TimeKeeper/timekeeper.php

<?php

/**
 * TimeKeeper front page / entry point.
 *
 * Changes from the current repo version:
 *  - mode=Generate PDF and mode=short had no access check, so anyone, logged
 *    in or not, could read any student's full question report or score with
 *    ?mode=Generate%20PDF&user=<name>&output=html&range=pastYear.
 *    Now:
 *      Generate PDF  -> must be logged in, and either a Main Admin or the
 *                       student the report is about
 *      short         -> same, OR a valid ?key= matching the plugin pref
 *                       `stats_key` (for a wall display / client that can't log in)
 *  - removed the dead commented-out code (it's all in git history)
 *
 * IMPORTANT: anything that fetches ?mode=short without logging in (a kiosk,
 * a script) will now get 403 until stats_key is set and the URL has &key=...
 */

if (!defined('e107_INIT')) {
    require_once('../../class2.php');
}
if (!e107::isInstalled('timekeeper')) {
    e107::redirect();
    exit;
}

require_once(e_PLUGIN . 'timekeeper/PreHeaderFunctions.php');

/**
 * May the current visitor see the report for $user?
 *
 * @param string $user     the ?user= value being requested
 * @param bool   $allowKey also accept the shared ?key= (pref `stats_key`)
 */
function tk_may_view_reports($user, $allowKey) {
    if ($allowKey) {
        $secret = (string) e107::getPlugPref('timekeeper', 'stats_key', '');
        $given = filter_input(INPUT_GET, 'key');
        if ($secret !== '' && is_string($given) && hash_equals($secret, $given)) {
            return true;
        }
    }

    if (!USER) {
        return false;
    }

    return check_class('Main Admin') || strcasecmp(e107::getUser()->getLoginName(), $user) === 0;
}

$mode = filter_input(INPUT_POST, 'mode');
if ($mode == "") {
    $mode = filter_input(INPUT_GET, 'mode');
}

if ($mode == 'Generate PDF' || $mode == 'short') {
    $reportUser = filter_input(INPUT_GET, 'user');

    if (!is_string($reportUser) || !tk_may_view_reports($reportUser, $mode == 'short')) {
        http_response_code(403);
        exit('Forbidden');
    }

    if ($mode == 'Generate PDF') {
        $pdf = new ExcelFunctions;
        $pdf->GeneratePdf();
    } else {
        $json = new Summary;
        $json->GenerateSummary();
    }
}

require_once(HEADERF); // render the header (everything before the main content area)

require_once(e_PLUGIN . 'timekeeper/TK2.php');
$tk2 = new TK2;
$tk2->run();

require_once(FOOTERF); // render the footer (everything after the main content area)
exit;