plugin.image.photostation/PhotoStation API/webapi/authutil.php

<?php

require_once('auth.inc.php');

class AuthAPIUtil {

    static function SYNOPHOTO_LOGIN_USERDATA_PARSER($pUser)
    {
        global $SYNOPHOTO_DSM_USER_INFO;
        $result = array();
        if (!is_array($pUser)) {
            return null;
        }
        $i = 0;
		$groups = array();
        foreach ($pUser as $item) {
			if (preg_match('/\((\d+)\)/', $item, $match)) {
				$groups[] = $match[1];
			}

            if (!preg_match('/(^\w+\s?\w+)\s*\:/', $item, $match) || !preg_match('/\[(.*)\]/', $item, $match_val)) {
                continue;
            }

            if (false !== $index = array_search($match[1], $SYNOPHOTO_DSM_USER_INFO)) { // $key = 2;
                $result[$index] = $match_val[1];
                $result[$SYNOPHOTO_DSM_USER_INFO[$index]] = $match_val[1];
            }
        }
		$result['groups'] = implode(',', $groups);
        return $result;
    }

    static function SYNOPHOTO_LOGIN_AddLog($username, $success)
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        $conf = csSYNOPhotoMisc::GetConfigFile(SYNO_CNF_FILE, 'enable_demomode');
        if ('yes' == $conf['enable_demomode']) {
            $ip = 'xxx.xxx.xxx.xxx';
        }

        if ($success) {
            PhotoLog::Add($username." logged in from "."[".$ip."].", true, strtolower($username));
            return;
        }
        PhotoLog::Add($username." failed to log in from "."[".$ip."].", false, strtolower($username));
    }

    /*
     *  return
     *    1 - success
     *    0 - fail
     */
    static function SYNOPHOTO_LOGIN_ValidateAdmin()
    {
        $user = ('root' == SYNOPHOTO_ADMIN_USER)? 'admin':SYNOPHOTO_ADMIN_NAME;
        $command = "/usr/syno/bin/synoauth ".escapeshellarg($user)." ".escapeshellarg($_REQUEST['password']);
        @exec($command, $pAuth, $retval);

        if (0 == $retval) {
            unset($_SESSION[SYNOPHOTO_ADMIN_USER]);
			csSYNOPhotoMisc::PhotoSessionStart();

            csSYNOPhotoDB::GetDBInstance()->SetSessionSystemConfigsFromFile();
            $_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user'] = SYNOPHOTO_ADMIN_PASS;
            self::SYNOPHOTO_LOGIN_AddLog($_REQUEST['username'], true);
            return 1;
        }
        self::SYNOPHOTO_LOGIN_AddLog($_REQUEST['username'], false);
        return 0;
    }

    /*
     *  return
     *    1 - success
     *    0 - fail
     *   -1 - disable user (Photo Station Account System)
     *   -2 - not photo station user (Photo Station Account System)
     *   -3 - guest account is not allowed to login (DSM Account System)
     */
    static function SYNOPHOTO_LOGIN_ValidateDsmUser()
    {
        if (!strcasecmp($_REQUEST['username'], 'guest')) {
            return -3;
        }
        $command = "/usr/syno/bin/synophoto_dsm_user --auth ".escapeshellarg($_REQUEST['username'])." ".escapeshellarg($_REQUEST['password']);
        @exec($command, $pAuth, $auth_retval);

        $user_info = array();
        if (0 == $auth_retval) {
            $command = "/usr/syno/bin/synophoto_dsm_user --getinfo ".escapeshellarg($_REQUEST['username']);
            @exec($command, $pUser, $retval);
            $user_info = self::SYNOPHOTO_LOGIN_USERDATA_PARSER($pUser);
        } else {
            self::SYNOPHOTO_LOGIN_AddLog($_REQUEST['username'], false);
            return 0;
        }

        if ($user_info) {
            unset($_SESSION[SYNOPHOTO_ADMIN_USER]);
			csSYNOPhotoMisc::PhotoSessionStart();

            csSYNOPhotoDB::GetDBInstance()->SetSessionSystemConfigsFromFile();
            $_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_userid'] = $user_info[2];
            $_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_user'] = $user_info[0];
            $_SESSION[SYNOPHOTO_ADMIN_USER]['use_dsm_account'] = true;
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = $user_info['groups'];

            if ($user_info[10]) {
                $_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user'] = SYNOPHOTO_ADMIN_PASS;
            }
            self::SYNOPHOTO_LOGIN_AddLog($_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_user'], true);
            return 1;
        }
        self::SYNOPHOTO_LOGIN_AddLog($_REQUEST['username'], false);
        return 0;
    }

    /*
     * return 
     *   1 - success
     *   0 - fail
     *  -1 - disable user (Photo Station Account System)
     *  -2 - not photo station user (Photo Station Account System)
     *  -3 - guest account is not allowed to login (DSM Account System)
     */
    static function SYNOPHOTO_LOGIN_ValidateUser()
    {
        $escape = PHOTO_DB_GetEscape();
        $query_usr = "Select count(*) from photo_user where lower(username) like ? $escape";
        $sqlParam = array(PHOTO_DB_EscapForLike(strtolower($_REQUEST['username'])));
        $count = PHOTO_DB_QueryCount($GLOBALS['dbconn_photo'], $query_usr, $sqlParam);

        if ($count == 0) {
            // user is not photo station user
            return -2;
        }

        $query = "Select * from photo_user where lower(username) like ? $escape and password = '".md5($_REQUEST['password'])."'";
        $sqlParam = array(PHOTO_DB_EscapForLike(strtolower($_REQUEST['username'])));
        $result = PHOTO_DB_Query($query, $sqlParam);

        $user_info = PHOTO_DB_FetchRow($result);
        if ($user_info) {
            if(PHOTO_DB_ConvertBool($user_info[4]) == 't') {
                //disabled
                return -1;
            }

            unset($_SESSION[SYNOPHOTO_ADMIN_USER]);
			csSYNOPhotoMisc::PhotoSessionStart();

            csSYNOPhotoDB::GetDBInstance()->SetSessionSystemConfigsFromFile();
            $_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_userid'] = $user_info[0];
            $_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_user'] = $user_info[1];
            $_SESSION[SYNOPHOTO_ADMIN_USER]['use_dsm_account'] = false;

			/* set user's belonging groups */
			$query = "SELECT groupid FROM " . PHOTO_USER_GROUP_TABLE . " WHERE userid = $user_info[0]";
			$db_result = PHOTO_DB_Query($query);
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = '';
			$groups = array();
			while ($row = PHOTO_DB_FetchRow($db_result)) {
				$groups[] = $row['groupid'];
			}
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = implode(',', $groups);

            if (PHOTO_DB_ConvertBool($user_info[6]) == 't') {
                $_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user'] = SYNOPHOTO_ADMIN_PASS;
            }
            self::SYNOPHOTO_LOGIN_AddLog($_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_user'], true);
            return 1;
        }
        self::SYNOPHOTO_LOGIN_AddLog($_REQUEST['username'], false);
        return 0;
    }

	static function SYNOPHOTO_LOGIN_UpdateUserSession($username) {
		if (null == $username) {
			return;
		}
		// PhotoStation User
		if ("0" == $_SESSION[SYNOPHOTO_ADMIN_USER]['photo_config']['global']['account_system'] || 'root' != SYNOPHOTO_ADMIN_USER){
			$isAdmin = 'f';
			$query = "SELECT userid, admin, disabled FROM photo_user WHERE username = ?";
			$db_result = PHOTO_DB_Query($query, array($username));
			while ($row = PHOTO_DB_FetchRow($db_result)) {
				if (PHOTO_DB_IsTrue($row['disabled'])) {
					unset($_SESSION[SYNOPHOTO_ADMIN_USER]);
					return false;
				}
				$userid = $row['userid'];
				$isAdmin = $row['admin'];
			}
			if('t' === PHOTO_DB_ConvertBool($isAdmin) || (('root' === SYNOPHOTO_ADMIN_USER) ? 'admin' : substr(SYNOPHOTO_ADMIN_USER, 1)) === $username) {
				$_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user'] = SYNOPHOTO_ADMIN_PASS;
			} else {
				unset($_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user']);
			}

			$query = "SELECT groupid FROM photo_user_group WHERE userid = ?";
			$db_result = PHOTO_DB_Query($query, array($userid));
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = '';
			$groups = array();
			while ($row = PHOTO_DB_FetchRow($db_result)) {
				$groups[] = $row['groupid'];
			}
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = implode(',', $groups);
		// DSM User
		} else {
			$command = "/usr/syno/bin/synophoto_dsm_user --getinfo ".escapeshellarg($username);
			@exec($command, $pUser, $retval);
			$user_info = self::SYNOPHOTO_LOGIN_USERDATA_PARSER($pUser);
			if (!$user_info || $user_info['Expired'] !== "false") {
				unset($_SESSION[SYNOPHOTO_ADMIN_USER]);
				return false;
			}
			$_SESSION[SYNOPHOTO_ADMIN_USER]['reg_syno_groupid'] = $user_info['groups'];
			if ($user_info[10]) {
				$_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user'] = SYNOPHOTO_ADMIN_PASS;
			} else {
				unset($_SESSION[SYNOPHOTO_ADMIN_USER]['admin_syno_user']);
			}
		}
	}
}

?>