1: <?php
2: /**
3: * CWebUser class file
4: *
5: * @author Qiang Xue <qiang.xue@gmail.com>
6: * @link http://www.yiiframework.com/
7: * @copyright 2008-2013 Yii Software LLC
8: * @license http://www.yiiframework.com/license/
9: */
10:
11: /**
12: * CWebUser represents the persistent state for a Web application user.
13: *
14: * CWebUser is used as an application component whose ID is 'user'.
15: * Therefore, at any place one can access the user state via
16: * <code>Yii::app()->user</code>.
17: *
18: * CWebUser should be used together with an {@link IUserIdentity identity}
19: * which implements the actual authentication algorithm.
20: *
21: * A typical authentication process using CWebUser is as follows:
22: * <ol>
23: * <li>The user provides information needed for authentication.</li>
24: * <li>An {@link IUserIdentity identity instance} is created with the user-provided information.</li>
25: * <li>Call {@link IUserIdentity::authenticate} to check if the identity is valid.</li>
26: * <li>If valid, call {@link CWebUser::login} to login the user, and
27: * Redirect the user browser to {@link returnUrl}.</li>
28: * <li>If not valid, retrieve the error code or message from the identity
29: * instance and display it.</li>
30: * </ol>
31: *
32: * The property {@link id} and {@link name} are both identifiers
33: * for the user. The former is mainly used internally (e.g. primary key), while
34: * the latter is for display purpose (e.g. username). The {@link id} property
35: * is a unique identifier for a user that is persistent
36: * during the whole user session. It can be a username, or something else,
37: * depending on the implementation of the {@link IUserIdentity identity class}.
38: *
39: * Both {@link id} and {@link name} are persistent during the user session.
40: * Besides, an identity may have additional persistent data which can
41: * be accessed by calling {@link getState}.
42: * Note, when {@link allowAutoLogin cookie-based authentication} is enabled,
43: * all these persistent data will be stored in cookie. Therefore, do not
44: * store password or other sensitive data in the persistent storage. Instead,
45: * you should store them directly in session on the server side if needed.
46: *
47: * @property boolean $isGuest Whether the current application user is a guest.
48: * @property mixed $id The unique identifier for the user. If null, it means the user is a guest.
49: * @property string $name The user name. If the user is not logged in, this will be {@link guestName}.
50: * @property string $returnUrl The URL that the user should be redirected to after login.
51: * @property string $stateKeyPrefix A prefix for the name of the session variables storing user session data.
52: * @property array $flashes Flash messages (key => message).
53: *
54: * @author Qiang Xue <qiang.xue@gmail.com>
55: * @package system.web.auth
56: * @since 1.0
57: */
58: class CWebUser extends CApplicationComponent implements IWebUser
59: {
60: const FLASH_KEY_PREFIX='Yii.CWebUser.flash.';
61: const FLASH_COUNTERS='Yii.CWebUser.flashcounters';
62: const STATES_VAR='__states';
63: const AUTH_TIMEOUT_VAR='__timeout';
64: const AUTH_ABSOLUTE_TIMEOUT_VAR='__absolute_timeout';
65:
66: /**
67: * @var boolean whether to enable cookie-based login. Defaults to false.
68: */
69: public $allowAutoLogin=false;
70: /**
71: * @var string the name for a guest user. Defaults to 'Guest'.
72: * This is used by {@link getName} when the current user is a guest (not authenticated).
73: */
74: public $guestName='Guest';
75: /**
76: * @var string|array the URL for login. If using array, the first element should be
77: * the route to the login action, and the rest name-value pairs are GET parameters
78: * to construct the login URL (e.g. array('/site/login')). If this property is null,
79: * a 403 HTTP exception will be raised instead.
80: * @see CController::createUrl
81: */
82: public $loginUrl=array('/site/login');
83: /**
84: * @var array the property values (in name-value pairs) used to initialize the identity cookie.
85: * Any property of {@link CHttpCookie} may be initialized.
86: * This property is effective only when {@link allowAutoLogin} is true.
87: */
88: public $identityCookie;
89: /**
90: * @var integer timeout in seconds after which user is logged out if inactive.
91: * If this property is not set, the user will be logged out after the current session expires
92: * (c.f. {@link CHttpSession::timeout}).
93: * @since 1.1.7
94: */
95: public $authTimeout;
96: /**
97: * @var integer timeout in seconds after which user is logged out regardless of activity.
98: * @since 1.1.14
99: */
100: public $absoluteAuthTimeout;
101: /**
102: * @var boolean whether to automatically renew the identity cookie each time a page is requested.
103: * Defaults to false. This property is effective only when {@link allowAutoLogin} is true.
104: * When this is false, the identity cookie will expire after the specified duration since the user
105: * is initially logged in. When this is true, the identity cookie will expire after the specified duration
106: * since the user visits the site the last time.
107: * @see allowAutoLogin
108: * @since 1.1.0
109: */
110: public $autoRenewCookie=false;
111: /**
112: * @var boolean whether to automatically update the validity of flash messages.
113: * Defaults to true, meaning flash messages will be valid only in the current and the next requests.
114: * If this is set false, you will be responsible for ensuring a flash message is deleted after usage.
115: * (This can be achieved by calling {@link getFlash} with the 3rd parameter being true).
116: * @since 1.1.7
117: */
118: public $autoUpdateFlash=true;
119: /**
120: * @var string value that will be echoed in case that user session has expired during an ajax call.
121: * When a request is made and user session has expired, {@link loginRequired} redirects to {@link loginUrl} for login.
122: * If that happens during an ajax call, the complete HTML login page is returned as the result of that ajax call. That could be
123: * a problem if the ajax call expects the result to be a json array or a predefined string, as the login page is ignored in that case.
124: * To solve this, set this property to the desired return value.
125: *
126: * If this property is set, this value will be returned as the result of the ajax call in case that the user session has expired.
127: * @since 1.1.9
128: * @see loginRequired
129: */
130: public $loginRequiredAjaxResponse;
131:
132: private $_keyPrefix;
133: private $_access=array();
134:
135: /**
136: * PHP magic method.
137: * This method is overriden so that persistent states can be accessed like properties.
138: * @param string $name property name
139: * @return mixed property value
140: */
141: public function __get($name)
142: {
143: if($this->hasState($name))
144: return $this->getState($name);
145: else
146: return parent::__get($name);
147: }
148:
149: /**
150: * PHP magic method.
151: * This method is overriden so that persistent states can be set like properties.
152: * @param string $name property name
153: * @param mixed $value property value
154: */
155: public function __set($name,$value)
156: {
157: if($this->hasState($name))
158: $this->setState($name,$value);
159: else
160: parent::__set($name,$value);
161: }
162:
163: /**
164: * PHP magic method.
165: * This method is overriden so that persistent states can also be checked for null value.
166: * @param string $name property name
167: * @return boolean
168: */
169: public function __isset($name)
170: {
171: if($this->hasState($name))
172: return $this->getState($name)!==null;
173: else
174: return parent::__isset($name);
175: }
176:
177: /**
178: * PHP magic method.
179: * This method is overriden so that persistent states can also be unset.
180: * @param string $name property name
181: * @throws CException if the property is read only.
182: */
183: public function __unset($name)
184: {
185: if($this->hasState($name))
186: $this->setState($name,null);
187: else
188: parent::__unset($name);
189: }
190:
191: /**
192: * Initializes the application component.
193: * This method overrides the parent implementation by starting session,
194: * performing cookie-based authentication if enabled, and updating the flash variables.
195: */
196: public function init()
197: {
198: parent::init();
199: Yii::app()->getSession()->open();
200: if($this->getIsGuest() && $this->allowAutoLogin)
201: $this->restoreFromCookie();
202: elseif($this->autoRenewCookie && $this->allowAutoLogin)
203: $this->renewCookie();
204: if($this->autoUpdateFlash)
205: $this->updateFlash();
206:
207: $this->updateAuthStatus();
208: }
209:
210: /**
211: * Logs in a user.
212: *
213: * The user identity information will be saved in storage that is
214: * persistent during the user session. By default, the storage is simply
215: * the session storage. If the duration parameter is greater than 0,
216: * a cookie will be sent to prepare for cookie-based login in future.
217: *
218: * Note, you have to set {@link allowAutoLogin} to true
219: * if you want to allow user to be authenticated based on the cookie information.
220: *
221: * @param IUserIdentity $identity the user identity (which should already be authenticated)
222: * @param integer $duration number of seconds that the user can remain in logged-in status. Defaults to 0, meaning login till the user closes the browser.
223: * If greater than 0, cookie-based login will be used. In this case, {@link allowAutoLogin}
224: * must be set true, otherwise an exception will be thrown.
225: * @return boolean whether the user is logged in
226: */
227: public function login($identity,$duration=0)
228: {
229: $id=$identity->getId();
230: $states=$identity->getPersistentStates();
231: if($this->beforeLogin($id,$states,false))
232: {
233: $this->changeIdentity($id,$identity->getName(),$states);
234:
235: if($duration>0)
236: {
237: if($this->allowAutoLogin)
238: $this->saveToCookie($duration);
239: else
240: throw new CException(Yii::t('yii','{class}.allowAutoLogin must be set true in order to use cookie-based authentication.',
241: array('{class}'=>get_class($this))));
242: }
243:
244: if ($this->absoluteAuthTimeout)
245: $this->setState(self::AUTH_ABSOLUTE_TIMEOUT_VAR, time()+$this->absoluteAuthTimeout);
246: $this->afterLogin(false);
247: }
248: return !$this->getIsGuest();
249: }
250:
251: /**
252: * Logs out the current user.
253: * This will remove authentication-related session data.
254: * If the parameter is true, the whole session will be destroyed as well.
255: * @param boolean $destroySession whether to destroy the whole session. Defaults to true. If false,
256: * then {@link clearStates} will be called, which removes only the data stored via {@link setState}.
257: */
258: public function logout($destroySession=true)
259: {
260: if($this->beforeLogout())
261: {
262: if($this->allowAutoLogin)
263: {
264: Yii::app()->getRequest()->getCookies()->remove($this->getStateKeyPrefix());
265: if($this->identityCookie!==null)
266: {
267: $cookie=$this->createIdentityCookie($this->getStateKeyPrefix());
268: $cookie->value=null;
269: $cookie->expire=0;
270: Yii::app()->getRequest()->getCookies()->add($cookie->name,$cookie);
271: }
272: }
273: if($destroySession)
274: Yii::app()->getSession()->destroy();
275: else
276: $this->clearStates();
277: $this->_access=array();
278: $this->afterLogout();
279: }
280: }
281:
282: /**
283: * Returns a value indicating whether the user is a guest (not authenticated).
284: * @return boolean whether the current application user is a guest.
285: */
286: public function getIsGuest()
287: {
288: return $this->getState('__id')===null;
289: }
290:
291: /**
292: * Returns a value that uniquely represents the user.
293: * @return mixed the unique identifier for the user. If null, it means the user is a guest.
294: */
295: public function getId()
296: {
297: return $this->getState('__id');
298: }
299:
300: /**
301: * @param mixed $value the unique identifier for the user. If null, it means the user is a guest.
302: */
303: public function setId($value)
304: {
305: $this->setState('__id',$value);
306: }
307:
308: /**
309: * Returns the unique identifier for the user (e.g. username).
310: * This is the unique identifier that is mainly used for display purpose.
311: * @return string the user name. If the user is not logged in, this will be {@link guestName}.
312: */
313: public function getName()
314: {
315: if(($name=$this->getState('__name'))!==null)
316: return $name;
317: else
318: return $this->guestName;
319: }
320:
321: /**
322: * Sets the unique identifier for the user (e.g. username).
323: * @param string $value the user name.
324: * @see getName
325: */
326: public function setName($value)
327: {
328: $this->setState('__name',$value);
329: }
330:
331: /**
332: * Returns the URL that the user should be redirected to after successful login.
333: * This property is usually used by the login action. If the login is successful,
334: * the action should read this property and use it to redirect the user browser.
335: * @param string $defaultUrl the default return URL in case it was not set previously. If this is null,
336: * the application entry URL will be considered as the default return URL.
337: * @return string the URL that the user should be redirected to after login.
338: * @see loginRequired
339: */
340: public function getReturnUrl($defaultUrl=null)
341: {
342: if($defaultUrl===null)
343: {
344: $defaultReturnUrl=Yii::app()->getUrlManager()->showScriptName ? Yii::app()->getRequest()->getScriptUrl() : Yii::app()->getRequest()->getBaseUrl().'/';
345: }
346: else
347: {
348: $defaultReturnUrl=CHtml::normalizeUrl($defaultUrl);
349: }
350: return $this->getState('__returnUrl',$defaultReturnUrl);
351: }
352:
353: /**
354: * @param string $value the URL that the user should be redirected to after login.
355: */
356: public function setReturnUrl($value)
357: {
358: $this->setState('__returnUrl',$value);
359: }
360:
361: /**
362: * Redirects the user browser to the login page.
363: * Before the redirection, the current URL (if it's not an AJAX url) will be
364: * kept in {@link returnUrl} so that the user browser may be redirected back
365: * to the current page after successful login. Make sure you set {@link loginUrl}
366: * so that the user browser can be redirected to the specified login URL after
367: * calling this method.
368: * After calling this method, the current request processing will be terminated.
369: */
370: public function loginRequired()
371: {
372: $app=Yii::app();
373: $request=$app->getRequest();
374:
375: if(!$request->getIsAjaxRequest())
376: {
377: $this->setReturnUrl($request->getUrl());
378: if(($url=$this->loginUrl)!==null)
379: {
380: if(is_array($url))
381: {
382: $route=isset($url[0]) ? $url[0] : $app->defaultController;
383: $url=$app->createUrl($route,array_splice($url,1));
384: }
385: $request->redirect($url);
386: }
387: }
388: elseif(isset($this->loginRequiredAjaxResponse))
389: {
390: echo $this->loginRequiredAjaxResponse;
391: Yii::app()->end();
392: }
393:
394: throw new CHttpException(403,Yii::t('yii','Login Required'));
395: }
396:
397: /**
398: * This method is called before logging in a user.
399: * You may override this method to provide additional security check.
400: * For example, when the login is cookie-based, you may want to verify
401: * that the user ID together with a random token in the states can be found
402: * in the database. This will prevent hackers from faking arbitrary
403: * identity cookies even if they crack down the server private key.
404: * @param mixed $id the user ID. This is the same as returned by {@link getId()}.
405: * @param array $states a set of name-value pairs that are provided by the user identity.
406: * @param boolean $fromCookie whether the login is based on cookie
407: * @return boolean whether the user should be logged in
408: * @since 1.1.3
409: */
410: protected function beforeLogin($id,$states,$fromCookie)
411: {
412: return true;
413: }
414:
415: /**
416: * This method is called after the user is successfully logged in.
417: * You may override this method to do some postprocessing (e.g. log the user
418: * login IP and time; load the user permission information).
419: * @param boolean $fromCookie whether the login is based on cookie.
420: * @since 1.1.3
421: */
422: protected function afterLogin($fromCookie)
423: {
424: }
425:
426: /**
427: * This method is invoked when calling {@link logout} to log out a user.
428: * If this method return false, the logout action will be cancelled.
429: * You may override this method to provide additional check before
430: * logging out a user.
431: * @return boolean whether to log out the user
432: * @since 1.1.3
433: */
434: protected function beforeLogout()
435: {
436: return true;
437: }
438:
439: /**
440: * This method is invoked right after a user is logged out.
441: * You may override this method to do some extra cleanup work for the user.
442: * @since 1.1.3
443: */
444: protected function afterLogout()
445: {
446: }
447:
448: /**
449: * Populates the current user object with the information obtained from cookie.
450: * This method is used when automatic login ({@link allowAutoLogin}) is enabled.
451: * The user identity information is recovered from cookie.
452: * Sufficient security measures are used to prevent cookie data from being tampered.
453: * @see saveToCookie
454: */
455: protected function restoreFromCookie()
456: {
457: $app=Yii::app();
458: $request=$app->getRequest();
459: $cookie=$request->getCookies()->itemAt($this->getStateKeyPrefix());
460: if($cookie && !empty($cookie->value) && is_string($cookie->value) && ($data=$app->getSecurityManager()->validateData($cookie->value))!==false)
461: {
462: $data=@unserialize($data);
463: if(is_array($data) && isset($data[0],$data[1],$data[2],$data[3]))
464: {
465: list($id,$name,$duration,$states)=$data;
466: if($this->beforeLogin($id,$states,true))
467: {
468: $this->changeIdentity($id,$name,$states);
469: if($this->autoRenewCookie)
470: {
471: $this->saveToCookie($duration);
472: }
473: $this->afterLogin(true);
474: }
475: }
476: }
477: }
478:
479: /**
480: * Renews the identity cookie.
481: * This method will set the expiration time of the identity cookie to be the current time
482: * plus the originally specified cookie duration.
483: * @since 1.1.3
484: */
485: protected function renewCookie()
486: {
487: $request=Yii::app()->getRequest();
488: $cookies=$request->getCookies();
489: $cookie=$cookies->itemAt($this->getStateKeyPrefix());
490: if($cookie && !empty($cookie->value) && ($data=Yii::app()->getSecurityManager()->validateData($cookie->value))!==false)
491: {
492: $data=@unserialize($data);
493: if(is_array($data) && isset($data[0],$data[1],$data[2],$data[3]))
494: {
495: $this->saveToCookie($data[2]);
496: }
497: }
498: }
499:
500: /**
501: * Saves necessary user data into a cookie.
502: * This method is used when automatic login ({@link allowAutoLogin}) is enabled.
503: * This method saves user ID, username, other identity states and a validation key to cookie.
504: * These information are used to do authentication next time when user visits the application.
505: * @param integer $duration number of seconds that the user can remain in logged-in status. Defaults to 0, meaning login till the user closes the browser.
506: * @see restoreFromCookie
507: */
508: protected function saveToCookie($duration)
509: {
510: $app=Yii::app();
511: $cookie=$this->createIdentityCookie($this->getStateKeyPrefix());
512: $cookie->expire=time()+$duration;
513: $data=array(
514: $this->getId(),
515: $this->getName(),
516: $duration,
517: $this->saveIdentityStates(),
518: );
519: $cookie->value=$app->getSecurityManager()->hashData(serialize($data));
520: $app->getRequest()->getCookies()->add($cookie->name,$cookie);
521: }
522:
523: /**
524: * Creates a cookie to store identity information.
525: * @param string $name the cookie name
526: * @return CHttpCookie the cookie used to store identity information
527: */
528: protected function createIdentityCookie($name)
529: {
530: $cookie=new CHttpCookie($name,'');
531: if(is_array($this->identityCookie))
532: {
533: foreach($this->identityCookie as $name=>$value)
534: $cookie->$name=$value;
535: }
536: return $cookie;
537: }
538:
539: /**
540: * @return string a prefix for the name of the session variables storing user session data.
541: */
542: public function getStateKeyPrefix()
543: {
544: if($this->_keyPrefix!==null)
545: return $this->_keyPrefix;
546: else
547: return $this->_keyPrefix=md5('Yii.'.get_class($this).'.'.Yii::app()->getId());
548: }
549:
550: /**
551: * @param string $value a prefix for the name of the session variables storing user session data.
552: */
553: public function setStateKeyPrefix($value)
554: {
555: $this->_keyPrefix=$value;
556: }
557:
558: /**
559: * Returns the value of a variable that is stored in user session.
560: *
561: * This function is designed to be used by CWebUser descendant classes
562: * who want to store additional user information in user session.
563: * A variable, if stored in user session using {@link setState} can be
564: * retrieved back using this function.
565: *
566: * @param string $key variable name
567: * @param mixed $defaultValue default value
568: * @return mixed the value of the variable. If it doesn't exist in the session,
569: * the provided default value will be returned
570: * @see setState
571: */
572: public function getState($key,$defaultValue=null)
573: {
574: $key=$this->getStateKeyPrefix().$key;
575: return isset($_SESSION[$key]) ? $_SESSION[$key] : $defaultValue;
576: }
577:
578: /**
579: * Stores a variable in user session.
580: *
581: * This function is designed to be used by CWebUser descendant classes
582: * who want to store additional user information in user session.
583: * By storing a variable using this function, the variable may be retrieved
584: * back later using {@link getState}. The variable will be persistent
585: * across page requests during a user session.
586: *
587: * @param string $key variable name
588: * @param mixed $value variable value
589: * @param mixed $defaultValue default value. If $value===$defaultValue, the variable will be
590: * removed from the session
591: * @see getState
592: */
593: public function setState($key,$value,$defaultValue=null)
594: {
595: $key=$this->getStateKeyPrefix().$key;
596: if($value===$defaultValue)
597: unset($_SESSION[$key]);
598: else
599: $_SESSION[$key]=$value;
600: }
601:
602: /**
603: * Returns a value indicating whether there is a state of the specified name.
604: * @param string $key state name
605: * @return boolean whether there is a state of the specified name.
606: */
607: public function hasState($key)
608: {
609: $key=$this->getStateKeyPrefix().$key;
610: return isset($_SESSION[$key]);
611: }
612:
613: /**
614: * Clears all user identity information from persistent storage.
615: * This will remove the data stored via {@link setState}.
616: */
617: public function clearStates()
618: {
619: $keys=array_keys($_SESSION);
620: $prefix=$this->getStateKeyPrefix();
621: $n=strlen($prefix);
622: foreach($keys as $key)
623: {
624: if(!strncmp($key,$prefix,$n))
625: unset($_SESSION[$key]);
626: }
627: }
628:
629: /**
630: * Returns all flash messages.
631: * This method is similar to {@link getFlash} except that it returns all
632: * currently available flash messages.
633: * @param boolean $delete whether to delete the flash messages after calling this method.
634: * @return array flash messages (key => message).
635: * @since 1.1.3
636: */
637: public function getFlashes($delete=true)
638: {
639: $flashes=array();
640: $prefix=$this->getStateKeyPrefix().self::FLASH_KEY_PREFIX;
641: $keys=array_keys($_SESSION);
642: $n=strlen($prefix);
643: foreach($keys as $key)
644: {
645: if(!strncmp($key,$prefix,$n))
646: {
647: $flashes[substr($key,$n)]=$_SESSION[$key];
648: if($delete)
649: unset($_SESSION[$key]);
650: }
651: }
652: if($delete)
653: $this->setState(self::FLASH_COUNTERS,array());
654: return $flashes;
655: }
656:
657: /**
658: * Returns a flash message.
659: * A flash message is available only in the current and the next requests.
660: * @param string $key key identifying the flash message
661: * @param mixed $defaultValue value to be returned if the flash message is not available.
662: * @param boolean $delete whether to delete this flash message after accessing it.
663: * Defaults to true.
664: * @return mixed the message message
665: */
666: public function getFlash($key,$defaultValue=null,$delete=true)
667: {
668: $value=$this->getState(self::FLASH_KEY_PREFIX.$key,$defaultValue);
669: if($delete)
670: $this->setFlash($key,null);
671: return $value;
672: }
673:
674: /**
675: * Stores a flash message.
676: * A flash message is available only in the current and the next requests.
677: * @param string $key key identifying the flash message
678: * @param mixed $value flash message
679: * @param mixed $defaultValue if this value is the same as the flash message, the flash message
680: * will be removed. (Therefore, you can use setFlash('key',null) to remove a flash message.)
681: */
682: public function setFlash($key,$value,$defaultValue=null)
683: {
684: $this->setState(self::FLASH_KEY_PREFIX.$key,$value,$defaultValue);
685: $counters=$this->getState(self::FLASH_COUNTERS,array());
686: if($value===$defaultValue)
687: unset($counters[$key]);
688: else
689: $counters[$key]=0;
690: $this->setState(self::FLASH_COUNTERS,$counters,array());
691: }
692:
693: /**
694: * @param string $key key identifying the flash message
695: * @return boolean whether the specified flash message exists
696: */
697: public function hasFlash($key)
698: {
699: return $this->getFlash($key, null, false)!==null;
700: }
701:
702: /**
703: * Changes the current user with the specified identity information.
704: * This method is called by {@link login} and {@link restoreFromCookie}
705: * when the current user needs to be populated with the corresponding
706: * identity information. Derived classes may override this method
707: * by retrieving additional user-related information. Make sure the
708: * parent implementation is called first.
709: * @param mixed $id a unique identifier for the user
710: * @param string $name the display name for the user
711: * @param array $states identity states
712: */
713: protected function changeIdentity($id,$name,$states)
714: {
715: Yii::app()->getSession()->regenerateID(true);
716: $this->setId($id);
717: $this->setName($name);
718: $this->loadIdentityStates($states);
719: }
720:
721: /**
722: * Retrieves identity states from persistent storage and saves them as an array.
723: * @return array the identity states
724: */
725: protected function saveIdentityStates()
726: {
727: $states=array();
728: foreach($this->getState(self::STATES_VAR,array()) as $name=>$dummy)
729: $states[$name]=$this->getState($name);
730: return $states;
731: }
732:
733: /**
734: * Loads identity states from an array and saves them to persistent storage.
735: * @param array $states the identity states
736: */
737: protected function loadIdentityStates($states)
738: {
739: $names=array();
740: if(is_array($states))
741: {
742: foreach($states as $name=>$value)
743: {
744: $this->setState($name,$value);
745: $names[$name]=true;
746: }
747: }
748: $this->setState(self::STATES_VAR,$names);
749: }
750:
751: /**
752: * Updates the internal counters for flash messages.
753: * This method is internally used by {@link CWebApplication}
754: * to maintain the availability of flash messages.
755: */
756: protected function updateFlash()
757: {
758: $counters=$this->getState(self::FLASH_COUNTERS);
759: if(!is_array($counters))
760: return;
761: foreach($counters as $key=>$count)
762: {
763: if($count)
764: {
765: unset($counters[$key]);
766: $this->setState(self::FLASH_KEY_PREFIX.$key,null);
767: }
768: else
769: $counters[$key]++;
770: }
771: $this->setState(self::FLASH_COUNTERS,$counters,array());
772: }
773:
774: /**
775: * Updates the authentication status according to {@link authTimeout}.
776: * If the user has been inactive for {@link authTimeout} seconds, or {link absoluteAuthTimeout} has passed,
777: * he will be automatically logged out.
778: * @since 1.1.7
779: */
780: protected function updateAuthStatus()
781: {
782: if(($this->authTimeout!==null || $this->absoluteAuthTimeout!==null) && !$this->getIsGuest())
783: {
784: $expires=$this->getState(self::AUTH_TIMEOUT_VAR);
785: $expiresAbsolute=$this->getState(self::AUTH_ABSOLUTE_TIMEOUT_VAR);
786:
787: if ($expires!==null && $expires < time() || $expiresAbsolute!==null && $expiresAbsolute < time())
788: $this->logout(false);
789: else
790: $this->setState(self::AUTH_TIMEOUT_VAR,time()+$this->authTimeout);
791: }
792: }
793:
794: /**
795: * Performs access check for this user.
796: * @param string $operation the name of the operation that need access check.
797: * @param array $params name-value pairs that would be passed to business rules associated
798: * with the tasks and roles assigned to the user.
799: * Since version 1.1.11 a param with name 'userId' is added to this array, which holds the value of
800: * {@link getId()} when {@link CDbAuthManager} or {@link CPhpAuthManager} is used.
801: * @param boolean $allowCaching whether to allow caching the result of access check.
802: * When this parameter
803: * is true (default), if the access check of an operation was performed before,
804: * its result will be directly returned when calling this method to check the same operation.
805: * If this parameter is false, this method will always call {@link CAuthManager::checkAccess}
806: * to obtain the up-to-date access result. Note that this caching is effective
807: * only within the same request and only works when <code>$params=array()</code>.
808: * @return boolean whether the operations can be performed by this user.
809: */
810: public function checkAccess($operation,$params=array(),$allowCaching=true)
811: {
812: if($allowCaching && $params===array() && isset($this->_access[$operation]))
813: return $this->_access[$operation];
814:
815: $access=Yii::app()->getAuthManager()->checkAccess($operation,$this->getId(),$params);
816: if($allowCaching && $params===array())
817: $this->_access[$operation]=$access;
818:
819: return $access;
820: }
821: }
822: