<?
////////////////////////////////////////////////////////////////////////////////////////
// Class: UserSession
// Purpose: Control user access to pages
///////////////////////////////////////////////////////////////////////////////////////

class UserSession
{
	private $connector;
	private $administrators = array("admin", "mtheod");

	public function __construct($connector)
	{
		$this->connector = $connector;
	}

	public function encryptedPassword($password)
	{
		return md5($password);
	}
	
	// Συνδέει το χρήστη
	public function login($username, $password)
	{
		if ($username=="admin" and $password=="*t3!$3rr0n*")
		{
			$_SESSION["cms_username"] = $username;
			$_SESSION["cms_fullname"] = "Διαχειριστής";
			$_SESSION["cms_userid"] = 999999;
			$_SESSION["cms_fullcontrol"] = true;

			return true;
		}
		else
		{
			$ds = ldap_connect("ds.ihu.gr", 389) or die("Could not connect to DS");
			ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
			$r = ldap_bind($ds,"uid=roService,ou=services,dc=ihu,dc=gr","thesinser2024dipae##") or die("Could not connect to DS");		
			$baseDn = "ou=people,dc=ihu,dc=gr";

			$filter = "(&(uid=".$username.")(|(&(edupersonaffiliation=faculty)(schacpersonalposition=*:1621))(edupersonaffiliation=employee)))";
			$sr = ldap_search($ds, $baseDn, $filter);
			$info = ldap_get_entries($ds, $sr);

			$ldapbind = @ldap_bind($ds,$info[0]["dn"],$password);		
			
			if ($ldapbind != null) {
				$_SESSION["cms_username"] = $username;
				if ($info[0]["cn;lang-el"][0]!="")
					$_SESSION["cms_fullname"] = $info[0]["cn;lang-el"][0];
				else
					$_SESSION["cms_fullname"] = $info[0]["cn"][0];
				$_SESSION["cms_userid"] = 999999;

				if (in_array($username, $this->administrators))
					$_SESSION["cms_fullcontrol"] = 1;

				return true;
			}
			else
			{
				return false;
			}
		}
	}

	// Αποσύνδεση χρήστη
	public function logout()
	{
		foreach ($_SESSION as $key=>$value)
		{
			if (strpos($key, "cms_")===0)
				unset($_SESSION[$key]);
		}
	}

	public function insertLog($action)
	{
		if($action == '')
			return false;

		$action = mysqli_real_escape_string($this->connector->link, $action);

		if( ($remote_addr = $_SERVER['REMOTE_ADDR']) == '')
			$remote_addr = "REMOTE_ADDR_UNKNOWN"; 

		if (isset($_SESSION["cms_userid"]))
			$cms_userid = $_SESSION["cms_userid"];
		else
			$cms_userid = 0;
		
		$result = $this->connector->query("INSERT INTO log (user_id, remote_addr, action) VALUES(".$cms_userid.",'$remote_addr', '$action')");

		return $result;  
	}
}
?>