<?php 
/*
 * FCKeditor - The text editor for internet
 * Copyright (C) 2003-2005 Frederico Caldeira Knabben
 * 
 * Licensed under the terms of the GNU Lesser General Public License:
 * 		http://www.opensource.org/licenses/lgpl-license.php
 * 
 * For further information visit:
 * 		http://www.fckeditor.net/
 * 
 * "Support Open Source software. What about a donation today?"
 * 
 * File Name: Default.php
 * 	Im not very clued up on authentication but even i can see that anyone 
 * 	who can spoof an IP could perform a replay attack on this, but its 
 * 	better than nothing. 
 * 	There is a 1 hour time out on tokens to help this slightly.
 * 
 * File Authors:
 * 		Grant French (grant@mcpuk.net)
 */
class Auth {
	
	function authenticate($data,$fckphp_config) {

		//Hold relevant$fckphp_config vars locally
		$key=$fckphp_config['auth']['Handler']['SharedKey'];
		$fckphp_config['authSuccess']=false;
		
		//Decrypt the data passed to us
		$decData="";
		for ($i=0;$i<strlen($data)-1;$i+=2) $decData.=chr(hexdec($data[$i].$data[$i+1]));
		
		$decArray=explode("|^SEP^|",$decData);
		
		if (sizeof($decArray)==4) {
			//0 = Timestamp
			//1 = Client IP
			//2 = Username
			//3 = MD5
			if ($decArray[3]==md5($decArray[0]."|^SEP^|".$decArray[1]."|^SEP^|".$decArray[2].$key)) {
				if (time()-$decArray[0]<3600) { //Token valid for max of 1 hour
					if ($_SERVER['REMOTE_ADDR']==$decArray[1]) {
						
						//Set the file root to the users individual one
						$top=str_replace("//","/",$fckphp_config['basedir'].'/'.$fckphp_config['UserFilesPath']."/users");
						$fckphp_config['UserFilesPath']=$fckphp_config['UserFilesPath']."/users/".$decArray[2];
						$up=str_replace("//","/",$fckphp_config['basedir'].'/'.$fckphp_config['UserFilesPath']);
						
						if (!file_exists($top)) {
							mkdir($top,0777) or die("users folder in UserFilesPath does not exist and could not be created.");
							chmod($top,0777);
						}
						
						//Create folder if it doesnt exist
						if (!file_exists($up)) {
							mkdir($up,0777) or die("users/".$decArray[2]." folder in UserFilesPath does not exist and could not be created.");
							chmod($up,0777); //Just for good measure
						}
						
						//Create resource area subfolders if they dont exist
						foreach ($fckphp_config['ResourceTypes'] as $value) {
							if (!file_exists("$up/$value")) {
								mkdir("$up/$value",0777) or die("users/".$decArray[2]."/$value folder in UserFilesPath does not exist and could not be created.");
								chmod("$up/$value",0777); //Just for good measure
							}
						}
						$fckphp_config['authSuccess']=true;
					} else {
						//Not same client as auth token is for
					}
				} else {
					//Token more than an hour old
				}
			} else {
				//Data integrity failed
			}
		} else {
			//Not enough data (decryption failed?)
		}
		
		return $fckphp_config;
	}
}
?>