo']['sourceID']));
|
||
define('MY_DESKTOP',KodIO::make($this->user['sourceInfo']['desktop']));
|
||
}
|
||
|
||
public function accessToken(){
|
||
$systemPass = Model('SystemOption')->get('systemPassword');
|
||
$pass = substr(md5('kodbox_'.$systemPass),0,15);
|
||
return Mcrypt::encode(Session::sign(),$pass,3600*24*30);
|
||
}
|
||
public function accessTokenGet(){
|
||
if(!KodUser::isLogin()){show_json('user not login!',ERROR_CODE_LOGOUT);}
|
||
show_json($this->accessToken(),true);
|
||
}
|
||
public function accessTokenCheck($token){
|
||
if(!$token || strlen($token) > 500) return false;
|
||
|
||
$systemPass = Model('SystemOption')->get('systemPassword');
|
||
$pass = substr(md5('kodbox_'.$systemPass),0,15);
|
||
$sessionSign = Mcrypt::decode($token,$pass);
|
||
if(!$sessionSign || $sessionSign != Session::sign()) return false;
|
||
return true;
|
||
}
|
||
|
||
// 登录校验并自动跳转 (已登录则直接跳转,未登录则登录成功后跳转)
|
||
public function autoLogin(){
|
||
$link = $this->in['link'];
|
||
if(!$link) return;
|
||
|
||
$errorTips = _get($this->in,'msg','');
|
||
$errorTips = $errorTips == '[API LOGIN]' ? '':$errorTips; // 未登录标记,不算做登录错误;
|
||
if(KodUser::isLogin() && !$errorTips){
|
||
$param = 'kodTokenApi='.$this->accessToken();
|
||
if($this->in['callbackToken'] == '1'){
|
||
$link .= strstr($link,'?') ? '&'.$param:'?'.$param;
|
||
}
|
||
header('Location:'.$link);exit;
|
||
}
|
||
|
||
$param = '#user/login&link='.rawurlencode($link);
|
||
$param .= isset($this->in['msg']) ? "&msg=".$this->in['msg']:'';
|
||
$param .= isset($this->in['callbackToken']) ? '&callbackToken=1':'';
|
||
header('Location:'.APP_HOST.$param);exit;
|
||
}
|
||
|
||
/**
|
||
* 根据用户名密码获取用户信息
|
||
* @param [type] $name
|
||
* @param [type] $password
|
||
*/
|
||
public function userInfo($name, $password){
|
||
$user = Model("User")->userLoginCheck($name,$password);
|
||
if(!is_array($user)) {
|
||
$userHook = Hook::trigger("user.index.userInfo",$name, $password);
|
||
if(is_array($userHook)) return $userHook;// 第三方登陆不做检测处理;
|
||
}
|
||
return Hook::trigger('user.index.loginSubmitBefore',$name,$user);
|
||
}
|
||
|
||
/**
|
||
* 退出处理
|
||
*/
|
||
public function logout() {
|
||
$user = Session::get('kodUser');
|
||
if(!is_array($user) || !$user['userID']){show_json('ok');}
|
||
Hook::trigger('user.index.logoutBefore',$user);
|
||
|
||
$lastLogin = time() - $GLOBALS['config']['cache']['sessionTime'] - 10;
|
||
Model('User')->userEdit($user['userID'],array("lastLogin"=>$lastLogin));
|
||
Session::destory();
|
||
Cookie::remove(SESSION_ID,true);
|
||
Cookie::remove('kodToken');
|
||
Action('user.sso')->logout(); // 单点登录同步跟随退出;清理缓存;
|
||
show_json('ok');
|
||
}
|
||
|
||
/**
|
||
* 登录数据提交处理；登录跳转：
|
||
*/
|
||
public function loginSubmit() {
|
||
$res = $this->loginWithToken();
|
||
if($res || $res !== false) return $res;
|
||
$res = $this->loginWithThird(); // app第三方账号登录
|
||
if($res || $res !== false) return $res;
|
||
$data = Input::getArray(array(
|
||
"name" => array("check"=>"require",'lengthMax'=>100),
|
||
"password" => array('check'=>"require",'lengthMax'=>100),
|
||
"salt" => array("default"=>false),
|
||
));
|
||
$checkCode = Input::get('checkCode', 'require', '');
|
||
if( need_check_code() && $data['name'] != 'guest'){
|
||
Action('user.setting')->checkImgCode($checkCode);
|
||
}
|
||
if ($data['salt']) {
|
||
$key = substr($data['password'], 0, 5) . "2&$%@(*@(djfhj1923";
|
||
$data['password'] = Mcrypt::decode(substr($data['password'], 5), $key);
|
||
}
|
||
$user = $this->userInfo($data['name'],$data['password']);
|
||
if (!is_array($user)){
|
||
show_json($this->loginErrMsg($user),false);
|
||
}
|
||
if(!$user['status']){
|
||
show_json(LNG('user.userEnabled'), ERROR_CODE_USER_INVALID);
|
||
}
|
||
$this->loginSuccessUpdate($user);
|
||
//自动登录跳转; http://xxx.com/?user/index/loginSubmit&name=guest&password=guest&auto=1
|
||
$this->loginAuto();
|
||
show_json('ok',true,$this->accessToken());
|
||
}
|
||
private function loginWithToken(){
|
||
if (!isset($this->in['loginToken'])) return false;
|
||
$apiToken = $this->config['settings']['apiLoginToken'];
|
||
$param = explode('|', $this->in['loginToken']);
|
||
if (strlen($apiToken) < 5 ||
|
||
count($param) != 2 || strlen($this->in['loginToken']) > 500 ||
|
||
md5(base64_decode($param[0]) . $apiToken) != $param[1]
|
||
) {
|
||
return show_json('API 接口参数错误!', false);
|
||
}
|
||
$name = base64_decode($param[0]);
|
||
$res = Model('User')->where(array('name' => $name))->field('userID')->find();
|
||
if(empty($res['userID'])) {
|
||
return show_json(LNG('user.pwdError'),false);
|
||
}
|
||
$user = Model('User')->getInfoFull($res['userID']);
|
||
$this->loginSuccessUpdate($user);
|
||
$this->loginAuto();
|
||
return show_json('ok',true,$this->accessToken());
|
||
}
|
||
|
||
// 更新登录时间
|
||
public function loginSuccessUpdate($user){
|
||
$this->loginSuccess($user);
|
||
Model('User')->userEdit($user['userID'],array("lastLogin"=>time()));
|
||
ActionCall('admin.log.loginLog'); // 登录日志
|
||
}
|
||
|
||
/**
|
||
* （app）第三方登录
|
||
*/
|
||
private function loginWithThird(){
|
||
if (!isset($this->in['third'])) return false;
|
||
$third = Input::get('third');
|
||
if(empty($third)) return false;
|
||
$third = is_array($third) ? $third : json_decode($third, true);
|
||
|
||
// 判断执行结果
|
||
if(isset($third['avatar'])) $third['avatar'] = rawurldecode($third['avatar']);
|
||
Hook::trigger('user.bind.withApp', $third);
|
||
$this->loginAuto();
|
||
return show_json('ok',true,$this->accessToken());
|
||
}
|
||
|
||
// 登录后自动跳转
|
||
private function loginAuto() {
|
||
if($this->in['auto'] != '1') return;
|
||
header('Location: '.APP_HOST);exit;
|
||
}
|
||
|
||
// 刷新用户信息;
|
||
public function refreshUser($userID){
|
||
Model('User')->clearCache($userID);
|
||
$user = Model('User')->getInfoFull($userID);
|
||
Session::set('kodUser', $user);
|
||
}
|
||
|
||
//前端（及app）找回密码
|
||
public function findPassword(){
|
||
return Action('user.setting')->findPassword();
|
||
}
|
||
|
||
/**
|
||
* app端请求
|
||
*/
|
||
private function findPwdWidthApp(){
|
||
// api，直接填写手机/邮箱验证码、密码进行修改
|
||
$data = Input::getArray(array(
|
||
'type' => array('check' => 'in','default'=>'','param'=>array('phone','email')),
|
||
'input' => array('check' => 'require'),
|
||
'code' => array('check' => 'require'),
|
||
'password' => array('check' => 'require'),
|
||
));
|
||
$param = array(
|
||
'type' => 'regist',
|
||
'input' => $data['input']
|
||
);
|
||
Action('user.setting')->checkMsgCode($data['type'], $data['code'], $param);
|
||
$user = Model('User')->where(array($data['type'] => $data['input']))->find();
|
||
if (empty($user)) {
|
||
show_json(LNG('user.notBind'), false);
|
||
}
|
||
if (!Model('User')->userEdit($user['userID'], array('password' => $data['password']))) {
|
||
show_json(LNG('explorer.error'), false);
|
||
}
|
||
show_json(LNG('explorer.success'));
|
||
}
|
||
|
||
public function loginSuccess($user) {
|
||
// 登录管控
|
||
$result = Hook::trigger('user.index.loginBefore',$user);
|
||
if($result !== true) {
|
||
show_tips($this->loginErrMsg($result), APP_HOST);exit;
|
||
}
|
||
Hook::trigger('user.index.loginAfter',$user);
|
||
|
||
Session::set('kodUser', $user);
|
||
Cookie::set('kodUserID', $user['userID']);
|
||
Cookie::set('kodTokenUpdate','1');//更新token通知;//自动登录处理;
|
||
$kodToken = Cookie::get('kodToken');
|
||
if($kodToken){//已存在则延期
|
||
Cookie::setSafe('kodToken',$kodToken);
|
||
}
|
||
if (!empty($this->in['rememberPassword'])) {
|
||
$kodToken = $this->makeLoginToken($user['userID']);
|
||
Cookie::setSafe('kodToken',$kodToken);
|
||
}
|
||
$this->userDataInit($user);
|
||
Hook::trigger("user.loginSuccess",$user);
|
||
}
|
||
// 登录时模糊提示消息
|
||
private function loginErrMsg($code){
|
||
if (in_array($code, array('-1','-2'))) {
|
||
return LNG('user.pwdError');
|
||
}
|
||
$error = UserModel::errorLang($code);
|
||
return $error ? $error : LNG('user.pwdError');
|
||
}
|
||
|
||
/**
|
||
* 以当前用户身份临时授权访问接口请求构造
|
||
*
|
||
* 安全性: 不泄露 accessToken;
|
||
* 只能访问特定接口特定参数
|
||
* 一定时间内访问有效
|
||
*
|
||
* 可以按应用授权;维护{appKey:appSecret,...};
|
||
* 注:完全以当前身份访问, 权限以当前用户为准;
|
||
*/
|
||
public function apiSignMake($action,$args,$timeout=false,$appKey='',$uriIndex=false){
|
||
$appSecret = $this->appKeySecret($appKey);
|
||
if(!$appSecret || !USER_ID){ // 外链分享等情况
|
||
return APP_HOST.'index.php?'.$action.'&'.http_build_query($args);
|
||
}
|
||
|
||
$userID = Session::get('kodUser.userID');
|
||
$timeout = $timeout ? $timeout : 3600*24*3;
|
||
$param = '';
|
||
$keyList = array(strtolower($action));
|
||
$signArr = array(strtolower($action),$appSecret);
|
||
foreach($args as $key=>$val){
|
||
$keyList[] = strtolower($key);
|
||
$signArr[] = strtolower($key).'='.base64_encode($val);
|
||
$param .= $key.'='.rawurlencode($val).'&';
|
||
}
|
||
$signToken = md5(implode(';',$signArr));//解密时获取
|
||
$acionKey = hash_encode(implode(';',$keyList));
|
||
$actionToken = Mcrypt::encode(USER_ID,$signToken,0,md5($appSecret)); // 避免url变化,无法缓存问题;
|
||
$param .= 'actionToken='.$actionToken.'&actionKey='.$acionKey;
|
||
// 包含index.php; (跨域时浏览器请求options, 避免被nginx拦截提前处理)
|
||
if($uriIndex){return APP_HOST.'index.php?'.$action.'&'.$param;}
|
||
return urlApi($action,$param);
|
||
}
|
||
|
||
// 解析处理;
|
||
public function apiSignCheck(){
|
||
if(isset($_REQUEST['accessToken']) && $_REQUEST['accessToken']){return;} // token优先;
|
||
$actionToken = _get($this->in, 'actionToken', '');
|
||
$actionKey = _get($this->in, 'actionKey', '');
|
||
$appKey = _get($this->in, 'appKey', '');
|
||
$appSecret = $this->appKeySecret($appKey);
|
||
if(!$actionToken || !$actionKey || !$appSecret) return;
|
||
if(strlen($actionToken) > 500) return;
|
||
|
||
$action = str_replace('.','/',ACTION);
|
||
$keyList = explode(';',hash_decode($actionKey));
|
||
$signArr = array(strtolower($action),$appSecret);
|
||
if(strtolower($action) != $signArr[0]) return;
|
||
for ($i = 1; $i < count($keyList); $i++) {
|
||
$key = $keyList[$i];
|
||
$signArr[] = strtolower($key).'='.base64_encode($this->in[$key]);
|
||
}
|
||
$signToken = md5(implode(';',$signArr));//同上加密计算
|
||
$userID = Mcrypt::decode($actionToken,$signToken);
|
||
|
||
allowCROS();Cookie::disable(true);
|
||
// 当前为自己则默认使用当前session(是否登录保险箱等session共享;)
|
||
if($userID && Session::get('kodUser.userID') == $userID){return;}
|
||
$userInfo = $userID ? Model('User')->getInfoFull($userID):false;
|
||
if(!is_array($userInfo)) {show_json(LNG("explorer.systemError").'.[apiSignCheck]',false);};
|
||
|
||
// api临时访问接口; 不处理cookie; 不影响已登录用户session; 允许跨域
|
||
Session::$sessionSign = guid();
|
||
Session::set('kodUser', $userInfo);
|
||
unset($_REQUEST['accessToken']);
|
||
}
|
||
// 维护多个应用
|
||
public function appKeySecret($appKey=''){
|
||
if(!$appKey) return md5(Model('SystemOption')->get('systemPassword'));
|
||
$appList = Model('SystemOption')->get('appKeySecret');
|
||
if(!$appList || !is_array($appList[$appKey])) return '';
|
||
return $appList[$appKey]['appSecret'];
|
||
}
|
||
|
||
|
||
//登录token
|
||
private function makeLoginToken($userID) {
|
||
$pass = Model('SystemOption')->get('systemPassword');
|
||
$user = Model('User')->getInfo($userID);
|
||
if(!$user) return false;
|
||
return md5($user['password'] . $pass . $userID);
|
||
}
|
||
|
||
// 系统维护中
|
||
public function maintenance($update=false,$value=0){
|
||
// Model('SystemOption')->set('maintenance',0);exit;
|
||
if($update) return Model('SystemOption')->set('maintenance', $value);
|
||
// 管理员or未启动维护，返回
|
||
if(KodUser::isRoot() || !Model('SystemOption')->get('maintenance')) return;
|
||
show_tips(LNG('common.maintenanceTips'), '','',LNG('common.tips'));
|
||
}
|
||
}
|