PHP ca_users::load方法代码示例

 public static function authenticate($ps_username, $ps_password = '', $pa_options = null)
 {
     $t_user = new ca_users();
     $t_user->load($ps_username);
     if ($t_user->getPrimaryKey() > 0) {
         $vs_hash = $t_user->get('password');
         if (preg_match('/^[a-f0-9]{32}$/', $vs_hash)) {
             // old-style md5 passwords
             //throw new CaUsersException(_t('The stored password for this user seems to be in legacy format. Please update the user account by resetting the password.'));
             if (md5($ps_password) == $vs_hash) {
                 // if the md5 hash matches, authenticate successfully and move the user over to pbkdf2 key
                 $t_user->setMode(ACCESS_WRITE);
                 // ca_users::update takes care of the hashing by calling AuthenticationManager::updatePassword()
                 $t_user->set('password', $ps_password);
                 $t_user->update();
                 return true;
             } else {
                 return false;
             }
         }
         return validate_password($ps_password, $vs_hash);
     } else {
         return false;
     }
 }

 public function renderWidget($ps_widget_id, &$pa_settings)
 {
     parent::renderWidget($ps_widget_id, $pa_settings);
     $vn_threshold = time() - $pa_settings['logins_since'] * 60 * 60;
     $o_db = new Db();
     $qr_res = $o_db->query("\n\t\t\t\tSELECT e.code, e.message, e.date_time\n\t\t\t\tFROM ca_eventlog e\n\t\t\t\tWHERE\n\t\t\t\t\t(e.date_time >= ?) AND (e.code = 'LOGN')\n\t\t\t\tORDER BY\n\t\t\t\t\te.date_time DESC\n\t\t\t", $vn_threshold);
     $va_login_list = array();
     $t_user = new ca_users();
     $va_user_cache = array();
     while ($qr_res->nextRow()) {
         $va_log = $qr_res->getRow();
         $vs_message = $va_log['message'];
         $va_tmp = explode(';', $vs_message);
         $vs_username = '?';
         if (preg_match('!\'([^\']+)\'!', $va_tmp[0], $va_matches)) {
             $vs_username = $va_matches[1];
         }
         $va_log['username'] = $vs_username;
         if (!isset($va_user_cache[$vs_username])) {
             if ($t_user->load(array('user_name' => $vs_username))) {
                 $va_user_cache[$vs_username] = array('fname' => $t_user->get('fname'), 'lname' => $t_user->get('lname'), 'email' => $t_user->get('email'));
             } else {
                 $va_user_cache[$vs_username] = array('fname' => '?', 'lname' => '?', 'email' => '?');
             }
         }
         $va_log = array_merge($va_log, $va_user_cache[$vs_username]);
         $va_log['ip'] = str_replace('IP=', '', $va_tmp[1]);
         $va_login_list[] = $va_log;
     }
     $this->opo_view->setVar('request', $this->getRequest());
     $this->opo_view->setVar('login_list', $va_login_list);
     return $this->opo_view->render('main_html.php');
 }

 /**
  * Internal helper for loading user from user_name
  */
 private function _loadUser($user_name)
 {
     $t_user = new ca_users();
     if (!$t_user->load(array("user_name" => $user_name))) {
         throw new SoapFault("Server", "user_name does not exist");
     }
     $t_user->setMode(ACCESS_WRITE);
     return $t_user;
 }

 /**
  * Determines if user has access to a set at a specified access level.
  *
  * @param int $pn_user_id user_id of user to check set access for
  * @param int $pn_access type of access required. Use __CA_SET_READ_ACCESS__ for read-only access or __CA_SET_EDIT_ACCESS__ for editing (full) access
  * @param int $pn_set_id The id of the set to check. If omitted then currently loaded set will be checked.
  * @param array $pa_options No options yet
  * @return bool True if user has access, false if not
  */
 public function haveAccessToSet($pn_user_id, $pn_access, $pn_set_id = null, $pa_options = null)
 {
     if ($this->getAppConfig()->get('dont_enforce_access_control_for_ca_sets')) {
         return true;
     }
     if ($pn_set_id) {
         $vn_set_id = $pn_set_id;
         $t_set = new ca_sets($vn_set_id);
         $vn_set_user_id = $t_set->get('user_id');
     } else {
         $t_set = $this;
         $vn_set_user_id = $t_set->get('user_id');
     }
     if (!$vn_set_id && !($vn_set_id = $t_set->getPrimaryKey())) {
         return true;
         // new set
     }
     if ($t_set->get('deleted') != 0) {
         return false;
     }
     // set is deleted
     if (isset(ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access])) {
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access];
     }
     if ($vn_set_user_id == $pn_user_id) {
         // owners have all access
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = true;
     }
     if ($t_set->get('access') > 0 && $pn_access == __CA_SET_READ_ACCESS__) {
         // public sets are readable by all
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = true;
     }
     //
     // If user is admin or has set admin privs allow them access to the set
     //
     $t_user = new ca_users();
     if ($t_user->load($pn_user_id) && ($t_user->canDoAction('is_administrator') || $t_user->canDoAction('can_administrate_sets'))) {
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = true;
     }
     $o_db = $this->getDb();
     $qr_res = $o_db->query($vs_sql = "\n\t\t\tSELECT sxg.set_id \n\t\t\tFROM ca_sets_x_user_groups sxg \n\t\t\tINNER JOIN ca_user_groups AS ug ON sxg.group_id = ug.group_id\n\t\t\tINNER JOIN ca_users_x_groups AS uxg ON uxg.group_id = ug.group_id\n\t\t\tWHERE \n\t\t\t\t(sxg.access >= ?) AND (uxg.user_id = ?) AND (sxg.set_id = ?)\n\t\t\t\tAND\n\t\t\t\t(\n\t\t\t\t\t(sxg.sdatetime <= " . time() . " AND sxg.edatetime >= " . time() . ")\n\t\t\t\t\tOR\n\t\t\t\t\t(sxg.sdatetime IS NULL and sxg.edatetime IS NULL)\n\t\t\t\t)\n\t\t", (int) $pn_access, (int) $pn_user_id, (int) $vn_set_id);
     if ($qr_res->numRows() > 0) {
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = true;
     }
     $qr_res = $o_db->query("\n\t\t\tSELECT sxu.set_id \n\t\t\tFROM ca_sets_x_users sxu\n\t\t\tINNER JOIN ca_users AS u ON sxu.user_id = u.user_id\n\t\t\tWHERE \n\t\t\t\t(sxu.access >= ?) AND (u.user_id = ?) AND (sxu.set_id = ?)\n\t\t\t\tAND\n\t\t\t\t(\n\t\t\t\t\t(sxu.sdatetime <= " . time() . " AND sxu.edatetime >= " . time() . ")\n\t\t\t\t\tOR\n\t\t\t\t\tsxu.sdatetime IS NULL and sxu.edatetime IS NULL\n\t\t\t\t)\n\t\t", (int) $pn_access, (int) $pn_user_id, (int) $vn_set_id);
     if ($qr_res->numRows() > 0) {
         return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = true;
     }
     return ca_sets::$s_have_access_to_set_cache[$vn_set_id . '/' . $pn_user_id . '/' . $pn_access] = false;
 }

 /**
  * Returns list of screens for a given UI. 
  *
  * @param int $pn_type_id Optional type to restrict screens to
  * @param array $pa_options Options include:
  *		showAll = Include screens that do not have placements. Default is false.
  *		user_id = User_id to apply access control for
  *
  * @return array List of screens for this user interface
  */
 public function getScreens($pn_type_id = null, $pa_options = null)
 {
     if (!$this->getPrimaryKey()) {
         return false;
     }
     if (!($t_instance = $this->_DATAMODEL->getInstanceByTableNum($this->get('editor_type')))) {
         return null;
     }
     if ($t_instance instanceof BaseRelationshipModel) {
         $va_types = $t_instance->getRelationshipTypes();
     } else {
         $va_types = $t_instance->getTypeList();
     }
     $va_sql_params = array((int) $this->getPrimaryKey());
     $o_db = $this->getDb();
     $va_type_list = caMakeTypeIDList($this->get('editor_type'), array($pn_type_id), array('dontIncludeSubtypesInTypeRestriction' => true));
     if (!sizeof($va_type_list)) {
         $va_type_list = array($pn_type_id);
     }
     $vs_type_sql = (int) $pn_type_id ? "AND (ceustr.type_id IS NULL OR ceustr.type_id IN (" . join(",", $va_type_list) . "))" : '';
     $vs_access_sql = '';
     $t_user = new ca_users();
     if (($vn_user_id = caGetOption('user_id', $pa_options, null)) && $t_user->load($vn_user_id)) {
         $vs_access_sql = " AND ((ceus.screen_id IN \n\t\t\t\t\t(\n\t\t\t\t\t\tSELECT screen_id \n\t\t\t\t\t\tFROM ca_editor_ui_screens_x_users\n\t\t\t\t\t\tWHERE\n\t\t\t\t\t\t\tuser_id = ?\n\t\t\t\t\t)\n\t\t\t\t)";
         $va_sql_params[] = $vn_user_id;
         $va_groups = $t_user->getUserGroups();
         if (is_array($va_groups) && sizeof($va_groups)) {
             $vs_access_sql .= " OR (ceus.screen_id IN \n\t\t\t\t\t(\n\t\t\t\t\t\tSELECT screen_id \n\t\t\t\t\t\tFROM ca_editor_ui_screens_x_user_groups\n\t\t\t\t\t\tWHERE\n\t\t\t\t\t\t\tgroup_id IN (?)\n\t\t\t\t\t)\n\t\t\t\t)";
             $va_sql_params[] = array_keys($va_groups);
         }
         $va_roles = $t_user->getUserRoles();
         if (is_array($va_roles) && sizeof($va_roles)) {
             $vs_access_sql .= " OR (ceus.screen_id IN \n\t\t\t\t\t(\n\t\t\t\t\t\tSELECT screen_id \n\t\t\t\t\t\tFROM ca_editor_ui_screens_x_roles\n\t\t\t\t\t\tWHERE\n\t\t\t\t\t\t\trole_id IN (?)\n\t\t\t\t\t)\n\t\t\t\t)";
             $va_sql_params[] = array_keys($va_roles);
         }
         $vs_access_sql .= "\n\t\t\t\tOR (\n\t\t\t\t\tceus.screen_id NOT IN (\n\t\t\t\t\t\tSELECT screen_id FROM ca_editor_ui_screens_x_users\n\t\t\t\t\t)\n\t\t\t\t\tAND\n\t\t\t\t\tceus.screen_id NOT IN (\n\t\t\t\t\t\tSELECT screen_id FROM ca_editor_ui_screens_x_user_groups\n\t\t\t\t\t)\n\t\t\t\t\tAND\n\t\t\t\t\tceus.screen_id NOT IN (\n\t\t\t\t\t\tSELECT screen_id FROM ca_editor_ui_screens_x_roles\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t)";
     }
     $qr_res = $o_db->query("\n\t\t\tSELECT ceus.*, ceusl.*, ceustr.type_id restriction_type_id\n\t\t\tFROM ca_editor_ui_screens ceus\n\t\t\tINNER JOIN ca_editor_ui_screen_labels AS ceusl ON ceus.screen_id = ceusl.screen_id\n\t\t\tLEFT JOIN ca_editor_ui_screen_type_restrictions AS ceustr ON ceus.screen_id = ceustr.screen_id\n\t\t\tWHERE\n\t\t\t\t(ceus.ui_id = ?) {$vs_type_sql}\n\t\t\t\t{$vs_access_sql}\n\t\t\tORDER BY \n\t\t\t\tceus.rank, ceus.screen_id\n\t\t", $va_sql_params);
     $va_screens = array();
     while ($qr_res->nextRow()) {
         if (!$va_screens[$vn_screen_id = $qr_res->get('screen_id')][$vn_screen_locale_id = $qr_res->get('locale_id')]) {
             $va_screens[$vn_screen_id][$vn_screen_locale_id] = $qr_res->getRow();
             if ((bool) $va_screens[$vn_screen_id][$vn_screen_locale_id]['is_default']) {
                 $va_screens[$vn_screen_id][$vn_screen_locale_id]['isDefault'] = "◉";
             }
             $va_screens[$vn_screen_id][$vn_screen_locale_id]['numPlacements'] = sizeof($this->getScreenBundlePlacements($vn_screen_id));
         }
         if ($qr_res->get('restriction_type_id')) {
             $vs_key_to_add = $t_instance instanceof BaseRelationshipModel ? 'type_code' : 'name_plural';
             $va_screens[$vn_screen_id][$vn_screen_locale_id]['typeRestrictions'][$qr_res->get('restriction_type_id')] = $va_types[$qr_res->get('restriction_type_id')][$vs_key_to_add];
         }
     }
     $va_screens_with_bundles = null;
     if ((!isset($pa_options['showAll']) || !$pa_options['showAll']) && sizeof($va_screens)) {
         // Get placements for all screens, so we can filter screens without placements
         $qr_res = $o_db->query("\n\t\t\t\tSELECT screen_id, placement_id, bundle_name\n\t\t\t\tFROM ca_editor_ui_bundle_placements\n\t\t\t\tWHERE\n\t\t\t\t\tscreen_id IN (?)\n\t\t\t", array(array_keys($va_screens)));
         $vs_table = $t_instance->tableName();
         $va_screens_with_bundles = array();
         while ($qr_res->nextRow()) {
             $vn_screen_id = $qr_res->get('screen_id');
             if (isset($va_screens_with_bundles[$vn_screen_id])) {
                 continue;
             }
             if (caGetBundleAccessLevel($vs_table, $qr_res->get('bundle_name')) != __CA_BUNDLE_ACCESS_NONE__) {
                 $va_screens_with_bundles[$vn_screen_id] = true;
             }
         }
     }
     foreach ($va_screens as $vn_screen_id => $va_screen_labels_by_locale) {
         if (is_array($va_screens_with_bundles) && !isset($va_screens_with_bundles[$vn_screen_id])) {
             unset($va_screens[$vn_screen_id]);
             continue;
         }
         foreach ($va_screen_labels_by_locale as $vn_locale_id => $va_restriction_info) {
             if (!is_array($va_screens[$vn_screen_id][$vn_locale_id]['typeRestrictions'])) {
                 continue;
             }
             $va_screens[$vn_screen_id][$vn_locale_id]['typeRestrictionsForDisplay'] = join(', ', $va_screens[$vn_screen_id][$vn_locale_id]['typeRestrictions']);
         }
     }
     return caExtractValuesByUserLocale($va_screens);
 }

 /**
  * Perform client services-related periodic tasks
  */
 public function hookPeriodicTask(&$pa_params)
 {
     $t_log = new Eventlog();
     $o_db = new Db();
     if (!(bool) $this->opo_config->get('enable_library_services')) {
         return true;
     }
     if ((bool) $this->opo_config->get('enable_object_checkout')) {
         $t_user = new ca_users();
         $t_checkout = new ca_object_checkouts();
         $vs_app_name = $this->opo_config->get('app_display_name');
         $vs_sender_name = $this->opo_library_services_config->get('notification_sender_name');
         $vs_sender_email = $this->opo_library_services_config->get('notification_sender_email');
         if (!is_array($va_administrative_email_addresses = $this->opo_library_services_config->getList('administrative_email_addresses'))) {
             $va_administrative_email_addresses = array();
         }
         // Periodic "coming due" notices
         if ($this->opo_library_services_config->get('send_coming_due_notices') && ($vs_interval = $this->opo_library_services_config->get('coming_due_interval'))) {
             try {
                 $va_items_by_user = ca_object_checkouts::getItemsDueWithin($vs_interval, array('groupBy' => 'user_id', 'template' => $this->opo_library_services_config->get('coming_due_item_display_template'), 'notificationInterval' => $this->opo_library_services_config->get('coming_due_notification_interval')));
                 foreach ($va_items_by_user as $vn_user_id => $va_items_for_user) {
                     if ($t_user->load($vn_user_id)) {
                         if ($vs_user_email = $t_user->get('email')) {
                             $vs_subject = _t('Notice of items coming due for return');
                             if (caSendMessageUsingView(null, $vs_user_email, $vs_sender_email, "[{$vs_app_name}] {$vs_subject}", "library_coming_due.tpl", array('subject' => $vs_subject, 'from_user_id' => $vn_user_id, 'sender_name' => $vs_sender_name, 'sender_email' => $vs_sender_email, 'sent_on' => time(), 'items' => $va_items_for_user), null, $va_administrative_email_addresses)) {
                                 // mark record
                                 foreach ($va_items_for_user as $va_item) {
                                     if ($t_checkout->load($va_item['checkout_id'])) {
                                         $t_checkout->setMode(ACCESS_WRITE);
                                         $t_checkout->set('last_sent_coming_due_email', _t('now'));
                                         $t_checkout->update();
                                         if ($t_checkout->numErrors()) {
                                             $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Could not mark checkout coming due message sent time because update failed: %1', join("; ", $t_checkout->getErrors())), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                                         }
                                     } else {
                                         $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Could not mark checkout coming due message sent time because checkout id %1 was not found', $va_item['checkout_id']), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                                     }
                                 }
                             }
                         } else {
                             // no email
                             $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('No email address set for user %1 (%2)', $t_user->get('user_name'), trim($t_user->get('fname') . ' ' . $t_user->get('lname'))), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                         }
                     } else {
                         // invalid user
                         $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('User id %1 does not exist', $vn_user_id), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                     }
                 }
             } catch (Exception $e) {
                 $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Invalid interval (%1) specified for coming due notices', $vs_interval), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
             }
         }
         // Periodic overdue notices
         if ($this->opo_library_services_config->get('send_overdue_notices')) {
             try {
                 $va_items_by_user = ca_object_checkouts::getOverdueItems(array('groupBy' => 'user_id', 'template' => $this->opo_library_services_config->get('overdue_item_display_template'), 'notificationInterval' => $this->opo_library_services_config->get('overdue_notification_interval')));
                 foreach ($va_items_by_user as $vn_user_id => $va_items_for_user) {
                     if ($t_user->load($vn_user_id)) {
                         if ($vs_user_email = $t_user->get('email')) {
                             $vs_subject = _t('Notice of overdue items');
                             if (caSendMessageUsingView(null, $vs_user_email, $vs_sender_email, "[{$vs_app_name}] {$vs_subject}", "library_overdue.tpl", array('subject' => $vs_subject, 'from_user_id' => $vn_user_id, 'sender_name' => $vs_sender_name, 'sender_email' => $vs_sender_email, 'sent_on' => time(), 'items' => $va_items_for_user), null, $va_administrative_email_addresses)) {
                                 // mark record
                                 foreach ($va_items_for_user as $va_item) {
                                     if ($t_checkout->load($va_item['checkout_id'])) {
                                         $t_checkout->setMode(ACCESS_WRITE);
                                         $t_checkout->set('last_sent_overdue_email', _t('now'));
                                         $t_checkout->update();
                                         if ($t_checkout->numErrors()) {
                                             $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Could not mark checkout overdue message sent time because update failed: %1', join("; ", $t_checkout->getErrors())), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                                         }
                                     } else {
                                         $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Could not mark checkout overdue message sent time because checkout id %1 was not found', $va_item['checkout_id']), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                                     }
                                 }
                             }
                         } else {
                             // no email
                             $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('No email address set for user %1 (%2)', $t_user->get('user_name'), trim($t_user->get('fname') . ' ' . $t_user->get('lname'))), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                         }
                     } else {
                         // invalid user
                         $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('User id %1 does not exist', $vn_user_id), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
                     }
                 }
             } catch (Exception $e) {
                 $t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Failed to get overdue list'), 'SOURCE' => 'libraryServicesPlugin->hookPeriodicTask'));
             }
         }
         // Notice when reservation becomes available
         if ($this->opo_library_services_config->get('send_reservation_available_notices')) {
             try {
                 $va_items_by_user = ca_object_checkouts::getReservedAvailableItems(array('groupBy' => 'user_id', 'template' => $this->opo_library_services_config->get('overdue_item_display_template'), 'notificationInterval' => $this->opo_library_services_config->get('reservation_available_notification_interval')));
                 foreach ($va_items_by_user as $vn_user_id => $va_items_for_user) {
                     if ($t_user->load($vn_user_id)) {
                         if ($vs_user_email = $t_user->get('email')) {
                             $vs_subject = _t('Notice of reserved available items');
                             if (caSendMessageUsingView(null, $vs_user_email, $vs_sender_email, "[{$vs_app_name}] {$vs_subject}", "library_reservation_available.tpl", array('subject' => $vs_subject, 'from_user_id' => $vn_user_id, 'sender_name' => $vs_sender_name, 'sender_email' => $vs_sender_email, 'sent_on' => time(), 'items' => $va_items_for_user), null, $va_administrative_email_addresses)) {
//.........这里部分代码省略.........

 /**
  * Reset user password
  */
 public static function reset_password($po_opts = null)
 {
     if ($vs_user_name = (string) $po_opts->getOption('user')) {
         if (!($vs_password = (string) $po_opts->getOption('password'))) {
             CLIUtils::addError(_t("You must specify a password"));
             return false;
         }
         $t_user = new ca_users();
         if (!$t_user->load(array("user_name" => $vs_user_name))) {
             CLIUtils::addError(_t("User name %1 does not exist", $vs_user_name));
             return false;
         }
         $t_user->setMode(ACCESS_WRITE);
         $t_user->set('password', $vs_password);
         $t_user->update();
         if ($t_user->numErrors()) {
             CLIUtils::addError(_t("Password change for user %1 failed: %2", $vs_user_name, join("; ", $t_user->getErrors())));
             return false;
         }
         CLIUtils::addMessage(_t('Changed password for user %1', $vs_user_name), array('color' => 'bold_green'));
         return true;
     }
     CLIUtils::addError(_t("You must specify a user"));
     return false;
 }

 public function DownloadUserReport()
 {
     $vs_download_format = $this->request->getParameter("download_format", pString);
     if (!$vs_download_format) {
         $vs_download_format = "tab";
     }
     $this->view->setVar("download_format", $vs_download_format);
     switch ($vs_download_format) {
         default:
         case "tab":
             $this->view->setVar("file_extension", "txt");
             $this->view->setVar("mimetype", "text/plain");
             $vs_delimiter_col = "\t";
             $vs_delimiter_row = "\n";
             break;
             # -----------------------------------
         # -----------------------------------
         case "csv":
             $this->view->setVar("file_extension", "txt");
             $this->view->setVar("mimetype", "text/plain");
             $vs_delimiter_col = ",";
             $vs_delimiter_row = "\n";
             break;
             # -----------------------------------
     }
     $o_db = new Db();
     $t_user = new ca_users();
     $va_fields = array("lname", "fname", "email", "user_name", "userclass", "active", "last_login");
     $va_profile_prefs = $t_user->getValidPreferences('profile');
     $va_profile_prefs_labels = array();
     foreach ($va_profile_prefs as $vs_pref) {
         $va_pref_info = $t_user->getPreferenceInfo($vs_pref);
         $va_profile_prefs_labels[$vs_pref] = $va_pref_info["label"];
     }
     $qr_users = $o_db->query("SELECT * FROM ca_users ORDER BY user_id DESC");
     if ($qr_users->numRows()) {
         $va_rows = array();
         # --- headings
         $va_row = array();
         # --- headings for field values
         foreach ($va_fields as $vs_field) {
             switch ($vs_field) {
                 case "last_login":
                     $va_row[] = _t("Last login");
                     break;
                     # --------------------
                 # --------------------
                 default:
                     $va_row[] = $t_user->getDisplayLabel("ca_users." . $vs_field);
                     break;
                     # --------------------
             }
         }
         # --- headings for profile prefs
         foreach ($va_profile_prefs_labels as $vs_pref => $vs_pref_label) {
             $va_row[] = $vs_pref_label;
         }
         $va_rows[] = join($vs_delimiter_col, $va_row);
         reset($va_fields);
         reset($va_profile_prefs_labels);
         $o_tep = new TimeExpressionParser();
         while ($qr_users->nextRow()) {
             $va_row = array();
             # --- fields
             foreach ($va_fields as $vs_field) {
                 switch ($vs_field) {
                     case "userclass":
                         $va_row[] = $t_user->getChoiceListValue($vs_field, $qr_users->get("ca_users." . $vs_field));
                         break;
                         # -----------------------
                     # -----------------------
                     case "active":
                         $va_row[] = $qr_users->get("ca_users." . $vs_field) == 1 ? _t("active") : _t("not active");
                         break;
                         # -----------------------
                     # -----------------------
                     case "last_login":
                         //if (!is_array($va_vars = $qr_users->getVars('vars'))) { $va_vars = array(); }
                         if (!is_array($va_vars = $qr_users->getVars('volatile_vars'))) {
                             $va_vars = array();
                         }
                         if ($va_vars['last_login'] > 0) {
                             $o_tep->setUnixTimestamps($va_vars['last_login'], $va_vars['last_login']);
                             $va_row[] = $o_tep->getText();
                         } else {
                             $va_row[] = "-";
                         }
                         break;
                         # -----------------------
                     # -----------------------
                     default:
                         if ($vs_download_format == "csv") {
                             $va_row[] = str_replace(",", "-", $qr_users->get("ca_users." . $vs_field));
                         } else {
                             $va_row[] = $qr_users->get("ca_users." . $vs_field);
                         }
                         break;
                         # -----------------------
                 }
             }
//.........这里部分代码省略.........

 public function search($pn_subject_tablenum, $ps_search_expression, $pa_filters = array(), $po_rewritten_query = null)
 {
     $va_solr_search_filters = array();
     $vn_i = 0;
     $va_old_signs = is_object($po_rewritten_query) ? $po_rewritten_query->getSigns() : array();
     $va_terms = $va_signs = array();
     if ($po_rewritten_query) {
         foreach ($po_rewritten_query->getSubqueries() as $o_lucene_query_element) {
             if (!$va_old_signs || !is_array($va_old_signs)) {
                 // if array is null then according to Zend Lucene all subqueries should be "are required"... so we AND them
                 $vs_op = "AND";
             } else {
                 if (is_null($va_old_signs[$vn_i])) {
                     // is the sign for a particular query is null then OR is (it is "neither required nor prohibited")
                     $vs_op = 'OR';
                 } else {
                     $vs_op = $va_old_signs[$vn_i] === false ? 'NOT' : 'AND';
                     // true sign indicated "required" (AND) operation, false indicated "prohibited" (NOT) operation
                 }
             }
             if ($vn_i == 0) {
                 $vs_op = 'OR';
             }
             // advanced search queries are for some reason nested 1-element boolean queries in boolean queries
             if (get_class($o_lucene_query_element) == 'Zend_Search_Lucene_Search_Query_Boolean') {
                 $va_subqueries = $o_lucene_query_element->getSubqueries();
                 if (sizeof($va_subqueries) == 1) {
                     $o_lucene_query_element = array_shift($va_subqueries);
                 }
             }
             switch ($vs_class = get_class($o_lucene_query_element)) {
                 case 'Zend_Search_Lucene_Search_Query_Term':
                 case 'Zend_Search_Lucene_Search_Query_MultiTerm':
                 case 'Zend_Search_Lucene_Search_Query_Phrase':
                     $vs_access_point = '';
                     if ($vs_class != 'Zend_Search_Lucene_Search_Query_Term') {
                         $va_raw_terms = array();
                         foreach ($o_lucene_query_element->getQueryTerms() as $o_term) {
                             if (!$vs_access_point && ($vs_field = $o_term->field)) {
                                 $vs_access_point = $vs_field;
                             }
                             $va_raw_terms[] = $vs_text = (string) $o_term->text;
                         }
                         $vs_term = join(" ", $va_raw_terms);
                     } else {
                         $vs_access_point = $o_lucene_query_element->getTerm()->field;
                         $vs_term = $o_lucene_query_element->getTerm()->text;
                     }
                     if ($vs_access_point) {
                         list($vs_table, $vs_field, $vs_sub_field) = explode('.', $vs_access_point);
                         if (in_array($vs_table, array('created', 'modified'))) {
                             if (!$this->opo_tep->parse($vs_term)) {
                                 break;
                             }
                             $va_range = $this->opo_tep->getUnixTimestamps();
                             $vn_user_id = null;
                             if ($vs_field = trim($vs_field)) {
                                 if (!is_int($vs_field)) {
                                     $t_user = new ca_users();
                                     if ($t_user->load(array("user_name" => $vs_field))) {
                                         $vn_user_id = (int) $t_user->getPrimaryKey();
                                     }
                                 } else {
                                     $vn_user_id = (int) $vs_field;
                                 }
                             }
                             $vs_user_sql = $vn_user_id ? " AND (ccl.user_id = " . (int) $vn_user_id . ")" : "";
                             switch ($vs_table) {
                                 case 'created':
                                     if ($vn_user_id) {
                                         $o_lucene_query_element = new Zend_Search_Lucene_Search_Query_Boolean(array(new Zend_Search_Lucene_Index_Term('[' . $this->opo_tep->getText(array('start_as_iso8601' => true)) . " TO " . $this->opo_tep->getText(array('end_as_iso8601' => true)) . ']', 'created'), new Zend_Search_Lucene_Index_Term($vn_user_id, 'created_user_id')), array(true, true));
                                     } else {
                                         $o_lucene_query_element = new Zend_Search_Lucene_Search_Query_Term(new Zend_Search_Lucene_Index_Term('[' . $this->opo_tep->getText(array('start_as_iso8601' => true)) . " TO " . $this->opo_tep->getText(array('end_as_iso8601' => true)) . ']', 'created'));
                                     }
                                     break;
                                 case 'modified':
                                     if ($vn_user_id) {
                                         $o_lucene_query_element = new Zend_Search_Lucene_Search_Query_Boolean(array(new Zend_Search_Lucene_Index_Term('[' . $this->opo_tep->getText(array('start_as_iso8601' => true)) . " TO " . $this->opo_tep->getText(array('end_as_iso8601' => true)) . ']', 'modified'), new Zend_Search_Lucene_Index_Term($vn_user_id, 'modified_user_id')), array(true, true));
                                     } else {
                                         $o_lucene_query_element = new Zend_Search_Lucene_Search_Query_Term(new Zend_Search_Lucene_Index_Term('[' . $this->opo_tep->getText(array('start_as_iso8601' => true)) . " TO " . $this->opo_tep->getText(array('end_as_iso8601' => true)) . ']', 'modified'));
                                     }
                                     break;
                             }
                         } else {
                             if ($vs_table && $vs_field) {
                                 $t_table = $this->opo_datamodel->getInstanceByTableName($vs_table, true);
                                 if ($t_table) {
                                     $vs_table_num = $t_table->tableNum();
                                     if (is_numeric($vs_field)) {
                                         $vs_fld_num = 'I' . $vs_field;
                                         $vn_fld_num = (int) $vs_field;
                                     } else {
                                         $vn_fld_num = $this->getFieldNum($vs_table, $vs_field);
                                         $vs_fld_num = 'I' . $vn_fld_num;
                                         if (!strlen($vn_fld_num)) {
                                             $t_element = new ca_metadata_elements();
                                             if ($t_element->load(array('element_code' => $vs_sub_field ? $vs_sub_field : $vs_field))) {
                                                 $vn_fld_num = $t_element->getPrimaryKey();
                                                 $vs_fld_num = 'A' . $vn_fld_num;
                                                 //
//.........这里部分代码省略.........

 /**
  * Remove current user from one or more groups.
  *
  * @access public
  * @param mixed $pm_groups Single group or list (array) of user_ids to remove from current group. Users must be specified by user_id
  * @return bool Returns true on success, false on error.
  */
 function removeUsers($pm_user_ids)
 {
     if (!is_array($pm_user_ids)) {
         $pm_user_ids = array($pm_user_ids);
     }
     if ($pn_group_id = $this->getPrimaryKey()) {
         $t_user = new ca_users();
         $vn_users_added = 0;
         $va_user_ids = array();
         foreach ($pm_user_ids as $pn_user_id) {
             if (!$t_user->load((int) $pn_user_id)) {
                 continue;
             }
             $va_user_ids[] = intval($t_user->getPrimaryKey());
         }
         if (sizeof($va_user_ids) > 0) {
             $o_db = $this->getDb();
             $o_db->query("\n\t\t\t\t\tDELETE FROM ca_users_x_groups \n\t\t\t\t\tWHERE (group_id = ?) AND (user_id IN (" . join(", ", $va_user_ids) . "))\n\t\t\t\t", (int) $pn_group_id);
             if ($o_db->numErrors()) {
                 $this->postError(936, _t("Database error: %1", join(';', $o_db->getErrors())), "ca_user_groups->removeUsers()");
                 return false;
             } else {
                 return true;
             }
         } else {
             $this->postError(945, _t("No users specified"), "ca_user_groups->removeUsers()");
             return false;
         }
     } else {
         return false;
     }
 }

 /**
  * Perform periodic tasks
  *
  * @return boolean true because otherwise it disables subsequent plugins
  */
 public function hookPeriodicTask(&$pa_params)
 {
     global $AUTH_CURRENT_USER_ID;
     $t_log = new Eventlog();
     $o_db = new Db();
     //$t_log->log(array('CODE' => 'ERR', 'MESSAGE' => _t('Could not authenticate to remote system %1', $vs_base_url), 'SOURCE' => 'traveloguePlugin->hookPeriodicTask'));
     // Get new email
     $pn_locale_id = 1;
     // US
     $vs_server = $this->opo_config->get('imap_server');
     $vs_username = $this->opo_config->get('username');
     $vs_password = $this->opo_config->get('password');
     $vs_ssl = $this->opo_config->get('ssl');
     if (!$vs_server) {
         return true;
     }
     if (!$vs_username) {
         return true;
     }
     try {
         $o_mail = new Zend_Mail_Storage_Imap(array('host' => $vs_server, 'user' => $vs_username, 'password' => $vs_password, 'ssl' => $vs_ssl));
     } catch (Exception $e) {
         return true;
     }
     $va_mimetypes = $this->opo_config->getList('mimetypes');
     $va_mail_to_delete = array();
     foreach ($o_mail as $vn_message_num => $o_message) {
         $va_mail_to_delete[$vn_message_num] = true;
         // Extract title from subject line of email
         $vs_subject = $o_message->subject;
         $vs_from = $o_message->headerExists('from') ? $o_message->from : "";
         print "PROCESSING {$vs_subject} FROM {$vs_from}\n";
         // Extract media from email attachments
         // Extract caption from email body
         $va_images = array();
         $va_texts = array();
         foreach (new RecursiveIteratorIterator($o_message) as $o_part) {
             try {
                 if (in_array(strtok($o_part->contentType, ';'), $va_mimetypes)) {
                     $va_images[] = $o_part;
                 } else {
                     if (in_array(strtok($o_part->contentType, ';'), array("text/plain", "text/html"))) {
                         $va_texts[] = (string) $o_part;
                     }
                 }
             } catch (Zend_Mail_Exception $e) {
                 // ignore
             }
         }
         if (!sizeof($va_images)) {
             continue;
         }
         // Get user by email address
         if (preg_match('!<([^>]+)>!', $vs_from, $va_matches)) {
             // extract raw address from "from" header
             $vs_from = $va_matches[1];
         }
         $t_user = new ca_users();
         if ($t_user->load(array('email' => $vs_from))) {
             $AUTH_CURRENT_USER_ID = $vn_user_id = $t_user->getPrimaryKey();
             // force libs to consider matched user as logged in; change log will reflect this name
         } else {
             $vn_user_id = null;
         }
         // Create object
         $t_object = new ca_objects();
         $t_object->setMode(ACCESS_WRITE);
         $t_object->set('type_id', $this->opo_config->get('object_type'));
         // TODO: set idno to autogenerated # and/or allow for configurable policy
         $t_object->set('idno', '');
         $t_object->set('access', $this->opo_config->get('default_access'));
         $t_object->set('status', $this->opo_config->get('default_status'));
         // TODO: make this a configurable mapping ala how media metadata is done
         $t_object->addAttribute(array('locale_id' => $pn_locale_id, 'generalNotes' => join("\n\n", $va_texts)), 'generalNotes');
         $t_object->insert();
         DataMigrationUtils::postError($t_object, "While adding object", "traveloguePlugin");
         // TODO: log this
         $t_object->addLabel(array('name' => $vs_subject), $pn_locale_id, null, true);
         DataMigrationUtils::postError($t_object, "While adding label", "traveloguePlugin");
         // TODO: log this
         // Add representation
         $vs_tmp_file_path = tempnam(caGetTempDirPath(), 'travelogue_');
         foreach ($va_images as $vn_i => $vs_file_content) {
             if (file_put_contents($vs_tmp_file_path, base64_decode((string) $vs_file_content))) {
                 $t_object->addRepresentation($vs_tmp_file_path, $this->opo_config->get('representation_type'), 1, $this->opo_config->get('default_status'), $this->opo_config->get('default_access'), true);
                 DataMigrationUtils::postError($t_object, "While adding media", "traveloguePlugin");
                 // TODO: log this
             }
         }
         // TODO: add option to link user-as-entity to image (probably as creator)
     }
     foreach (array_reverse(array_keys($va_mail_to_delete)) as $vn_message_num) {
         $o_mail->removeMessage($vn_message_num);
     }
     return true;
//.........这里部分代码省略.........

 public static function authenticate($ps_username, $ps_password = '', $pa_options = null)
 {
     $po_auth_config = Configuration::load(Configuration::load()->get('authentication_config'));
     if (!function_exists("ldap_connect")) {
         throw new OpenLDAPException(_t("PHP's LDAP module is required for LDAP authentication!"));
     }
     if (!$ps_username) {
         return false;
     }
     // ldap config
     $vs_ldaphost = $po_auth_config->get("ldap_host");
     $vs_ldapport = $po_auth_config->get("ldap_port");
     $vs_base_dn = $po_auth_config->get("ldap_base_dn");
     $vs_user_ou = $po_auth_config->get("ldap_user_ou");
     $vs_bind_rdn = self::postProcessLDAPConfigValue("ldap_bind_rdn_format", $ps_username, $vs_user_ou, $vs_base_dn);
     $va_default_roles = $po_auth_config->get("ldap_users_default_roles");
     if (!is_array($va_default_roles)) {
         $va_default_roles = array();
     }
     $va_default_groups = $po_auth_config->get("ldap_users_default_groups");
     if (!is_array($va_default_groups)) {
         $va_default_groups = array();
     }
     $vo_ldap = ldap_connect($vs_ldaphost, $vs_ldapport);
     ldap_set_option($vo_ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
     if (!$vo_ldap) {
         return false;
     }
     $vs_bind_rdn_filter = self::postProcessLDAPConfigValue("ldap_bind_rdn_filter", $ps_username, $vs_user_ou, $vs_base_dn);
     if (strlen($vs_bind_rdn_filter) > 0) {
         $vo_dn_search_results = ldap_search($vo_ldap, $vs_base_dn, $vs_bind_rdn_filter);
         $va_dn_search_results = ldap_get_entries($vo_ldap, $vo_dn_search_results);
         if (isset($va_dn_search_results[0]['dn'])) {
             $vs_bind_rdn = $va_dn_search_results[0]['dn'];
         }
     }
     // log in
     $vo_bind = @ldap_bind($vo_ldap, $vs_bind_rdn, $ps_password);
     if (!$vo_bind) {
         // wrong credentials
         if (ldap_get_option($vo_ldap, 0x32, $extended_error)) {
             caLogEvent("ERR", "LDAP ERROR (" . ldap_errno($vo_ldap) . ") {$extended_error} [{$vs_bind_rdn}]", "OpenLDAP::Authenticate");
         }
         ldap_unbind($vo_ldap);
         return false;
     }
     // check group membership
     if (!self::isMemberinAtLeastOneGroup($ps_username, $vo_ldap)) {
         ldap_unbind($vo_ldap);
         return false;
     }
     // user role and group membership syncing with directory
     $t_user = new ca_users();
     if ($t_user->load($ps_username)) {
         // don't try to sync roles for non-existing users (the first auth call is before the user is actually created)
         if ($po_auth_config->get('ldap_sync_user_roles')) {
             $va_expected_roles = array_merge($va_default_roles, self::getRolesToAddFromDirectory($ps_username, $vo_ldap));
             foreach ($va_expected_roles as $vs_role) {
                 if (!$t_user->hasUserRole($vs_role)) {
                     $t_user->addRoles($vs_role);
                 }
             }
             foreach ($t_user->getUserRoles() as $vn_id => $va_role_info) {
                 if (!in_array($va_role_info['code'], $va_expected_roles)) {
                     $t_user->removeRoles($vn_id);
                 }
             }
         }
         if ($po_auth_config->get('ldap_sync_user_groups')) {
             $va_expected_groups = array_merge($va_default_groups, self::getGroupsToAddFromDirectory($ps_username, $vo_ldap));
             foreach ($va_expected_groups as $vs_group) {
                 if (!$t_user->inGroup($vs_group)) {
                     $t_user->addToGroups($vs_group);
                 }
             }
             foreach ($t_user->getUserGroups() as $vn_id => $va_group_info) {
                 if (!in_array($va_group_info['code'], $va_expected_groups)) {
                     $t_user->removeFromGroups($vn_id);
                 }
             }
         }
     }
     ldap_unbind($vo_ldap);
     return true;
 }

 public function userCanAccess($pn_user_id, $pa_module_path, $ps_controller, $ps_action, $pa_fake_parameters = array())
 {
     if (!$this->opo_acr_config->get("enforce_access_restrictions")) {
         // admin doesn't want us to enforce any restrictions
         return true;
     }
     if (!$this->opo_request) {
         // there is no "real" request, i.e. we're running a CLI script or something
         // we need some context information from the request to determine if a user
         // can access something though -> always return false here!
         return false;
     }
     if ($this->opt_user->getPrimaryKey() != $pn_user_id) {
         $this->opt_user->load($pn_user_id);
     }
     if ($this->opt_user->canDoAction("is_administrator")) {
         // almighty admin!
         return true;
     }
     $va_groups_to_check = array();
     // check module components
     if (!is_array($pa_module_path)) {
         $pa_module_path = explode("/", $pa_module_path);
     }
     if (is_array($pa_module_path)) {
         $va_modules_to_check = array();
         foreach ($pa_module_path as $vs_module) {
             $va_modules_to_check[] = $vs_module;
             $vs_module_part_path = join("/", $va_modules_to_check);
             if (is_array($this->opa_acr[$vs_module_part_path])) {
                 foreach ($this->opa_acr[$vs_module_part_path] as $va_group) {
                     $va_groups_to_check[] = $va_group;
                 }
             }
         }
     }
     // check controller
     $vs_controller_path = join("/", is_array($pa_module_path) ? $pa_module_path : array()) . "/" . ucfirst($ps_controller) . 'Controller';
     if (is_array($this->opa_acr[$vs_controller_path])) {
         foreach ($this->opa_acr[$vs_controller_path] as $va_group) {
             $va_groups_to_check[] = $va_group;
         }
     }
     // check action
     $vs_action_path = join("/", is_array($pa_module_path) ? $pa_module_path : array()) . "/" . ucfirst($ps_controller) . "Controller/" . $ps_action;
     if (is_array($this->opa_acr[$vs_action_path])) {
         foreach ($this->opa_acr[$vs_action_path] as $va_group) {
             $va_groups_to_check[] = $va_group;
         }
     }
     // check rules
     foreach ($va_groups_to_check as $va_group) {
         if (!is_array($va_group) || !is_array($va_group["actions"])) {
             continue;
         }
         // group without action restrictions
         $vb_group_passed = false;
         // check if parameter restrictions apply
         if (is_array($va_group["parameters"])) {
             if (!$this->_parameterRestrictionsApply($va_group["parameters"], $ps_controller, $ps_action, $pa_fake_parameters)) {
                 continue;
                 // auto-pass
             }
         }
         if (isset($va_group["operator"]) && $va_group["operator"] == "OR") {
             // OR
             foreach ($va_group["actions"] as $vs_action) {
                 if ($this->opt_user->canDoAction($vs_action)) {
                     $vb_group_passed = true;
                     break;
                 }
             }
         } else {
             // AND
             foreach ($va_group["actions"] as $vs_action) {
                 if (!$this->opt_user->canDoAction($vs_action)) {
                     return false;
                 }
             }
             $vb_group_passed = true;
             // passed all AND-ed conditions
         }
         if (!$vb_group_passed) {
             // one has to pass ALL groups!
             return false;
         }
     }
     return true;
     // all groups passed
 }

 function resetSave()
 {
     $ps_action = $this->request->getParameter('action', pString);
     $ps_key = $this->request->getParameter('key', pString);
     $ps_key = preg_replace("/[^A-Za-z0-9]+/", "", $ps_key);
     $this->view->setVar("key", $ps_key);
     $o_check_key = new Db();
     $qr_check_key = $o_check_key->query("\n\t\t\t\tSELECT user_id \n\t\t\t\tFROM ca_users \n\t\t\t\tWHERE\n\t\t\t\t\tmd5(concat(concat(user_id, '/'), password)) = ?\n\t\t\t", $ps_key);
     #
     # Check reset key
     #
     if (!$qr_check_key->nextRow() || !($vs_user_id = $qr_check_key->get("user_id"))) {
         $this->view->setVar("action", "reset_failure");
         $this->render('LoginReg/resetpw_html.php');
     } else {
         $ps_password = $this->request->getParameter('password', pString);
         $ps_password_confirm = $this->request->getParameter('password_confirm', pString);
         switch ($ps_action) {
             case 'reset_save':
                 if (!$ps_password || !$ps_password_confirm) {
                     $this->view->setVar("password_error", _t("Please enter and re-type your password."));
                     $ps_action = "reset";
                     break;
                 }
                 if ($ps_password != $ps_password_confirm) {
                     $this->view->setVar("password_error", _t("Passwords do not match. Please try again."));
                     $ps_action = "reset";
                     break;
                 }
                 $t_user = new ca_users();
                 $t_user->load($vs_user_id);
                 # verify user exists with this e-mail address
                 if ($t_user->getPrimaryKey()) {
                     # user with e-mail already exists...
                     $t_user->setMode(ACCESS_WRITE);
                     $t_user->set("password", $ps_password);
                     $t_user->update();
                     if ($t_user->numErrors()) {
                         $this->notification->addNotification(join("; ", $t_user->getErrors()), __NOTIFICATION_TYPE_INFO__);
                         $ps_action = "reset_failure";
                     } else {
                         $ps_action = "reset_success";
                         # -- generate mail text from template
                         ob_start();
                         require $this->request->getViewsDirectoryPath() . "/mailTemplates/notification.tpl";
                         $vs_mail_message = ob_get_contents();
                         ob_end_clean();
                         caSendmail($t_user->get('email'), $this->request->config->get("ca_admin_email"), "[" . $this->request->config->get("app_display_name") . "] " . _t("Your password has been reset"), $vs_mail_message);
                     }
                     break;
                 } else {
                     $this->notification->addNotification(_t("Invalid user"), __NOTIFICATION_TYPE_INFO__);
                     $ps_action = "reset_failure";
                 }
         }
         $this->view->setVar("action", $ps_action);
         $this->render('LoginReg/resetpw_html.php');
     }
 }

 private function syncWithDirectory($ps_username)
 {
     $va_default_roles = $this->getConfigValue("ldap_users_default_roles", array());
     $va_default_groups = $this->getConfigValue("ldap_users_default_groups", array());
     $t_user = new ca_users();
     // don't try to sync roles for non-existing users (the first auth call is before the user is actually created)
     if (!$t_user->load($ps_username)) {
         return;
     }
     if ($this->getConfigValue('ldap_sync_user_roles')) {
         $va_expected_roles = array_merge($va_default_roles, $this->getRolesToAddFromDirectory($ps_username));
         foreach ($va_expected_roles as $vs_role) {
             if (!$t_user->hasUserRole($vs_role)) {
                 $t_user->addRoles($vs_role);
             }
         }
         foreach ($t_user->getUserRoles() as $vn_id => $va_role_info) {
             if (!in_array($va_role_info['code'], $va_expected_roles)) {
                 $t_user->removeRoles($vn_id);
             }
         }
     }
     if ($this->getConfigValue('ldap_sync_user_groups')) {
         $va_expected_groups = array_merge($va_default_groups, $this->getGroupsToAddFromDirectory($ps_username));
         foreach ($va_expected_groups as $vs_group) {
             if (!$t_user->inGroup($vs_group)) {
                 $t_user->addToGroups($vs_group);
             }
         }
         foreach ($t_user->getUserGroups() as $vn_id => $va_group_info) {
             if (!in_array($va_group_info['code'], $va_expected_groups)) {
                 $t_user->removeFromGroups($vn_id);
             }
         }
     }
 }