class.ilWebAccessChecker.php

Go to the documentation of this file.

<?php
require_once('./Services/WebAccessChecker/classes/class.ilWACSignedPath.php');
require_once('./Services/WebAccessChecker/classes/class.ilWACPath.php');
require_once('./Services/WebAccessChecker/classes/class.ilWACSecurePath.php');
require_once('./Services/WebAccessChecker/classes/class.ilWACLog.php');
require_once('./Services/Init/classes/class.ilInitialisation.php');
require_once('./Services/FileDelivery/classes/class.ilFileDelivery.php');
require_once('./Services/WebAccessChecker/classes/class.ilWACCookie.php');
require_once('./Services/WebAccessChecker/classes/class.ilWACHeader.php');

class ilWebAccessChecker {

        const DISPOSITION = 'disposition';
        const STATUS_CODE = 'status_code';
        const REVALIDATE = 'revalidate';
        const CM_FILE_TOKEN = 1;
        const CM_FOLDER_TOKEN = 2;
        const CM_CHECKINGINSTANCE = 3;
        const CM_SECFOLDER = 4;
        protected $path_object = null;
        protected $checked = false;
        protected $disposition = ilFileDelivery::DISP_INLINE;
        protected $override_mimetype = '';
        protected $send_status_code = false;
        protected $initialized = false;
        protected $revalidate_folder_tokens = true;
        protected static $DEBUG = false;
        protected static $use_seperate_logfile = false;
        protected $cookie = null;
        protected $header = null;
        protected $applied_checking_methods = array();


        public function __construct($path, ilWACCookieInterface $ilWACCookieInterface = null, ilWACHeaderInterface $ilWACHeaderInterface = null) {
                $this->setPathObject(new ilWACPath($path));
                $this->setCookie($ilWACCookieInterface ? $ilWACCookieInterface : new ilWACCookie());
                $this->setHeader($ilWACHeaderInterface ? $ilWACHeaderInterface : new ilWACHeader());
        }


        public function check() {
                ilWACLog::getInstance()->write('Checking File: ' . $this->getPathObject()->getPathWithoutQuery());
                if (!$this->getPathObject()) {
                        throw new ilWACException(ilWACException::CODE_NO_PATH);
                }

                // Check if Path has been signed with a token
                $ilWACSignedPath = new ilWACSignedPath($this->getPathObject(), $this->cookie);
                if ($ilWACSignedPath->isSignedPath()) {
                        $this->addAppliedCheckingMethod(self::CM_FILE_TOKEN);
                        if ($ilWACSignedPath->isSignedPathValid()) {
                                $this->setChecked(true);
                                ilWACLog::getInstance()->write('checked using token');
                                $this->sendHeader('checked using token');

                                return true;
                        }
                }

                // Check if the whole secured folder has been signed
                if ($ilWACSignedPath->isFolderSigned()) {
                        $this->addAppliedCheckingMethod(self::CM_FOLDER_TOKEN);
                        if ($ilWACSignedPath->isFolderTokenValid()) {
                                if ($this->isRevalidateFolderTokens()) {
                                        $ilWACSignedPath->revalidatingFolderToken();
                                }
                                $this->setChecked(true);
                                ilWACLog::getInstance()->write('checked using secure folder');
                                $this->sendHeader('checked using secure folder');

                                return true;
                        }
                }

                // Fallback, have to initiate ILIAS
                $this->initILIAS();

                // Maybe the path has been registered, lets check
                $checkingInstance = ilWACSecurePath::getCheckingInstance($this->getPathObject());
                if ($checkingInstance instanceof ilWACCheckingClass) {
                        $this->addAppliedCheckingMethod(self::CM_CHECKINGINSTANCE);
                        ilWACLog::getInstance()->write('has checking instance: ' . get_class($checkingInstance));
                        $canBeDelivered = $checkingInstance->canBeDelivered($this->getPathObject());
                        if ($canBeDelivered) {
                                ilWACLog::getInstance()->write('checked using fallback');
                                $this->sendHeader('checked using fallback');
                                if ($ilWACSignedPath->isFolderSigned() && $this->isRevalidateFolderTokens()) {
                                        $ilWACSignedPath->revalidatingFolderToken();
                                }

                                $this->setChecked(true);

                                return true;
                        } else {
                                ilWACLog::getInstance()->write('checking-instance denied access');
                                $this->setChecked(true);

                                return false;
                        }
                }

                // none of the checking mechanisms could have been applied. no access
                $this->setChecked(true);
                ilWACLog::getInstance()->write('none of the checking mechanisms could have been applied. access depending on sec folder');
                if ($this->getPathObject()->isInSecFolder()) {
                        $this->addAppliedCheckingMethod(self::CM_SECFOLDER);
                        ilWACLog::getInstance()->write('file is in sec-folder, no delivery');

                        return false;
                } else {
                        $this->addAppliedCheckingMethod(self::CM_SECFOLDER);
                        ilWACLog::getInstance()->write('file is not in sec-folder, delivery');

                        return true;
                }
        }


        protected function sendHeader($message) {
                $this->getHeader()->sendHeader('X-ILIAS-WebAccessChecker: ' . $message);
        }


        public function initILIAS() {
                if ($this->isInitialized()) {
                        return true;
                }
                $GLOBALS['COOKIE_PATH'] = '/';
                $this->cookie->set('ilClientId', $this->getPathObject()->getClient(), 0, '/');
                ilContext::init(ilContext::CONTEXT_WAC);
                try {
                        ilWACLog::getInstance()->write('init ILIAS');
                        ilInitialisation::initILIAS();
                        $this->checkUser();
                        $this->checkPublicSection();
                } catch (Exception $e) {
                        if ($e instanceof ilWACException
                            && $e->getCode() !== ilWACException::ACCESS_DENIED_NO_LOGIN) {
                                throw  $e;
                        }
                        if (($e instanceof Exception && $e->getMessage() == 'Authentication failed.')
                            || $e->getCode() === ilWACException::ACCESS_DENIED_NO_LOGIN) {
                                $this->initAnonymousSession();
                                $this->checkUser();
                                $this->checkPublicSection();
                        }
                }
                $this->setInitialized(true);
        }


        protected function checkPublicSection() {
                global $DIC;
                $not_on_login_page = $this->isRequestNotFromLoginPage();
                $is_anonymous = ((int)$DIC->user()->getId() === (int)ANONYMOUS_USER_ID);
                $is_null_user = ($DIC->user()->getId() === 0);
                $pub_section_activated = (bool)$DIC['ilSetting']->get('pub_section');
                $isset = isset($DIC['ilSetting']);
                $instanceof = $DIC['ilSetting'] instanceof ilSetting;
                if (!$isset || !$instanceof || (!$pub_section_activated && ($is_anonymous || ($is_null_user && $not_on_login_page)))) {
                        throw new ilWACException(ilWACException::ACCESS_DENIED_NO_PUB);
                }
        }


        protected function checkUser() {
                global $DIC;

                $is_user = $DIC->user() instanceof ilObjUser;
                $user_id_is_zero = ((int)$DIC->user()->getId() === 0);
                $not_on_login_page = $this->isRequestNotFromLoginPage();
                if (!$is_user || ($user_id_is_zero && $not_on_login_page)) {
                        throw new ilWACException(ilWACException::ACCESS_DENIED_NO_LOGIN);
                }
        }


        public function isChecked() {
                return $this->checked;
        }


        public function setChecked($checked) {
                $this->checked = $checked;
        }


        public function getPathObject() {
                return $this->path_object;
        }


        public function setPathObject($path_object) {
                $this->path_object = $path_object;
        }


        public function getDisposition() {
                return $this->disposition;
        }


        public function setDisposition($disposition) {
                $this->disposition = $disposition;
        }


        public function getOverrideMimetype() {
                return $this->override_mimetype;
        }


        public function setOverrideMimetype($override_mimetype) {
                $this->override_mimetype = $override_mimetype;
        }


        public function isInitialized() {
                return $this->initialized;
        }


        public function setInitialized($initialized) {
                $this->initialized = $initialized;
        }


        public function isSendStatusCode() {
                return $this->send_status_code;
        }


        public function setSendStatusCode($send_status_code) {
                $this->send_status_code = $send_status_code;
        }


        public function isRevalidateFolderTokens() {
                return $this->revalidate_folder_tokens;
        }


        public function setRevalidateFolderTokens($revalidate_folder_tokens) {
                $this->revalidate_folder_tokens = $revalidate_folder_tokens;
        }


        public static function isDEBUG() {
                return self::$DEBUG;
        }


        public static function setDEBUG($DEBUG) {
                self::$DEBUG = $DEBUG;
        }


        public static function isUseSeperateLogfile() {
                return self::$use_seperate_logfile;
        }


        public static function setUseSeperateLogfile($use_seperate_logfile) {
                self::$use_seperate_logfile = $use_seperate_logfile;
        }


        public function getCookie() {
                return $this->cookie;
        }


        public function setCookie($cookie) {
                $this->cookie = $cookie;
        }


        public function getAppliedCheckingMethods() {
                return $this->applied_checking_methods;
        }


        public function setAppliedCheckingMethods($applied_checking_methods) {
                $this->applied_checking_methods = $applied_checking_methods;
        }


        protected function addAppliedCheckingMethod($method) {
                $this->applied_checking_methods[] = $method;
        }


        public function getHeader() {
                return $this->header;
        }


        public function setHeader($header) {
                $this->header = $header;
        }


        protected function initAnonymousSession() {
                global $DIC;
                include_once './Services/Context/classes/class.ilContext.php';
                ilContext::init(ilContext::CONTEXT_WAC);
                require_once("Services/Init/classes/class.ilInitialisation.php");
                ilInitialisation::reinitILIAS();
                $ilAuthSession = $DIC['ilAuthSession'];
                $ilAuthSession->init();
                $ilAuthSession->regenerateId();
                $a_id = (int)ANONYMOUS_USER_ID;
                $ilAuthSession->setUserId($a_id);
                $ilAuthSession->setAuthenticated(false, $a_id);
                $DIC->user()->setId($a_id);
        }


        protected function isRequestNotFromLoginPage() {
                $referrer = !is_null($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
                $not_on_login_page = (strpos($referrer, 'login.php') === false
                                      && strpos($referrer, '&baseClass=ilStartUpGUI') === false);

                return $not_on_login_page;
        }
}