<?php
/*
 +-------------------------------------------------------------------------+
 | Copyright (C) 2004-2023 The Cacti Group                                 |
 |                                                                         |
 | This program is free software; you can redistribute it and/or           |
 | modify it under the terms of the GNU General Public License             |
 | as published by the Free Software Foundation; either version 2          |
 | of the License, or (at your option) any later version.                  |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 +-------------------------------------------------------------------------+
 | Cacti: The Complete RRDtool-based Graphing Solution                     |
 +-------------------------------------------------------------------------+
 | This code is designed, written, and maintained by the Cacti Group. See  |
 | about.php and/or the AUTHORS file for specific developer information.   |
 +-------------------------------------------------------------------------+
 | http://www.cacti.net/                                                   |
 +-------------------------------------------------------------------------+
*/


/**
 * clear_auth_cookie - clears a users security token
 *
 * @return (void)
 */
function clear_auth_cookie() {
	global $config;

	if (isset($_COOKIE['cacti_remembers']) && read_config_option('auth_cache_enabled') == 'on') {
		$parts = explode(',', $_COOKIE['cacti_remembers']);

		if (cacti_sizeof($parts) == 2) {
			$user_id  = $parts[0];
			$realm_id = -1;
			$token    = $parts[1];
		} else {
			$user_id  = $parts[0];
			$realm_id = $parts[1];
			$token    = $parts[2];
		}

		// Legacy support which leaked usernames
		if (!is_numeric($user_id)) {
			$user_id = db_fetch_cell_prepared('SELECT id
				FROM user_auth
				WHERE username = ?',
				array($user_id));
		}

		if ($user_id > 0) {
			$secret = hash('sha512', $token, false);

			cacti_cookie_session_logout();

			db_execute_prepared('DELETE FROM user_auth_cache
				WHERE user_id = ?
				AND token = ?',
				array($user_id, $secret));
		}
	}
}

/**
 * set_auth_cookie - sets a users security token
 *
 * @param  (array) user is the user_auth row for the user
 *
 * @return (bool) True if token set worked, otherwise false
 */
function set_auth_cookie($user) {
	global $config;

	if (db_table_exists('user_auth_cache')) {
		clear_auth_cookie();

		$nssecret = md5($_SERVER['REQUEST_TIME'] .  mt_rand(10000,10000000)) . md5(get_client_addr());

		$secret = hash('sha512', $nssecret, false);

		db_execute_prepared('REPLACE INTO user_auth_cache
			(user_id, hostname, last_update, token)
			VALUES
			(?, ?, NOW(), ?);',
			array($user['id'], get_client_addr(), $secret));

		cacti_cookie_session_set($user['id'], $user['realm'], $nssecret);
	}
}

/**
 * check_auth_cookie - clears a users security token
 *
 * @return (int) The user of the session cookie, otherwise false
 */
function check_auth_cookie() {
	if (isset($_COOKIE['cacti_remembers']) &&
		read_config_option('auth_cache_enabled') == 'on' &&
		db_table_exists('user_auth_cache')) {

		$parts = explode(',', $_COOKIE['cacti_remembers']);

		if (cacti_sizeof($parts) == 2) {
			$user_id  = $parts[0];
			$realm_id = -1;
			$token    = $parts[1];
		} else {
			$user_id  = $parts[0];
			$realm_id = $parts[1];
			$token    = $parts[2];
		}

		// Legacy support which leaked usernames
		if (!is_numeric($user_id)) {
			$user_id = db_fetch_cell_prepared('SELECT id
				FROM user_auth
				WHERE username = ?',
				array($user_id));
		}

		if ($user_id > 0 && $user_id != get_guest_account()) {
			if ($realm_id == -1) {
				$user_info = db_fetch_row_prepared('SELECT id, realm, username
					FROM user_auth
					WHERE id = ?',
					array($user_id));
			} else {
				$user_info = db_fetch_row_prepared('SELECT id, realm, username
					FROM user_auth
					WHERE id = ?
					AND realm = ?',
					array($user_id, $realm_id));
			}

			if (cacti_sizeof($user_info)) {
				$secret = hash('sha512', $token, false);

				$found  = db_fetch_cell_prepared('SELECT user_id
					FROM user_auth_cache
					WHERE user_id = ?
					AND token = ?',
					array($user_info['id'], $secret)
				);

				if (empty($found)) {
					return false;
				} else {
					set_auth_cookie($user_info);

					cacti_log("LOGIN: User '" . $user_info['username'] . "' Authenticated via Authentication Cookie", false, 'AUTH');

					db_execute_prepared('INSERT IGNORE INTO user_log
						(username, user_id, result, ip, time)
						VALUES
						(?, ?, 2, ?, NOW())',
						array($user_info['username'], $user_info['id'], get_client_addr())
					);

					return $user_info['id'];
				}
			}
		}
	}

	return false;
}

/**
 * is_template_account - given a username or user_id test if this is a template account
 *   Template accounts could be accounts used for the administrative email, for both
 *   the guest and template accounts, or a user that is specified by a plugin as a
 *   template account.
 *
 * @param  (int|string) user_id is either the user_id or a username
 *
 * @return (bool) true if template account, false otherwise
 */
function is_template_account($user_id) {
	if (!is_numeric($user_id)) {
		$user_id = db_fetch_cell_prepared('SELECT id FROM user_auth WHERE username = ?', array($user_id));
	}

	if (empty($user_id)) {
		return false;
	}

	if (read_config_option('admin_user') == $user_id) {
		return true;
	} elseif (read_config_option('guest_user') == $user_id) {
		return true;
	} elseif (read_config_option('user_template') == $user_id) {
		return true;
	} else {
		$domain_template = db_fetch_cell_prepared('SELECT COUNT(*)
			FROM user_domains
			WHERE user_id = ?',
			array($user_id));

		if ($domain_template > 0) {
			return true;
		} else {
			$plugin_template = get_template_account($user_id);

			if ($plugin_template == $user_id) {
				return true;
			}
		}
	}

	return false;
}

/**
 * get_basic_auth_username - If basic auth is used, return the valid username
 *
 * @return (string) the new username, or false if one was not passed
 */
function get_basic_auth_username() {
	if (isset($_SERVER['PHP_AUTH_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['PHP_AUTH_USER']);
	} elseif (isset($_SERVER['REMOTE_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['REMOTE_USER']);
	} elseif (isset($_SERVER['REDIRECT_REMOTE_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['REDIRECT_REMOTE_USER']);
	} elseif (isset($_SERVER['HTTP_PHP_AUTH_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['HTTP_PHP_AUTH_USER']);
	} elseif (isset($_SERVER['HTTP_REMOTE_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['HTTP_REMOTE_USER']);
	} elseif (isset($_SERVER['HTTP_REDIRECT_REMOTE_USER'])) {
		$username = str_replace("\\", "\\\\", $_SERVER['HTTP_REDIRECT_REMOTE_USER']);
	} else {
		$username = false;
	}

	if ($username !== false) {
		if (strpos($username, '@') !== false) {
			$upart = explode('@', $username);
			$username = $upart[0];
		}

		/* Handle mapping basic accounts to shortform accounts.
		 * Format of map file is CSV: basic,shortform */
		$mapfile = read_config_option('path_basic_mapfile');
		if ($mapfile != '' && file_exists($mapfile) && is_readable($mapfile)) {
			$records = file($mapfile);
			$found   = false;

			if (cacti_sizeof($records)) {
				foreach($records as $r) {
					list($basic, $shortform) = str_getcsv($r);

					if (trim($basic) == $username) {
						$username = trim($shortform);
						$found    = true;

						break;
					}
				}
			}

			if (!$found) {
				cacti_log("WARNING: Username $username not found in basic mapfile.", false, 'AUTH');
			}
		}
	}

	return $username;
}

/**
 * user_copy - copies user account
 *
 * @param  (string)  $template_user - username of the user account that should be used as the template
 * @param  (string)  $new_user - new username of the account to be created/overwritten
 * @param  (int)     $template_realm - new realm of the account
 * @param  (int)     $new_realm - new realm of the account to be created, overwrite not affected, but is used for lookup
 * @param  (bool)    $overwrite - Allow overwrite of existing user, preserves username, fullname, password and realm
 * @param  (array)   $data_override - Array of user_auth field and values to override on the new user
 *
 * @return (int|bool) the new users id, or false on no copy
 */
function user_copy($template_user, $new_user, $template_realm = 0, $new_realm = 0, $overwrite = false, $data_override = array()) {
	/* ================= input validation ================= */
	input_validate_input_number($template_realm);
	input_validate_input_number($new_realm);
	/* ==================================================== */

	/* Check get template users array */
	$user_auth = db_fetch_row_prepared('SELECT *
		FROM user_auth
		WHERE username = ?
		AND realm = ?',
		array($template_user, $template_realm));

	if (!cacti_sizeof($user_auth)) {
		return false;
	}

	$template_id = $user_auth['id'];

	/* Create update/insert for new/existing user */
	$user_exist = db_fetch_row_prepared('SELECT *
		FROM user_auth
		WHERE username = ?
		AND realm = ?',
		array($new_user, $new_realm));

	if (cacti_sizeof($user_exist)) {
		if ($overwrite) {
			/* Overwrite existing user */
			$user_auth['id']            = $user_exist['id'];
			$user_auth['username']      = $user_exist['username'];
			$user_auth['password']      = $user_exist['password'];
			$user_auth['realm']         = $user_exist['realm'];
			$user_auth['full_name']     = $user_exist['full_name'];
			$user_auth['email_address'] = $user_exist['email_address'];
 			$user_auth['must_change_password'] = $user_exist['must_change_password'];
			$user_auth['enabled']       = $user_exist['enabled'];
		} else {
			/* User already exists, duplicate users are bad */
			raise_message(19);

			return false;
		}
	} else {
		/* new user */
		$user_auth['id']            = 0;
		$user_auth['username']      = $new_user;
		$user_auth['enabled']       = 'on';
		$user_auth['password']      = mt_rand(100000, 10000000);
		$user_auth['email_address'] = '';
 		$user_auth['realm']         = $new_realm;
	}

	/* Update data_override fields */
	if (is_array($data_override)) {
		foreach ($data_override as $field => $value) {
			if (isset($user_auth[$field]) && $field != 'id' && $field != 'username') {
				$user_auth[$field] = $value;
			}
		}
	}

	/* Save the user */
	$new_id = sql_save($user_auth, 'user_auth');

	/* Create/Update permissions and settings */
	if (cacti_sizeof($user_exist) && $overwrite) {
		db_execute_prepared('DELETE FROM user_auth_perms WHERE user_id = ?', array($user_exist['id']));
		db_execute_prepared('DELETE FROM user_auth_realm WHERE user_id = ?', array($user_exist['id']));
		db_execute_prepared('DELETE FROM settings_user WHERE user_id = ?', array($user_exist['id']));
		db_execute_prepared('DELETE FROM settings_tree WHERE user_id = ?', array($user_exist['id']));
	}

	$user_auth_perms = db_fetch_assoc_prepared('SELECT *
		FROM user_auth_perms
		WHERE user_id = ?',
		array($template_id));

	if (cacti_sizeof($user_auth_perms)) {
		foreach ($user_auth_perms as $row) {
			$row['user_id'] = $new_id;
			sql_save($row, 'user_auth_perms', array('user_id', 'item_id', 'type'), false);
		}
	}

	$user_auth_realm = db_fetch_assoc_prepared('SELECT *
		FROM user_auth_realm
		WHERE user_id = ?',
		array($template_id));

	if (cacti_sizeof($user_auth_realm)) {
		foreach ($user_auth_realm as $row) {
			$row['user_id'] = $new_id;
			sql_save($row, 'user_auth_realm', array('realm_id', 'user_id'), false);
		}
	}

	$settings_user = db_fetch_assoc_prepared('SELECT *
		FROM settings_user
		WHERE user_id = ?',
		array($template_id));

	if (cacti_sizeof($settings_user)) {
		foreach ($settings_user as $row) {
			$row['user_id'] = $new_id;
			sql_save($row, 'settings_user', array('user_id', 'name'), false);
		}
	}

	$settings_tree = db_fetch_assoc_prepared('SELECT *
		FROM settings_tree
		WHERE user_id = ?',
		array($template_id));

	if (cacti_sizeof($settings_tree)) {
		foreach ($settings_tree as $row) {
			$row['user_id'] = $new_id;
			sql_save($row, 'settings_tree', array('user_id', 'graph_tree_item_id'), false);
		}
	}

	/* apply group permissions for the user */
	$groups = db_fetch_assoc_prepared('SELECT group_id
		FROM user_auth_group_members
		WHERE user_id = ?',
		array($template_id));

	if (cacti_sizeof($groups)) {
		foreach($groups as $g) {
			$sql[] = '(' . $new_id . ', ' . $g['group_id'] . ')';
		}

		db_execute('INSERT IGNORE INTO user_auth_group_members
			(user_id, group_id) VALUES ' . implode(',', $sql));
	}

	api_plugin_hook_function('copy_user', array('template_id' => $template_id, 'new_id' => $new_id));

	return $new_id;
}


/**
 * user_remove - remove a user account
 *
 * @param  (int) $user_id - Id os the user account to remove
 *
 * @return (void)
 */
function user_remove($user_id) {
	/* ================= input validation ================= */
	input_validate_input_number($user_id);
	/* ==================================================== */

	/* check for guest or template user */
	$username = db_fetch_cell_prepared('SELECT username
		FROM user_auth
		WHERE id = ?',
		array($user_id));

	if ($username != get_nfilter_request_var('username')) {
		if (is_template_account($user_id)) {
			raise_message(21);
			return;
		}

		if ($user_id === get_guest_account()) {
			raise_message(21);
			return;
		}
	}

	db_execute_prepared('DELETE FROM user_auth WHERE id = ?', array($user_id));
	db_execute_prepared('DELETE FROM user_auth_realm WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM user_auth_cache WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM user_auth_perms WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM user_auth_row_cache WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM user_auth_group_members WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM settings_user WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM settings_tree WHERE user_id = ?', array($user_id));
	db_execute_prepared('DELETE FROM sessions WHERE user_id = ?', array($user_id));

	api_plugin_hook_function('user_remove', $user_id);
}

/**
 * user_disable - disable a user account
 *
 * @param  (int) $user_id - Id of the user account to disable
 *
 * @return (void)
 */
function user_disable($user_id) {
	/* ================= input validation ================= */
	input_validate_input_number($user_id);
	/* ==================================================== */

	db_execute_prepared("UPDATE user_auth SET enabled = '' WHERE id = ?", array($user_id));

	reset_user_perms($user_id);
}

/**
 * user_enable - enable a user account
 *
 * @param  (int) $user_id - Id of the user account to enable
 *
 * @return (void)
 */
function user_enable($user_id) {
	/* ================= input validation ================= */
	input_validate_input_number($user_id);
	/* ==================================================== */

	db_execute_prepared("UPDATE user_auth SET enabled = 'on' WHERE id = ?", array($user_id));

	reset_user_perms($user_id);
}

/**
 * get_auth_realms - return a list of system user authentication realms
 *
 * @param  (bool) $login - If true, we also set the local login realm
 *
 * @return (array) Array of login realms
 */
function get_auth_realms($login = false) {
	if (read_config_option('auth_method') == 4) {
		$drealms = db_fetch_assoc('SELECT domain_id, domain_name
			FROM user_domains
			WHERE enabled="on"
			ORDER BY domain_name');

		if (cacti_sizeof($drealms)) {
			if ($login) {
				$new_realms['0'] = array(
					'name' => __('Local'),
					'selected' => false
				);

				foreach($drealms as $realm) {
					$new_realms[1000+$realm['domain_id']] = array(
						'name' => $realm['domain_name'],
						'selected' => false
					);
				}

				$default_realm = db_fetch_cell('SELECT domain_id
					FROM user_domains
					WHERE defdomain=1
					AND enabled="on"');

				if (!empty($default_realm)) {
					$new_realms[1000+$default_realm]['selected'] = true;
				} else {
					$new_realms['0']['selected'] = true;
				}
			} else {
				$new_realms['0'] = __('Local');
				foreach($drealms as $realm) {
					$new_realms[1000+$realm['domain_id']] = $realm['domain_name'];
				}
			}

			return $new_realms;
		}
	}

	return array(
		'0' => __('Local'),
		'3' => __('LDAP'),
		'2' => __('Web Basic')
	);
}

/**
 * is_graph_allowed - determines whether the current user is allowed to view a certain graph
 *
 * @param  (int) $local_graph_id - the ID of the graph to check permissions for
 *
 * @return (bool) whether the current user is allowed the view the specified graph or not
 */
function is_graph_allowed($local_graph_id, $user_id = 0) {
	$rows  = 0;

	get_allowed_graphs('', '', '', $rows, $user_id, $local_graph_id);

	return ($rows > 0);
}

/**
 * auth_check_perms - A helper function to checking Tree permissions
 *
 * @param  (array) A set of tree objects
 * @param  (int)   $policy - The policy to check
 *
 * @return (bool) true if there is access else false
 */
function auth_check_perms($objects, $policy) {
	$objectSize = cacti_sizeof($objects);

	/* policy == allow AND matches = DENY */
	if ($objectSize && $policy == 1) {
		return false;
	/* policy == deny AND matches = ALLOW */
	} elseif ($objectSize && $policy == 2) {
		return true;
	/* policy == allow AND no matches = ALLOW */
	} elseif (!$objectSize && $policy == 1) {
		return true;
	/* policy == deny AND no matches = DENY */
	} elseif (!$objectSize && $policy == 2) {
		return false;
	}
}

/**
 * auth_augment_roles - A helper function to extend Cacti roles with additional realms
 *   or to add a new role.
 *
 * @param  (string) $role_name - The role to extend or add
 * @param  (array)  $files - The filenames to add to the role
 *
 * @return (void)
 */
function auth_augment_roles($role_name, $files) {
	global $user_auth_roles, $user_auth_realm_filenames;

	foreach($files as $file) {
		if (array_search($file, $user_auth_realm_filenames, true) !== false) {
			if (array_search($user_auth_realm_filenames[$file], $user_auth_roles[$role_name], true) === false) {
				$user_auth_roles[$role_name][] = $user_auth_realm_filenames[$file];
			}
		} else {
			if (isset($_SESSION['sess_auth_names'][$file])) {
				$realm_id = $_SESSION['sess_auth_names'][$file];
			} else {
				$realm_id = db_fetch_cell_prepared('SELECT id+100 AS realm
					FROM plugin_realms
					WHERE file = ?
					OR file LIKE ?
					OR file LIKE ?
					OR file LIKE ?',
					array(
						$file,
						$file . ',%',
						'%,' . $file . ',%',
						'%,' . $file
					)
				);

				if ($realm_id > 0) {
					$_SESSION['sess_auth_names'][$file] = $realm_id;
				}
			}

			if (!empty($realm_id)) {
				if (!isset($user_auth_roles[$role_name])) {
					$user_auth_roles[$role_name][] = $realm_id;
				} elseif (array_search($realm_id, $user_auth_roles[$role_name]) === false) {
					$user_auth_roles[$role_name][] = $realm_id;
				}
			}
		}
	}
}

/**
 * auth_augment_roles_byname - A helper function to extend Cacti roles with additional realms
 *   or to add a new role.
 *
 * @param  (string)  $role_name - The role to extend or add
 * @param  (string)  $auth_name - The name that must be mapped
 *
 * @return (void)
 */
function auth_augment_roles_byname($role_name, $auth_name) {
	global $user_auth_roles, $user_auth_realm_filenames;

	if (isset($_SESSION['sess_auth_names'][$auth_name])) {
		$realm_id = $_SESSION['sess_auth_names'][$auth_name];
	} else {
		$realm_id = db_fetch_cell_prepared('SELECT id+100 AS realm
			FROM plugin_realms
			WHERE display = ?',
			array($auth_name));

		if ($realm_id > 0) {
			$_SESSION['sess_auth_names'][$auth_name] = $realm_id;
		}
	}

	if (!empty($realm_id)) {
		if (!isset($user_auth_roles[$role_name])) {
			$user_auth_roles[$role_name][] = $realm_id;
		} elseif (array_search($realm_id, $user_auth_roles[$role_name]) === false) {
			$user_auth_roles[$role_name][] = $realm_id;
		}
	}
}

/**
 * is_tree_allowed - determines whether the current user is allowed to view a certain graph tree
 *
 * @param  (int)  $tree_id the ID of the graph tree to check permissions for
 * @param  (int)  If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (bool) whether the current user is allowed the view the specified graph tree or not
 */
function is_tree_allowed($tree_id, $user_id = 0) {
	if ($user_id == -1) {
		return true;
	}

	if (isset($_SESSION['sess_tree_perms'][$tree_id])) {
		return $_SESSION['sess_tree_perms'][$tree_id];
	}

	if (read_config_option('auth_method') != 0) {
		if ($user_id == 0) {
			if (isset($_SESSION['sess_user_id'])) {
				$user_id = $_SESSION['sess_user_id'];
			} else {
				$_SESSION['sess_tree_perms'][$tree_id] = false;

				return false;
			}
		}

		$policy = db_fetch_cell_prepared('SELECT policy_trees
			FROM user_auth
			WHERE id = ?',
			array($user_id));

		$trees  = db_fetch_assoc_prepared('SELECT user_id
			FROM user_auth_perms
			WHERE user_id = ?
			AND type = 2
			AND item_id = ?',
			array($user_id, $tree_id));

		if (auth_check_perms($trees, $policy)) {
			$_SESSION['sess_tree_perms'][$tree_id] = true;

			return true;
		}

		/* check for group perms */
		$groups = db_fetch_assoc_prepared("SELECT uag.policy_trees
			FROM user_auth_group AS uag
			INNER JOIN user_auth_group_members AS uagm
			ON uag.id = uagm.group_id
			WHERE uag.enabled = 'on'
			AND uagm.user_id = ?",
			array($user_id));

		if (!cacti_sizeof($groups)) {
			$_SESSION['sess_tree_perms'][$tree_id] = false;

			return false;
		}

		foreach ($groups as $g) {
			if (auth_check_perms($trees, $g['policy_trees'])) {
				$_SESSION['sess_tree_perms'][$tree_id] = true;

				return true;
			}
		}

		/* check for group trees */
		$gtrees = db_fetch_assoc_prepared("SELECT uagm.user_id
			FROM user_auth_group AS uag
			INNER JOIN user_auth_group_members AS uagm
			ON uag.id = uagm.group_id
			INNER JOIN user_auth_group_perms as uagp
			ON uagp.group_id = uag.id
			WHERE uag.enabled = 'on'
			AND uagm.user_id = ?
			AND uagp.item_id = ?",
			array($user_id, $tree_id));

		foreach ($groups as $g) {
			if (auth_check_perms($gtrees, $g['policy_trees'])) {
				$_SESSION['sess_tree_perms'][$tree_id] = true;
				return true;
			}
		}

		$_SESSION['sess_tree_perms'][$tree_id] = false;

		return false;
	} else {
		$_SESSION['sess_tree_perms'][$tree_id] = true;

		return true;
	}
}

/**
 * is_device_allowed - determines whether the current user is allowed to view a certain device
 *
 * @param  (int)  $device_id - the ID of the device to check permissions for
 * @param  (int)  If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (bool) whether the current user is allowed the view the specified device or not
 */
function is_device_allowed($device_id, $user_id = 0) {
	$total_rows = -2;
	get_allowed_devices('', '', '', $total_rows, $user_id, $device_id);
	return ($total_rows > 0);
}

/**
 * is_graph_template_allowed - determines whether the current user is allowed to view a certain graph template
 *
 * @param  (int)  $graph_template_id - The ID of the graph template to check permissions for
 * @param  (int)  If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (bool) whether the current user is allowed the view the specified graph template or not
 */
function is_graph_template_allowed($graph_template_id, $user = 0) {
	$total_rows = -2;
	get_allowed_graph_templates('', '', '', $total_rows, $user, $graph_template_id);

	return ($total_rows > 0);
}

/**
 * is_view_allowed - Returns a true or false as to whether or not a specific view type is allowed
 *   View options include 'show_tree', 'show_list', 'show_preview', 'graph_settings'
 *
 * @param  (string) $view - the view to check for permissions on
 *
 * @return (bool) True if allowed, else false
 */
function is_view_allowed($view = 'show_tree') {
	if (read_config_option('auth_method') != 0) {
		if (!isset($_SESSION['sess_user_id'])) {
			return false;
		}

		if (db_table_exists('user_auth_group')) {
			$values = array_rekey(
				db_fetch_assoc_prepared("SELECT DISTINCT $view
					FROM user_auth_group AS uag
					INNER JOIN user_auth_group_members AS uagm
					ON uag.id = uagm.user_id
					WHERE uag.enabled = 'on'
					AND uagm.user_id = ?",
					array($_SESSION['sess_user_id'])
				), $view, $view
			);

			if (isset($values[3])) {
				return false;
			} elseif (isset($values['on'])) {
				return true;
			} elseif (isset($values[2])) {
				return true;
			}
		}
		$value = db_fetch_cell_prepared("SELECT $view
			FROM user_auth
			WHERE id = ?",
			array($_SESSION['sess_user_id'])
		);

		return ($value == 'on');
	} else {
		return true;
	}
}

/**
 * is_tree_branch_empty - Given a tree id and a branch id, check if it's empty
 *
 * @param  (int)  $tree_id - The Cacti Tree id
 * @param  (int)  $parent  - The Cacti Tree branch id
 *
 * @return (bool) True if empty, else false
 */
function is_tree_branch_empty($tree_id, $parent = 0) {
	$graphs = array_rekey(
		db_fetch_assoc_prepared('SELECT local_graph_id
			FROM graph_tree_items
			WHERE graph_tree_id = ?
			AND local_graph_id > 0
			AND parent = ?',
			array($tree_id, $parent)
		), 'local_graph_id', 'local_graph_id'
	);

	$simple_perms = get_simple_graph_perms($_SESSION['sess_user_id']);

	if (cacti_sizeof($graphs) && ($simple_perms || cacti_sizeof(get_allowed_graphs('gl.id IN(' . implode(',', $graphs) . ')'))) > 0) {
		return false;
	}

	$hosts = array_rekey(
		db_fetch_assoc_prepared('SELECT host_id
			FROM graph_tree_items
			WHERE graph_tree_id = ?
			AND host_id > 0
			AND parent = ?',
			array($tree_id, $parent)
		), 'host_id', 'host_id'
	);

	$sites = array_rekey(
		db_fetch_assoc_prepared('SELECT site_id
			FROM graph_tree_items
			WHERE graph_tree_id = ?
			AND site_id > 0
			AND parent = ?',
			array($tree_id, $parent)
		), 'site_id', 'site_id'
	);

	if (!cacti_sizeof($sites)) {
		if (cacti_sizeof($hosts) && cacti_sizeof(get_allowed_devices('h.id IN(' . implode(',', $hosts) . ')'), 'description', '', -1) > 0) {
			return false;
		}
	} else {
		$site_hosts = array();
		foreach($sites as $site) {
			$site_hosts += array_rekey(
				db_fetch_assoc_prepared('SELECT id
					FROM host
					WHERE site_id = ?',
					array($site)
				), 'id', 'id'
			);
		}

		if (cacti_sizeof($site_hosts) && cacti_sizeof(get_allowed_devices('h.id IN(' . implode(',', $site_hosts) . ')'), 'description', '', -1) > 0) {
			return false;
		}
	}

	$branches = db_fetch_assoc_prepared('SELECT id, graph_tree_id
		FROM graph_tree_items
		WHERE graph_tree_id = ?
		AND parent = ?
		AND local_graph_id = 0
		AND host_id = 0',
		array($tree_id, $parent));

	if (cacti_sizeof($branches)) {
		foreach($branches as $b) {
			if (!is_tree_branch_empty($b['graph_tree_id'], $b['id'])) {
				return false;
			}
		}
	}

	return true;
}

/**
 * is_realm_allowed - Given a realm and a user, check their permissions if the
 *   admin changed a users settings, setup the case to redirect by clearing
 *   session variables so that when an admin makes a change, the user does not
 *   have to login again to receive them.
 *
 * @param  (int)      $realm      The realm to check
 * @param  (int|bool) $check_user The either false or the user id to check
 *
 * @return (bool) True if allowed, otherwise false
 */
function is_realm_allowed($realm, $check_user = false) {
	global $config;

	/* list all realms that this user has access to */
	if (read_config_option('auth_method') != 0) {
		/* if we are only checking another users permission, don't check cache */
		if ($check_user == false) {
			/* user is not set, no permissions */
			if (!isset($_SESSION['sess_user_id'])) {
				return false;
			}

			/* check to see if the admin invalidated a permission */
			if (!is_user_perms_valid($_SESSION['sess_user_id'])) {
				if (db_table_exists('user_auth_cache')) {
					$enabled = db_fetch_cell_prepared('SELECT enabled
						FROM user_auth
						WHERE id = ?',
						array($_SESSION['sess_user_id']));

					if ($enabled == '' && get_guest_account() !== $_SESSION['sess_user_id']) {
						db_execute_prepared('DELETE FROM user_auth_cache
							WHERE user_id = ?',
							array($_SESSION['sess_user_id']));

						kill_session_var('sess_user_id');
						kill_session_var('sess_user_realms');
						kill_session_var('sess_user_config_array');
						kill_session_var('sess_config_array');
						kill_session_var('sess_auth_names');
						kill_session_var('sess_tree_perms');
						kill_session_var('sess_simple_perms');
						kill_session_var('sess_simple_template_perms');

						print '<span style="display:none;">cactiLoginSuspend</span>';
						exit;
					} else {
						kill_session_var('sess_user_realms');
						kill_session_var('sess_user_config_array');
						kill_session_var('sess_config_array');
						kill_session_var('sess_auth_names');
						kill_session_var('sess_tree_perms');
						kill_session_var('sess_simple_perms');
						kill_session_var('sess_simple_template_perms');
					}

					print '<span style="display:none;">cactiRedirect</span>';
					exit;
				} else {
					kill_session_var('sess_user_realms');
					kill_session_var('sess_user_config_array');
					kill_session_var('sess_config_array');
					kill_session_var('sess_auth_names');
					kill_session_var('sess_tree_perms');
					kill_session_var('sess_simple_perms');
					kill_session_var('sess_simple_template_perms');
				}
			}

			/* if the permission is already valid, the session variable will be set */
			if (isset($_SESSION['sess_user_realms'][$realm])) {
				return $_SESSION['sess_user_realms'][$realm];
			}

			$user_id = $_SESSION['sess_user_id'];
		} else {
			$user_id = $check_user;
		}

		/**
		 * check the permissions from the table, should only happen once per login
		 * of after a permission change by the administrator.
		 */
		if (read_config_option('auth_method') != 0) {
			if (cacti_version_compare($config['cacti_db_version'], '1.0.0', '>=')) {
				$user_realm = db_fetch_cell_prepared("SELECT realm_id
					FROM user_auth_realm
					WHERE user_id = ?
					AND realm_id = ?
					UNION
					SELECT realm_id
					FROM user_auth_group_realm AS uagr
					INNER JOIN user_auth_group AS uag
					ON uag.id = uagr.group_id
					INNER JOIN user_auth_group_members AS uagm
					ON uag.id = uagm.group_id
					WHERE uag.enabled = 'on'
					AND uagr.realm_id = ?
					AND uagm.user_id = ?",
					array($user_id, $realm, $realm, $user_id));
			} else {
				$user_realm = db_fetch_cell_prepared('SELECT realm_id
					FROM user_auth_realm
					WHERE user_id = ?
					AND realm_id = ?',
					array($user_id, $realm));
			}

			if (!empty($user_realm)) {
				if ($check_user == false) {
					$_SESSION['sess_user_realms'][$realm] = true;
				} else {
					return true;
				}
			} else {
				if ($check_user == false) {
					$_SESSION['sess_user_realms'][$realm] = false;
				} else {
					return false;
				}
			}
		} else {
			if ($check_user == false) {
				$_SESSION['sess_user_realms'][$realm] = true;
			} else {
				return true;
			}
		}
	} else {
		if ($check_user == false) {
			$_SESSION['sess_user_realms'][$realm] = true;
		} else {
			return true;
		}
	}

	return $_SESSION['sess_user_realms'][$realm];
}

/**
 * get_allowed_tree_level - Get the permitted tree branch data available to the user
 *
 * @param  (int)  The tree id to check
 * @param  (int)  The branch id, 0 is the root of the tree
 * @param  (bool) Tells the function that the user is editing
 * @param  (int)  The user id to check for permissions. if 0 then check the current user
 *
 * @return (array) An array of Tree branch items that a re allowed (graphs, devices)
 */
function get_allowed_tree_level($tree_id, $parent_id, $editing = false, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	$items = db_fetch_assoc_prepared('SELECT gti.id, gti.title, gti.host_id,
		gti.site_id, gti.local_graph_id, gti.host_grouping_type,
		h.description AS hostname, s.name AS sitename
		FROM graph_tree_items AS gti
		INNER JOIN graph_tree AS gt
		ON gt.id = gti.graph_tree_id
		LEFT JOIN host AS h
		ON h.id = gti.host_id
		LEFT JOIN sites AS s
		ON s.id = gti.site_id
		WHERE gti.graph_tree_id = ?
		AND gti.parent = ?
		ORDER BY gti.position ASC',
		array($tree_id, $parent_id));

	if (!$editing) {
		$i = 0;
		if (cacti_sizeof($items)) {
			foreach($items as $item) {
				if ($item['host_id'] > 0) {
					if (!is_device_allowed($item['host_id'], $user_id)) {
						unset($items[$i]);
					}
				} elseif($item['local_graph_id'] > 0) {
					if (!is_graph_allowed($item['local_graph_id'], $user_id)) {
						unset($items[$i]);
					}
				}

				$i++;
			}
		}
	}

	return $items;
}

/**
 * get_allowed_tree_content - A function that gathers items and statistics of those items
 *   that are permitted on the tree specified
 *
 * @param  (int)    The tree id to check
 * @param  (int)    The branch id, 0 is the root of the tree
 * @param  (string) The Tree SQL where when searching for specific content
 * @param  (string) The SQL Order clause to use for the sorting of items
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array) An array of Tree branch items that a re allowed (graphs, devices)
 */
function get_allowed_tree_content($tree_id, $parent = 0, $sql_where = '', $sql_order = '', $sql_limit = '', &$total_rows = 0, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if (!is_numeric($tree_id)) {
		return array();
	}

	if (!is_numeric($parent)) {
		return array();
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($sql_where != '') {
		$sql_where = "WHERE gti.local_graph_id=0
			AND gti.parent=$parent
			AND gti.graph_tree_id=$tree_id
			AND (" . $sql_where . ')';
	} else {
		$sql_where = "WHERE gti.local_graph_id=0
			AND gti.parent=$parent
			AND gti.graph_tree_id=$tree_id";
	}

	$trees = array_rekey(
		get_allowed_trees(false, false, '', '', '', $total_rows, $user_id),
		'id', 'name'
	);

	if ($tree_id > 0) {
		if (cacti_sizeof($trees)) {
			$sql_where .= ' AND gt.id IN (' . implode(', ', array_keys($trees)) . ')';
		}

		$hierarchy = db_fetch_assoc("SELECT gti.graph_tree_id AS tree_id, gti.id, gti.title, gti.host_id, gti.site_id,
			gti.local_graph_id, gti.host_grouping_type, h.description AS hostname, s.name AS sitename
			FROM graph_tree_items AS gti
			INNER JOIN graph_tree AS gt
			ON gt.id = gti.graph_tree_id
			LEFT JOIN host AS h
			ON h.id = gti.host_id
			LEFT JOIN sites AS s
			ON gti.site_id=s.id
			$sql_where
			ORDER BY gti.position");
	} elseif (cacti_sizeof($trees)) {
		$hierarchy = db_fetch_assoc("SELECT gt.id AS tree_id, '0' AS id, gt.name AS title, '0' AS host_id, '0' AS site_id,
			'0' AS local_graph_id, '1' AS host_grouping_type, '' AS hostname, '' AS sitename
			FROM graph_tree AS gt
			WHERE enabled='on'
			AND gt.id IN (" . implode(', ', array_keys($trees)) . ")
			ORDER BY gt.sequence");
	}

	if (read_config_option('auth_method') != 0) {
		$new_hierarchy = array();
		if (cacti_sizeof($hierarchy)) {
			foreach($hierarchy as $h) {
				if ($h['host_id'] > 0) {
					if (is_device_allowed($h['host_id'])) {
						$new_hierarchy[] = $h;
					}
				} elseif ($h['id'] == 0) {
					if (!is_tree_branch_empty($h['tree_id'], $h['id'])) {
						if (is_tree_allowed($h['tree_id'])) {
							$new_hierarchy[] = $h;
						}
					}
				} elseif ($h['site_id'] > 0) {
					$new_hierarchy[] = $h;
				} elseif (!is_tree_branch_empty($h['tree_id'], $h['id'])) {
					$new_hierarchy[] = $h;
				}
			}
		}

		return $new_hierarchy;
	} else {
		return $hierarchy;
	}
}

/**
 * get_policies - Searches both the users and the users groups and returns a policy
 *   array to be used for determining object permissions.
 *
 * @param  (int)  If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array) An array of policy objects comprising the users permissions
 */
function get_policies($user_id) {
	/* get policies for all user groups */
	$policies = db_fetch_assoc_prepared("SELECT uag.id, 'group' AS type, uag.name,
		uag.policy_graphs, uag.policy_hosts, uag.policy_graph_templates, uag.policy_trees
		FROM user_auth_group AS uag
		INNER JOIN user_auth_group_members AS uagm
		ON uag.id = uagm.group_id
		WHERE uag.enabled = 'on'
		AND uagm.user_id = ?",
		array($user_id));

	/* get policies for the user */
	$policies[] = db_fetch_row_prepared("SELECT id, 'user' AS type, 'user' AS name,
		policy_graphs, policy_hosts, policy_graph_templates, policy_trees
		FROM user_auth
		WHERE id = ?",
		array($user_id));

	return $policies;
}

/**
 * get_allowed_tree_header_graphs - Returns the graphs that are permitted at the branch/leaf id specified
 *
 * @param  (int)    The tree id to check
 * @param  (int)    The branch id, 0 is the root of the tree
 * @param  (string) The Tree SQL where when searching for specific content
 * @param  (string) The SQL Order clause to use for the sorting of items
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array) Array of tree header graphs to display
 */
function get_allowed_tree_header_graphs($tree_id, $leaf_id = 0, $sql_where = '', $sql_order = 'gti.position', $sql_limit = '', &$total_rows = 0, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if (!is_numeric($tree_id)) {
		return array();
	}

	if (!is_numeric($leaf_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($sql_where != '') {
		$sql_where = " AND ($sql_where)";
	}

	$sql_where = "WHERE (gti.graph_tree_id=$tree_id AND gti.parent=$leaf_id)" . $sql_where;

	if (read_user_setting('hide_disabled') == 'on') {
		$sql_where .= ($sql_where != '' ? ' AND ':'') . '(h.disabled = "" OR h.disabled IS NULL)';
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	$graph_auth_method = read_config_option('graph_auth_method');

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	if ($auth_method != 0) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	$graphs = db_fetch_assoc("SELECT gti.id, gti.title, gtg.local_graph_id, h.description,
		gt.name AS template_name, gtg.title_cache, gtg.width, gtg.height,
		gl.snmp_index, gl.snmp_query_id
		FROM graph_templates_graph AS gtg
		INNER JOIN graph_local AS gl
		ON gl.id = gtg.local_graph_id
		INNER JOIN graph_tree_items AS gti
		ON gti.local_graph_id = gl.id
		LEFT JOIN graph_templates AS gt
		ON gt.id = gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id = gl.host_id
		$sql_where
		$sql_order
		$sql_limit");

	$sql = "SELECT COUNT(*)
		FROM graph_templates_graph AS gtg
		INNER JOIN graph_local AS gl
		ON gl.id=gtg.local_graph_id
		INNER JOIN graph_tree_items AS gti
		ON gti.local_graph_id=gl.id
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id=gl.host_id
		$sql_where";

	$total_rows = get_total_row_data($user_id, $sql, array(), 'graph');

	return $graphs;
}

/**
 * get_allowed_graphs - Returns the graphs that are permitted by the user.  Used for table displays
 *   where users will view the graphs that they are permitted to access
 *
 * @param  (string) The SQL where when searching for specific content
 * @param  (string) The SQL Order clause to use for the sorting of graphs
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If just searching for if a single graph is permitted, the id of that graph
 *
 * @return (array) Array of allowed graphs
 */
function get_allowed_graphs($sql_where = '', $sql_order = 'gtg.title_cache', $sql_limit = '', &$total_rows = 0, $user_id = 0, $graph_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '') {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($graph_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : ' ') . " gl.id = $graph_id";
	}

	if (read_user_setting('hide_disabled') == 'on') {
		$sql_where .= ($sql_where != '' ? ' AND ':'') . '(h.disabled = "" OR h.disabled IS NULL)';
	}

	if ($sql_where != '') {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) AND $sql_where";
	} else {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL)";
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	/* see if permissions are simple */
	$simple_perms = get_simple_graph_perms($user_id);

	/* in case we need to review get the graph_auth_method */
	$graph_auth_method = read_config_option('graph_auth_method');

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	if (!$simple_perms && $auth_method != 0) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	$graphs = db_fetch_assoc("SELECT gtg.local_graph_id, h.description, gt.name AS template_name,
		gtg.title_cache, gtg.width, gtg.height, gl.snmp_index, gl.snmp_query_id,
		IF(gl.graph_template_id=0, 0, IF(gl.snmp_query_id=0, 2, 1)) AS graph_source
		FROM graph_templates_graph AS gtg
		INNER JOIN graph_local AS gl
		ON gl.id=gtg.local_graph_id
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id=gl.host_id
		$sql_where
		$sql_order
		$sql_limit");

	$sql = "SELECT COUNT(*)
		FROM graph_templates_graph AS gtg
		INNER JOIN graph_local AS gl
		ON gl.id=gtg.local_graph_id
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id=gl.host_id
		$sql_where";

	if ($graph_id == 0) {
		$total_rows = get_total_row_data($user_id, $sql, array(), 'graph');
	} else {
		$total_rows = db_fetch_cell($sql);
	}

	return $graphs;
}

/**
 * get_allowed_aggregate_graphs - Returns the aggregate graphs that are permitted by the user.
 *   Used for table displays where users will view the graphs that they are permitted to access
 *
 * @param  (string) The SQL where when searching for specific content
 * @param  (string) The SQL Order clause to use for the sorting of graphs
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If just searching for if a single graph is permitted, the id of that graph
 *
 * @return (array) Array of allowed graphs
 */
function get_allowed_aggregate_graphs($sql_where = '', $sql_order = 'gtg.title_cache', $sql_limit = '', &$total_rows = 0, $user_id = 0, $graph_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($graph_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : ' ') . " gl.id = $graph_id";
	}

	if (read_user_setting('hide_disabled') == 'on') {
		$sql_where .= ($sql_where != '' ? ' AND ':'') . '(h.disabled = "" OR h.disabled IS NULL)';
	}

	if ($sql_where != '') {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) AND $sql_where";
	} else {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL)";
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	/* see if permissions are simple */
	$simple_perms = get_simple_graph_perms($user_id);

	/* in case we need to review get the graph_auth_method */
	$graph_auth_method = read_config_option('graph_auth_method');

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	if (!$simple_perms && $auth_method != 0) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	$graphs = db_fetch_assoc("SELECT gtg.local_graph_id, '' AS description, gt.name AS template_name,
		gtg.title_cache, gtg.width, gtg.height, gl.snmp_index, gl.snmp_query_id
		FROM graph_templates_graph AS gtg
		INNER JOIN (
			SELECT ag.local_graph_id AS id, gl.host_id, gl.graph_template_id,
			gl.snmp_query_id, gl.snmp_query_graph_id, gl.snmp_index
			FROM aggregate_graphs AS ag
			INNER JOIN aggregate_graphs_items AS agi
			ON ag.id=agi.aggregate_graph_id
			INNER JOIN graph_local AS gl
			ON gl.id=agi.local_graph_id
		) AS gl
		ON gl.id=gtg.local_graph_id
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id=gl.host_id
		$sql_where
		GROUP BY gtg.local_graph_id
		$sql_order
		$sql_limit");

	$sql = "SELECT COUNT(DISTINCT gl.id)
		FROM graph_templates_graph AS gtg
		INNER JOIN (
			SELECT ag.local_graph_id AS id, gl.host_id, gl.graph_template_id,
			gl.snmp_query_id, gl.snmp_query_graph_id, gl.snmp_index
			FROM aggregate_graphs AS ag
			INNER JOIN aggregate_graphs_items AS agi
			ON ag.id=agi.aggregate_graph_id
			INNER JOIN graph_local AS gl
			ON gl.id=agi.local_graph_id
		) AS gl
		ON gl.id=gtg.local_graph_id
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN host AS h
		ON h.id=gl.host_id
		$sql_where";

	$total_rows = get_total_row_data($user_id, $sql, array(), 'aggregate_graph');

	return $graphs;
}

/**
 * get_simple_device_perms - Returns a boolean true or false if the user has full access to
 *   all devices in the system.  This function is used to shortcut complex queries that may
 *   take multiple seconds to return an answer.
 *
 * @param  (int)    The user id to check for permissions for
 *
 * @return (bool)   True if simple permissions are in place, otherwise false
 */
function get_simple_device_perms($user) {
	$policy_hosts = db_fetch_cell_prepared('SELECT policy_hosts
		FROM user_auth
		WHERE id = ?',
		array($user));

	$perm_count = db_fetch_cell_prepared('SELECT COUNT(*)
		FROM user_auth_perms
		WHERE user_id = ?
		AND type = 2',
		array($user));

	if ($policy_hosts == 1 && $perm_count == 0) {
		return true;
	} else {
		$policies = db_fetch_assoc_prepared('SELECT policy_hosts, COUNT(*) AS exceptions
			FROM user_auth_group AS uag
			INNER JOIN user_auth_group_perms AS uagp
			ON uag.id = uagp.group_id
			INNER JOIN user_auth_group_members AS uagm
			ON uagm.group_id = uag.id
			WHERE uagp.type = 2
			AND uagm.user_id = ?
			GROUP BY uag.id',
			array($user));

		if (cacti_sizeof($policies)) {
			foreach($policies as $p) {
				if ($p['policy_hosts'] == 1 && $p['exceptions'] == 0) {
					return true;
				}
			}
		}

		return false;
	}
}

/**
 * get_simple_graph_perms - Returns a boolean true or false if the user has full access to
 *   all graphs in the system.  This function is used to shortcut complex queries that may
 *   take multiple seconds to return an answer.
 *
 * @param  (int)    The user id to check for permissions for
 *
 * @return (bool)   True if simple permissions are in place, otherwise false
 */
function get_simple_graph_perms($user_id) {
	if (isset($_SESSION['sess_simple_perms'])) {
		return $_SESSION['sess_simple_perms'];
	}

	$policy_graphs = db_fetch_cell_prepared('SELECT policy_graphs
		FROM user_auth
		WHERE id = ?',
		array($user_id));

	$perm_count = db_fetch_cell_prepared('SELECT COUNT(*)
		FROM user_auth_perms
		WHERE user_id = ?
		AND type = 1',
		array($user_id));

	if ($policy_graphs == 1 && $perm_count == 0) {
		$_SESSION['sess_simple_perms'] = true;

		return true;
	} else {
		$policies = db_fetch_assoc_prepared('SELECT policy_graphs, COUNT(*) AS exceptions
			FROM user_auth_group AS uag
			INNER JOIN user_auth_group_perms AS uagp
			ON uag.id = uagp.group_id
			INNER JOIN user_auth_group_members AS uagm
			ON uagm.group_id = uag.id
			WHERE uagp.type = 1
			AND uagm.user_id = ?
			GROUP BY uag.id',
			array($user_id));

		if (cacti_sizeof($policies)) {
			foreach($policies as $p) {
				if ($p['policy_graphs'] == 1 && $p['exceptions'] == 0) {
					$_SESSION['sess_simple_perms'] = true;

					return true;
				}
			}
		}

		$_SESSION['sess_simple_perms'] = false;

		return false;
	}
}

/**
 * get_simple_graph_template_perms - Returns a boolean true or false if the user has full access to
 *   all graphs templates in the system.  This function is used to shortcut complex queries that may
 *   take multiple seconds to return an answer.
 *
 * @param  (int)    The user id to check for permissions for
 *
 * @return (bool)   True if simple permissions are in place, otherwise false
 */
function get_simple_graph_template_perms($user_id) {
	if (isset($_SESSION['sess_simple_template_perms'])) {
		return $_SESSION['sess_simple_template_perms'];
	}

	$policy_graph_templates = db_fetch_cell_prepared('SELECT policy_graph_templates
		FROM user_auth
		WHERE id = ?',
		array($user_id));

	$perm_count = db_fetch_cell_prepared('SELECT COUNT(*)
		FROM user_auth_perms
		WHERE user_id = ?
		AND type = 4',
		array($user_id));

	if ($policy_graph_templates == 1 && $perm_count == 0) {
		$_SESSION['sess_simple_template_perms'] = true;

		return true;
	} else {
		$policies = db_fetch_assoc_prepared('SELECT policy_graph_templates, COUNT(*) AS exceptions
			FROM user_auth_group AS uag
			INNER JOIN user_auth_group_perms AS uagp
			ON uag.id = uagp.group_id
			INNER JOIN user_auth_group_members AS uagm
			ON uagm.group_id = uag.id
			WHERE uagp.type = 4
			AND uagm.user_id = ?
			GROUP BY uag.id',
			array($user_id));

		if (cacti_sizeof($policies)) {
			foreach($policies as $p) {
				if ($p['policy_graph_templates'] == 1 && $p['exceptions'] == 0) {
					$_SESSION['sess_simple_template_perms'] = true;

					return true;
				}
			}
		}

		$_SESSION['sess_simple_template_perms'] = false;

		return false;
	}
}

/**
 * get_allowed_graph_templates - returns the list of Graph Templates that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays.
 *
 * @param  (string) The SQL where when searching for specific content
 * @param  (string) The SQL Order clause to use for the sorting of graphs
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If just searching for if a single graph template is permitted, the id of that graph template
 *
 * @return (array)  An array of permitted Graph Templates
 */
function get_allowed_graph_templates($sql_where = '', $sql_order = 'gt.name', $sql_limit = '', &$total_rows = 0, $user_id = 0, $graph_template_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	// For timing
	$start = microtime(true);

	$init_rows = $total_rows;

	$templates = array();

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($graph_template_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : ' ') . "(gl.graph_template_id = $graph_template_id)";
	}

	$sql_where = 'WHERE ' . ($sql_where != '' ? $sql_where . ' AND ':' ') . '(gt.id IS NOT NULL) ';

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	/* see if permissions are simple */
	$simple_perms = get_simple_graph_perms($user_id);

	/* in case we need to review get the graph_auth_method */
	$graph_auth_method = read_config_option('graph_auth_method');

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	/* short circuit if we don't have a user */
	if ($auth_method > 0 && $user_id == 0) {
		return array();
	}

	if (!$simple_perms && $auth_method != 0) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	if ($total_rows != -2) {
		$templates = db_fetch_assoc("SELECT gt.id, gt.name, COUNT(*) AS graphs
			FROM graph_local AS gl
			LEFT JOIN graph_templates AS gt
			ON gt.id = gl.graph_template_id
			LEFT JOIN host AS h
			ON h.id = gl.host_id
			$sql_where
			GROUP BY gl.graph_template_id
			$sql_order
			$sql_limit");
	}

	if ($total_rows >= 0 || $total_rows == -2) {
		$sql = "SELECT COUNT(DISTINCT gl.graph_template_id) AS id
			FROM graph_local AS gl
			LEFT JOIN graph_templates AS gt
			ON gt.id = gl.graph_template_id
			LEFT JOIN host AS h
			ON h.id = gl.host_id
			$sql_where";

		if ($graph_template_id == 0) {
			$total_rows = get_total_row_data($user_id, $sql, array(), 'graph');
		} else {
			$total_rows = db_fetch_cell($sql);
		}
	}

	// For timing
	$end = microtime(true);

	cacti_log(sprintf('The Get Templates total time was %4.2f', $end - $start), false, 'AUTH', POLLER_VERBOSITY_DEBUG);

	if ($templates === false) {
		$templates = array();
	}

	return $templates;
}

/**
 * get_policy_join_select - Parse the policies in order to visually display user permissions
 *
 * @param  (array) $policies  The list of user and group policies.  Will be reversed to
 *   show user permissions first.
 *
 * @return (array)  Array containing both $sql_select and $sql_join
 */
function get_policy_join_select($policies) {
	$sql_join   = '';
	$sql_select = '';

	$i = 1;
	$j = 1;
	foreach($policies as $p) {
		$sql_join   .= "LEFT JOIN (SELECT * FROM user_auth_" . ($p['type'] == 'user' ? '' : 'group_') . "perms WHERE " . $p['type'] . '_id = ' . $p['id'] . ") AS uap$j ON (gl.id = uap$j.item_id AND uap$j.type = 1) ";
		$sql_select .= ($sql_select != '' ? ', ' : '') . "uap$j." . $p['type'] . "_id AS graph$i";
		$j++;

		$sql_join   .= 'LEFT JOIN (SELECT * FROM user_auth_' . ($p['type'] == 'user' ? '' : 'group_') . "perms WHERE " . $p['type'] . '_id = ' . $p['id'] . ") AS uap$j ON (gl.host_id = uap$j.item_id AND uap$j.type = 3) ";
		$sql_select .= ($sql_select != '' ? ', ' : '') . "uap$j." . $p['type'] . "_id AS device$i";
		$j++;

		$sql_join   .= 'LEFT JOIN (SELECT * FROM user_auth_' . ($p['type'] == 'user' ? '' : 'group_') . "perms WHERE " . $p['type'] . '_id = ' . $p['id'] . ") AS uap$j ON (gl.graph_template_id = uap$j.item_id AND uap$j.type = 4) ";
		$sql_select .= ($sql_select != '' ? ', ' : '') . "uap$j." . $p['type'] . "_id AS template$i";
		$j++;

		$i++;
	}

	return array('sql_select' => $sql_select, 'sql_join' => $sql_join);
}

/**
 * get_policy_where - Parse the policies in order to downselect matching graphs
 *   without the use of the SQL Having clause which is very inefficient
 *
 * @param  (int)    $graph_auth_method - The graph auth method: permissive, restrictive, device, graph_template
 * @param  (array)  $policies - The list of user and group policies.  Will be reversed to
 * @param  (string) $sql_where - The SQL where filter provided by the calling function.
 *
 * @return (string) - Updated sql_where value
 */
function get_policy_where($graph_auth_method, $policies, $sql_where) {
	if ($graph_auth_method == 1) {
		// Policy Rows include
		// id, type (group|user), policy_graphs, policy_hosts, policy_graph_templates

		// Table user_auth_perms has user_id, item_id, type
		// Types can be:
		// 1 - Graph
		// 2 - Trees
		// 3 - Device
		// 4 - Graph Template

		// Policies are
		// 1 - Default Allow, all exceptions are denied
		// 2 - Default Deny, all exceptions are allowed

		// Permissive means access to the graph, or access to either the host or template

		$sql_where .= ($sql_where != '' ? ' AND (':'WHERE (');

		foreach($policies as $index => $p) {
			$sql_where .= ($index > 0 ? ' OR (':'(');

			if ($p['type'] == 'user') {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ' OR ';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				}

				$sql_where .= ' OR ';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= 'gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= 'gl.graph_template_id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				}
			} else {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ' OR ';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				}

				$sql_where .= ' OR ';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= 'gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= 'gl.graph_template_id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 4)';
				}
			}

			$sql_where .= ')';
		}

		$sql_where .= ')';
	} elseif ($graph_auth_method == 2) {
		// Policy Rows include
		// id, type (group|user), policy_graphs, policy_hosts, policy_graph_templates

		// Table user_auth_perms has user_id, item_id, type
		// Types can be:
		// 1 - Graph
		// 2 - Trees
		// 3 - Device
		// 4 - Graph Template

		// Policies are
		// 1 - Default Allow, all exceptions are denied
		// 2 - Default Deny, all exceptions are allowed

		// Restrictive means access to the graph, or access to both the host and template

		$sql_where .= ($sql_where != '' ? ' AND (':'WHERE (');

		foreach($policies as $index => $p) {
			$sql_where .= ($index == 0 ? '((':' OR ((');

			if ($p['type'] == 'user') {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				}

				$sql_where .= ' AND ';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= ' gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= ' gl.graph_template_id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				}

				$sql_where .= ')';
			} else {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				}

				$sql_where .= ' AND ';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= 'gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= 'gl.graph_template_id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 4)';
				}

				$sql_where .= ')';
			}

			$sql_where .= ')';
		}

		$sql_where .= ')';
	} elseif ($graph_auth_method == 3) {
		// Policy Rows include
		// id, type (group|user), policy_graphs, policy_hosts, policy_graph_templates

		// Table user_auth_perms has user_id, item_id, type
		// Types can be:
		// 1 - Graph
		// 2 - Trees
		// 3 - Device
		// 4 - Graph Template

		// Policies are
		// 1 - Default Allow, all exceptions are denied
		// 2 - Default Deny, all exceptions are allowed

		$sql_where .= ($sql_where != '' ? ' AND (':'WHERE (');

		foreach($policies as $index => $p) {
			$sql_where .= ($index == 0 ? '((' : ') OR ((');

			if ($p['type'] == 'user') {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 3)';
				}
			} else {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_hosts'] == 1) {
					$sql_where .= 'h.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				} else {
					$sql_where .= 'h.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 3)';
				}
			}

			$sql_where .= ')';
		}

		$sql_where .= '))';
	} elseif ($graph_auth_method == 4) {
		// Policy Rows include
		// id, type (group|user), policy_graphs, policy_hosts, policy_graph_templates

		// Table user_auth_perms has user_id, item_id, type
		// Types can be:
		// 1 - Graph
		// 2 - Trees
		// 3 - Device
		// 4 - Graph Template

		// Policies are
		// 1 - Default Allow, all exceptions are denied
		// 2 - Default Deny, all exceptions are allowed

		$sql_where .= ($sql_where != '' ? ' AND (':'WHERE (');

		foreach($policies as $index => $p) {
			$sql_where .= ($index == 0 ? '((' : ') OR ((');

			if ($p['type'] == 'user') {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= 'gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= 'gl.graph_template_id IN (SELECT item_id FROM user_auth_perms WHERE user_id = ' . $p['id'] . ' AND type = 4)';
				}
			} else {
				if ($p['policy_graphs'] == 1) {
					$sql_where .= 'gl.id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				} else {
					$sql_where .= 'gl.id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 1)';
				}

				$sql_where .= ') OR (';

				if ($p['policy_graph_templates'] == 1) {
					$sql_where .= 'gl.graph_template_id NOT IN (SELECT item_id FROM user_auth_group_perms WHERE group_id = ' . $p['id'] . ' AND type = 4)';
				} else {
					$sql_where .= 'gl.graph_template_id IN (SELECT item_id FROM user_auth_group_perms WHERE group_id =' . $p['id'] . ' AND type = 4)';
				}
			}

			$sql_where .= ')';
		}

		$sql_where .= '))';
	}

	return $sql_where;
}

/**
 * get_permission_string - get the effective permission string for the graph in question.  The
 *   logic for this is somewhat complex, but understandable.  First, the $graph object will include
 *   three columns generally graphX, deviceX, and templateX for each of the user or groups in the collection.
 *   The way we assign a restrictive or permissive value is based upon the graph permission setting
 *   in Cacti, but also whether or not the default access for the object type is either 'Allow' or 'Deny'.
 *
 *   - If the 'default access' for the object type is 'Deny', then a numeric value in userX means
 *     the user has permission to an object.
 *   - If the default access for the object is 'Allow', then a numeric
 *     value in userX means that the object is blocked.
 *
 *   Again, each of the graphX, deviceX, and templateX will always come in three's.  They equate to:
 *
 *   - graphX    - The user does or does not have permission to the Graph at the Graph Level
 *   - deviceX   - The user does or does not have permission to the Graph at the Device Level
 *   - templateX - The user does or does not have permission to the Graph at the Graph Template Level
 *
 *   Then, the effective permission are calculated by the Graph Permission Model in Cacti.  They are
 *
 *   - Permissive - If the user has access to the Graph, the Device, or Graph Template, then the
 *     user will have access to the Graph.
 *
 *   - Restrictive - If the user has access to the Graph, or both the Device and Graph Template,
 *     then the user will have access to the Graph
 *
 *   - Device - If the user has access to the Graph, or the Device, then the user will have
 *     access to the Graph
 *
 *   - Graph Template - If the user has access to the Graph, or the Graph Template, then the user
 *     will have access to the Graph.
 *
 *   This function will apply this logic, and then respond to the user a 'Granted' or 'Restricted'
 *   column value, and a Tooltip, that shows how the permissions were evaluated.  In other words
 *   why was the user either permitted to or denied access to the Graph.
 */
function get_permission_string(&$graph, &$policies) {
	$grantStr   = '';
	$rejectStr  = '';
	$reasonStr  = '';
	$drejectStr = '';

	// Methods:
	// 1 - Permissive
	// 2 - Restrictive
	// 3 - Device
	// 4 - Graph Template
	$method = read_config_option('graph_auth_method');

	if ($graph['disabled'] == 'on' && read_user_setting('hide_disabled', false, false, get_request_var('user_id'))) {
		$drejectStr .= __esc('Device:(Hide Disabled)');
	}

	// Policies:
	// 1 - Default Allow All - Numeric means blocked
	// 2 - Default Deny All  - Numeric means allowed

	$i = 1;
	foreach($policies as $p) {
		$allowed  = 0;
		$rejected = 0;

		// Perform the Graph Check first
		// If a user has access at the Graph Access, they always get Access
		if ($p['policy_graphs'] == 1) {
			// Default is to allow
			if (empty($graph["graph$i"])) {
				// Allow the access at the level
				$grantStr .= ($grantStr != '' ? ', ':'') . __esc('Graph:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
			} else {
				$rejectStr .= ($rejectStr != '' ? ', ':'') . __esc('Graph:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
				$rejected++;
			}
		} else {
			// Default is to Deny
			if (!empty($graph["graph$i"])) {
				$grantStr .= ($grantStr != '' ? ', ':'') . __esc('Graph:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
			} else {
				$rejectStr .= ($rejectStr != '' ? ', ':'') . __esc('Graph:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
				$rejected++;
			}
		}

		/**
		 * Now we check at the Device and Graph Template Level.  Here the permission get a bit more dicey, so we will
		 * Use case logic to make it read more simply.
		 */
		switch($method) {
			case 1: // Permissive
				if ($p['policy_hosts'] == 1) {
					if (empty($graph["device$i"])) {
						$grantStr .= ($grantStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejected++;
					}
				} else {
					if (!empty($graph["device$i"])) {
						$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejected++;
					}
				}

				if ($p['policy_graph_templates'] == 1) {
					if (empty($graph["template$i"])) {
						$grantStr .= ($grantStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejected++;
					}
				} else {
					if (!empty($graph["template$i"])) {
						$grantStr .= ($grantStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejected++;
					}
				}

				if ($rejected == 3) {
					$rejectStr .= ($rejectStr != '' ? ', ':'') . __esc('Graph+Device+Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
				}

				break;
			case 2: // Restrictive
				$allowed  = 0;
				$rejected = 0;

				if ($p['policy_hosts'] == 1) {
					if (empty($graph["device$i"])) {
						$allowed++;
					} else {
						$rejected++;
					}
				} else {
					if (!empty($graph["device$i"])) {
						$allowed++;
					} else {
						$rejected++;
					}
				}

				if ($p['policy_graph_templates'] == 1) {
					if (empty($graph["template$i"])) {
						$allowed++;
					} else {
						$rejected++;
					}
				} else {
					if (!empty($graph["template$i"])) {
						$rejected++;
					} else {
						$allowed++;
					}
				}

				if ($allowed == 2) {
					$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Device+Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
				} else {
					$rejectStr = $rejectStr . ($rejectStr != '' ? ', ':'') . __esc('Device+Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
				}

				break;
			case 3: // Device
				if ($p['policy_hosts'] == 1) {
					if (empty($graph["device$i"])) {
						$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejectStr = $rejectStr . ($rejectStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					}
				} else {
					if (!empty($graph["device$i"])) {
						$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejectStr = $rejectStr . ($rejectStr != '' ? ', ':'') . __esc('Device:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					}
				}

				break;
			case 4: // Graph Template
				if ($p['policy_graph_templates'] == 1) {
					if (empty($graph["template$i"])) {
						$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejectStr = $rejectStr . ($rejectStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					}
				} else {
					if (!empty($graph["template$i"])) {
						$grantStr = $grantStr . ($grantStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					} else {
						$rejectStr = $rejectStr . ($rejectStr != '' ? ', ':'') . __esc('Template:(%s%s)', ucfirst($p['type']), ($p['type'] != 'user' ? '/' . $p['name']:''));
					}
				}

				break;
		}

		$i++;
	}

	$permStr = '';

	if ($drejectStr != '') {
		$reasonStr .= ($reasonStr != '' ? ', ':'') . __esc('Restricted By: ') . $drejectStr;
	}

	if ($grantStr != '') {
		$reasonStr .= ($reasonStr != '' ? ', ':'') . __esc('Granted By: ') . trim($grantStr, ',');

		if ($rejectStr != '') {
			$reasonStr .= ', ' . __esc('Restricted By: ') . trim($rejectStr, ',');
		}

		if ($drejectStr == '') {
			$permStr = "<span data-tooltip='" . trim($reasonStr) . "' class='accessGranted'>" . __('Granted') . '</span>';
		} else {
			$permStr = "<span data-tooltip='" . trim($reasonStr) . "' class='accessRestricted'>" . __('Restricted') . '</span>';
		}
	} elseif ($rejectStr != '') {
		$reasonStr .= ($reasonStr != '' ? ', ':'') . __esc('Restricted By: ') . trim($rejectStr, ',');

		$permStr   = "<span data-tooltip='" . $reasonStr . "' class='accessRestricted'>" . __('Restricted') . '</span>';
	} else {
		$permStr = __('Unknown');
	}

	return $permStr;
}

/**
 * get_allowed_trees - returns the list of Trees that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays as
 *   well as to build out the tree for a user.
 *
 * @param  (bool)   Is the Tree in Edit mode or not
 * @param  (bool)   Return either the SQL used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of graphs
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If just searching for if a single graph template is permitted, the id of that graph template
 *
 * @return (string|array)  An array of permitted Trees or the SQL to gather them
 */
function get_allowed_trees($edit = false, $return_sql = false, $sql_where = '', $sql_order = 'name', $sql_limit = '', &$total_rows = 0, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method != 0) {
		if ($user_id == 0) {
			if (isset($_SESSION['sess_user_id'])) {
				$user_id = $_SESSION['sess_user_id'];
			} else {
				return array();
			}
		}

		/* get policies for all groups and user */
		$policies = db_fetch_assoc_prepared("SELECT uag.id, 'group' AS type, policy_trees FROM user_auth_group AS uag
			INNER JOIN user_auth_group_members AS uagm
			ON uag.id = uagm.group_id
			WHERE uag.enabled = 'on'
			AND uagm.user_id = ?",
			array($user_id));

		$policies[] = db_fetch_row_prepared("SELECT id, 'user' as type, policy_trees FROM user_auth WHERE id = ?", array($user_id));

		$i          = 0;
		$sql_join   = '';
		$sql_where1 = '';

		foreach($policies as $policy) {
			if ($policy['policy_trees'] == '1') {
				$sql_where1 .= ($sql_where1 != '' ? ' OR':'') . " uap$i." . $policy['type'] . "_id IS NULL";
			} elseif ($policy['policy_trees'] == '2') {
				$sql_where1 .= ($sql_where1 != '' ? ' OR':'') . " uap$i." . $policy['type'] . "_id IS NOT NULL";
			}

			$sql_join .= 'LEFT JOIN user_auth_' . ($policy['type'] == 'group' ? 'group_':'') . "perms AS uap$i
				ON (gt.id=uap$i.item_id AND uap$i.type=2 AND uap$i." . $policy['type'] . '_id=' . $policy['id'] . ') ';

			$i++;
		}

		if ($sql_where != '') {
			$sql_where = 'WHERE ' . ($edit == false ? '(gt.enabled="on") AND ':'') . '(' . $sql_where . ') AND (' . $sql_where1 . ')';
		} else {
			$sql_where = 'WHERE ' . ($edit == false ? '(gt.enabled="on") AND ':'') . '(gt.enabled="on") AND (' . $sql_where1 . ')';
		}

		$sql = "SELECT id, name
			FROM graph_tree AS gt
			$sql_join
			$sql_where
			$sql_order
			$sql_limit";

		if ($return_sql) {
			return $sql;
		} else {
			$trees = db_fetch_assoc($sql);

			$sql = "SELECT COUNT(gt.id)
				FROM graph_tree AS gt
				$sql_join
				$sql_where";

			$total_rows = get_total_row_data($user_id, $sql, array(), 'tree');
		}
	} else {
		if ($sql_where != '') {
			$sql_where = "WHERE enabled='on' AND $sql_where";
		} else {
			$sql_where = "WHERE enabled='on'";
		}

		if ($return_sql) {
			return "SELECT id, name FROM graph_tree $sql_where $sql_order";
		} else {
			$trees = db_fetch_assoc("SELECT id, name FROM graph_tree AS gt $sql_where $sql_order");

			$sql = "SELECT COUNT(*) FROM graph_tree AS gt $sql_where";

			$total_rows = get_total_row_data($user_id, $sql, array(), 'tree');
		}
	}

	return $trees;
}

/**
 * get_allowed_branches - returns the list of Tree branches that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays as
 *   well as to build out the tree for a user.
 *
 * @param  (bool)   Is the Tree in Edit mode or not
 * @param  (string) The SQL Where used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of branches
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array)  An array of permitted Tree branches
 */
function get_allowed_branches($sql_where = '', $sql_order = 'name', $sql_limit = '', &$total_rows = 0, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	// suppress total rows
	$total_rows = -1;

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	$simple_perms = get_simple_device_perms($user_id);

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	$sql_hosts_where = '';

	if (!$simple_perms) {
		$hosts = get_allowed_devices('', 'description', '', $total_rows);

		if (cacti_sizeof($hosts)) {
			$hosts = array_rekey($hosts, 'id', 'description');
		}

		$tree_hosts = db_fetch_assoc("SELECT DISTINCT h.id, h.description
			FROM graph_tree_items AS gti
			INNER JOIN graph_tree AS gt
			ON gti.graph_tree_id = gt.id
			INNER JOIN host AS h
			ON gti.host_id = h.id
			WHERE gti.host_id > 0
			AND $sql_where", false);

		if (cacti_sizeof($tree_hosts)) {
			$tree_hosts = array_rekey($tree_hosts, 'id', 'description');
		}

		$hosts = array_intersect_key($hosts, $tree_hosts);

		if (cacti_sizeof($hosts) > 0) {
			$sql_hosts_where =  'AND h.id IN (' . implode(',', array_keys($hosts)) . ')';
		}
	}

	if ($auth_method != 0) {
		$i          = 0;
		$sql_join   = '';
		$sql_where1 = '';

		foreach($policies as $policy) {
			if ($policy['policy_trees'] == '1') {
				$sql_where1 .= ($sql_where1 != '' ? ' OR':'') . " uap$i." . $policy['type'] . "_id IS NULL";
			} elseif ($policy['policy_trees'] == '2') {
				$sql_where1 .= ($sql_where1 != '' ? ' OR':'') . " uap$i." . $policy['type'] . "_id IS NOT NULL";
			}

			$sql_join .= 'LEFT JOIN user_auth_' . ($policy['type'] == 'group' ? 'group_':'') . "perms AS uap$i
				ON (gt.id=uap$i.item_id AND uap$i.type=2 AND uap$i." . $policy['type'] . '_id=' . $policy['id'] . ') ';

			$i++;
		}

		if ($sql_where != '') {
			$sql_where = 'WHERE gt.enabled="on" AND (' . $sql_where . ')' . ($sql_where1 != '' ? ' AND (' . $sql_where1 . ')':'');
		} elseif ($sql_where1 != '') {
			$sql_where = 'WHERE gt.enabled="on" AND (' . $sql_where1 . ')';
		}

		$sql = "(SELECT gti.id, CONCAT('". __('Branch:') . " ', gti.title) AS name
			FROM graph_tree AS gt
			INNER JOIN graph_tree_items AS gti
			ON gti.graph_tree_id = gt.id
			AND gti.host_id = 0
			AND gti.local_graph_id=0
			$sql_join
			$sql_where
			) UNION (
			SELECT gti.id, CONCAT('" . __('Device:') . " ', h.description) AS name
			FROM graph_tree AS gt
			INNER JOIN graph_tree_items AS gti
			ON gti.graph_tree_id = gt.id
			INNER JOIN host AS h
			ON h.id=gti.host_id
			$sql_hosts_where
			$sql_join
			$sql_where
 			)
			$sql_order
			$sql_limit";

		$branches = db_fetch_assoc($sql);

		$sql = 'SELECT COUNT(*) FROM (' . $sql . ') AS rower';

		$total_rows = get_total_row_data($user_id, $sql, array(), 'branch');
	} else {
		if ($sql_where != '') {
			$sql_where = "WHERE gt.enabled='on' AND h.disabled='' AND ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) AND $sql_where";
		} else {
			$sql_where = "WHERE gt.enabled='on' AND h.disabled='on' AND ((h.id > 0 AND h.deleted = '') OR h.id IS NULL)";
		}

		$sql = "(
			SELECT gti.id, CONCAT('". __('Branch:') . " ', gti.title) AS name
			FROM graph_tree AS gt
			INNER JOIN graph_tree_items AS gti
			ON gti.graph_tree_id = gt.id
			AND gti.host_id=0
			AND gti.local_graph_id=0
			$sql_where
			) UNION (
			SELECT gti.id, CONCAT('" . __('Device:') . " ', h.description) AS name
			FROM graph_tree AS gt
			INNER JOIN graph_tree_items AS gti
			ON gti.graph_tree_id = gt.id
			INNER JOIN host AS h
			ON h.id=gti.host_id
			$sql_join
			$sql_where
			)
			$sql_order
			$sql_limit";

		$branches = db_fetch_assoc($sql);

		$sql = 'SELECT COUNT(*) FROM (' . $sql . ') AS rower';

		$total_rows = get_total_row_data($user_id, $sql, array(), 'branch');
	}

	return $branches;
}

/**
 * get_allowed_devices - returns the list of devices that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays as
 *   well as other tasks.
 *
 * @param  (string) The SQL Where used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of devices
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array)  An array of permitted devices
 */
function get_allowed_devices($sql_where = '', $sql_order = 'description', $sql_limit = '', &$total_rows = 0, $user_id = 0, $device_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	$simple_perms = get_simple_device_perms($user_id);

	$init_rows = $total_rows;

	$host_list = array();

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if (read_user_setting('hide_disabled') == 'on') {
		$sql_where .= ($sql_where != '' ? ' AND ':'') . '(h.disabled = "" OR h.disabled IS NULL)';
	}

	if ($sql_where != '') {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) AND $sql_where";
	} else {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) ";
	}

	if ($device_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . " h.id = $device_id";
	}

	$graph_auth_method = read_config_option('graph_auth_method');

	/* get policies for all groups and user */
	$policies = get_policies($user_id);

	if (!$simple_perms && $auth_method != 0) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	if ($total_rows != -2) {
		$host_list = db_fetch_assoc("SELECT h1.*
			FROM host AS h1
			INNER JOIN (
				SELECT DISTINCT id
				FROM (
					SELECT h.id
					FROM host AS h
					LEFT JOIN graph_local AS gl
					ON h.id=gl.host_id
					LEFT JOIN graph_templates AS gt
					ON gt.id=gl.graph_template_id
					LEFT JOIN host_template AS ht
					ON h.host_template_id=ht.id
					$sql_where
				) AS rs1
			) AS rs2
			ON rs2.id=h1.id
			$sql_order
			$sql_limit");
	}

	if ($total_rows >= 0 || $total_rows == -2) {
		$sql = "SELECT COUNT(DISTINCT id)
			FROM (
				SELECT h.id
				FROM host AS h
				LEFT JOIN graph_local AS gl
				ON h.id=gl.host_id
				LEFT JOIN graph_templates AS gt
				ON gt.id=gl.graph_template_id
				LEFT JOIN host_template AS ht
				ON h.host_template_id=ht.id
				$sql_where
			) AS rower";

		if ($device_id == 0) {
			$total_rows = get_total_row_data($user_id, $sql, array(), 'device');
		} else {
			$total_rows = db_fetch_cell($sql);
		}
	}

	return $host_list;
}

/**
 * get_allowed_sites - returns the list of sites that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays as
 *   well as other tasks.
 *
 * @param  (string) The SQL Where used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of devices
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If checking a single site, specify the site_id
 *
 * @return (array)  An array of permitted sites
 */
function get_allowed_sites($sql_where = '', $sql_order = 'name', $sql_limit = '', &$total_rows = 0, $user_id = 0, $site_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if ($sql_where != '') {
		$sql_where = "WHERE $sql_where";
	}

	if ($site_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . " s.id=$site_id";
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if (isset($_SESSION['sess_user_id']) && $user_id == 0) {
		$user_id = $_SESSION['sess_user_id'];
	} elseif ($auth_method > 0) {
		return array();
	}

	$sites = db_fetch_assoc("SELECT s.id, s.name
		FROM sites AS s
		INNER JOIN host AS h
		ON s.id=h.site_id
		$sql_where
		GROUP BY s.id
		$sql_order
		$sql_limit");

	$sql = "SELECT COUNT(DISTINCT s.id)
		FROM sites AS s
		INNER JOIN host AS h
		ON s.id=h.site_id
		$sql_where";

	$total_rows = get_total_row_data($user_id, $sql, array(), 'site_device');

	return $sites;
}

/**
 * get_allowed_site_devices - returns the list of devices in a site that the user is allowed
 *   To access.  This function is generally intended for both listbox and table displays as
 *   well as other tasks.
 *
 * @param  (int)    The site id for the site
 * @param  (string) The SQL Where used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of devices
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array)  An array of permitted site devices
 */
function get_allowed_site_devices($site_id, $sql_where = '', $sql_order = 'description', $sql_limit = '', &$total_rows = 0, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	if ($user_id == -1) {
		$auth_method = 0;
	} else {
		$auth_method = read_config_option('auth_method');
	}

	if ($auth_method > 0 && $user_id == 0) {
		if (isset($_SESSION['sess_user_id'])) {
			$user_id = $_SESSION['sess_user_id'];
		} else {
			return array();
		}
	}

	$simple_perms = get_simple_device_perms($user_id);

	$policies = get_policies($user_id);

	$graph_auth_method = read_config_option('graph_auth_method');

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	if (read_user_setting('hide_disabled') == 'on') {
		$sql_where .= ($sql_where != '' ? ' AND ':'') . '(h.disabled = "" OR h.disabled IS NULL)';
	}

	if ($sql_where != '') {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) AND $sql_where";
	} else {
		$sql_where = "WHERE ((h.id > 0 AND h.deleted = '') OR h.id IS NULL) ";
	}

	if ($site_id > 0) {
		$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . " h.site_id=$site_id";
	}

	if ($auth_method != 0 && !$simple_perms) {
		$sql_where = get_policy_where($graph_auth_method, $policies, $sql_where);
	}

	$host_list = db_fetch_assoc("SELECT h1.*, ht.name AS host_template_name
		FROM host AS h1
		LEFT JOIN host_template AS ht
		ON h1.host_template_id=ht.id
		INNER JOIN (
			SELECT DISTINCT id
			FROM (
				SELECT h.id
				FROM host AS h
				LEFT JOIN graph_local AS gl
				ON h.id=gl.host_id
				LEFT JOIN graph_templates_graph AS gtg
				ON gl.id=gtg.local_graph_id
				LEFT JOIN graph_templates AS gt
				ON gt.id=gl.graph_template_id
				LEFT JOIN host_template AS ht
				ON h.host_template_id=ht.id
				$sql_where
			) AS rs1
		) AS rs2
		ON rs2.id=h1.id
		$sql_order
		$sql_limit");

	$sql = "SELECT COUNT(DISTINCT id)
		FROM (
			SELECT h.id
			FROM host AS h
			LEFT JOIN graph_local AS gl
			ON h.id=gl.host_id
			LEFT JOIN graph_templates_graph AS gtg
			ON gl.id=gtg.local_graph_id
			LEFT JOIN graph_templates AS gt
			ON gt.id=gl.graph_template_id
			LEFT JOIN host_template AS ht
			ON h.host_template_id=ht.id
			$sql_where
		) AS rower";

	$total_rows = get_total_row_data($user_id, $sql, array(), 'site_device');

	return $host_list;
}

/**
 * get_allowed_graph_templates_normalized - returns the list of graph templates aligned with the
 *   To be able to differentiate between Graph Templates based on a non-data query data input mode
 *   and those related to data queries.
 *
 * @param  (string) The SQL Where used to get the values or the values
 * @param  (string) The SQL Order clause to use for the sorting of devices
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 * @param  (int)    If checking a single graph template, specify the graph_template_id
 *
 * @return (array)  An array of permitted and normalized graph templates
 */
function get_allowed_graph_templates_normalized($sql_where = '', $sql_order = 'name', $sql_limit = '', &$total_rows = 0, $user_id = 0, $graph_template_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	$templates = array_rekey(get_allowed_graph_templates($sql_where, $sql_order, $sql_limit, $total_rows, $user_id, $graph_template_id), 'id', 'name');

	if (!cacti_sizeof($templates)) {
		return array();
	}

	if ($sql_where != '') {
		$sql_where = ' WHERE (' . $sql_where . ') AND gl.graph_template_id IN(' . implode(', ', array_keys($templates)) . ') AND (gl.snmp_query_graph_id=0 OR sqg.name IS NOT NULL) AND (gt.name IS NOT NULL)';
	} else {
		$sql_where = ' WHERE gl.graph_template_id IN(' . implode(', ', array_keys($templates)) . ') AND (gl.snmp_query_graph_id=0 OR sqg.name IS NOT NULL) AND (gt.name IS NOT NULL)';
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = "LIMIT $sql_limit";
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	$templates = db_fetch_assoc("SELECT
		IF(snmp_query_graph_id=0, CONCAT('cg_',gl.graph_template_id), CONCAT('dq_', gl.snmp_query_graph_id)) AS id,
		IF(snmp_query_graph_id=0, gt.name, CONCAT(gt.name, ' [', sqg.name, ']')) AS name
		FROM graph_local AS gl
		LEFT JOIN graph_templates AS gt
		ON gt.id=gl.graph_template_id
		LEFT JOIN snmp_query_graph AS sqg
		ON gl.snmp_query_graph_id=sqg.id
		AND gl.graph_template_id=sqg.graph_template_id
		$sql_where
		GROUP BY id, name
		$sql_order
		$sql_limit");

	return $templates;
}

/**
 * auth_valid_user - Returns true or false depending on if the user is valid for the system
 *   users with an id of 0 or -1 are special cases.  All non-zero users should be found in the
 *   user_auth table.
 *
 * @param  int   A valid or invalid user.
 *
 * @return bool  True is valid otherwise false
 */
function auth_valid_user($user_id) {
	static $users = array();

	// perform a check if the user exists
	if ($user_id > 0) {
		if (isset($users[$user_id]) && $users[$user_id] == true) {
			return true;
		} elseif (isset($users[$user_id])) {
			return false;
		} else {
			$exists = db_fetch_cell_prepared('SELECT id FROM user_auth WHERE id = ?', array($user_id));

			if (empty($exists)) {
				cacti_log(sprintf('ERROR: Invalid Cacti User ID %d is being used in a permission that does not exist', $user_id), false, 'AUTH');

				cacti_debug_backtrace('Invalid User Accound');

				$users[$user_id] = false;

				return false;
			}

			$users[$user_id] = true;
		}
	}

	return true;
}

/**
 * get_total_row_data - returns the total rows based upon a set of criteria
 *
 * This function will hash the $sql, and then search for the total
 * row counter based upon that criteria and if it finds a unexpired
 * match for that data, it will return the row count in the table
 * otherwise, it will execute the SQL and return the data.
 *
 * @param  (int)    The user id making the request
 * @param  (string) The sql to be executed, either prepared or otherwise
 * @param  (array)  In the case of a prepared statement the
 * @param  (string) The user defined class of data
 * @param  (int)    The timeout for the Class if not controlled by Cacti
 *
 * @return (array) an array containing a list of hosts
 */
function get_total_row_data($user_id, $sql, $sql_params = array(), $class = '', $timeout = 86400) {
	$execute  = true;
	$now_time = time();

	if (cacti_sizeof($sql_params)) {
		$nsql = str_replace('?', "'%s'", $sql);
		$nsql = vsprintf($nsql, $sql_params);

		$hash = md5($nsql);
	} else {
		$hash = md5($sql);
	}

	$row_data = db_fetch_row_prepared('SELECT total_rows, UNIX_TIMESTAMP(time) AS time
		FROM user_auth_row_cache
		WHERE user_id = ?
		AND class = ?
		AND hash = ?',
		array($user_id, $class, $hash));

	$cached = false;

	if (cacti_sizeof($row_data)) {
		$cached    = true;
		$last_time = read_config_option('time_last_change_' . $class);

		if (!empty($last_time)) {
			if ($row_data['time'] >= $last_time) {
				return $row_data['total_rows'];
			}
		} elseif ($now_time - $row_data['time'] < $timeout) {
			return $row_data['total_rows'];
		}
	}

	if (cacti_sizeof($sql_params)) {
		$rows = db_fetch_cell($sql, $sql_params);
	} else {
		$rows = db_fetch_cell($sql);
	}

	if ($user_id > 0) {
		db_execute_prepared('REPLACE INTO user_auth_row_cache
			(user_id, class, hash, total_rows, time)
			VALUES (?, ?, ?, ?, FROM_UNIXTIME(?))',
			array($user_id, $class, $hash, $rows, $now_time));
	}

	return $rows;
}

/**
 * get_host_array - returns a list of hosts taking permissions into account if necessary
 *
 * @return (array) an array containing a list of hosts
 */
function get_host_array() {
	$total_rows = -1;

	$hosts = get_allowed_devices('', 'description', '', $total_rows);

	foreach($hosts as $host) {
		$return_devices[] = strip_domain($host['description']) . ' (' . strip_domain($host['hostname']) . ')';
	}

	return $return_devices;
}

/**
 * get_allowed_ajax_hosts - returns a list of hosts in a way that can be easily read through
 *   a callback, in JSON.  The 'term' request variable will include an optional search term.
 *
 * @param  (bool)   Include the 'Any' item as the first in the list
 @ @param  (bool)   Include the 'None' item as the first or second in the list
 * @param  (string) SQL Where expression to use to gather the hosts in addition to the 'term'
 *   request variable.
 *
 * @return (string) A json array of matching devices upto a limit specified in the system
 *   settings
 */
function get_allowed_ajax_hosts($include_any = true, $include_none = true, $sql_where = '') {
	$user_id = $_SESSION['sess_user_id'];

	if (!auth_valid_user($user_id)) {
		return array();
	}

	$return = array();

	$term = get_filter_request_var('term', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	if ($term != '') {
		$sql_where .= ($sql_where != '' ? ' AND ' : '') .
			'(hostname LIKE ' . db_qstr("%$term%") .
			' OR description LIKE ' . db_qstr("%$term%") .
			' OR notes LIKE ' . db_qstr("%$term%") . ')';
	}

	if (get_request_var('term') == '') {
		if ($include_any) {
			$return[] = array('label' => __('Any'), 'value' => 'Any', 'id' => '-1');
		}
		if ($include_none) {
			$return[] = array('label' => __('None'), 'value' => 'None', 'id' => '0');
		}
	}

	$total_rows = -1;

	$hosts = get_allowed_devices($sql_where, 'description', read_config_option('autocomplete_rows'), $total_rows);

	if (cacti_sizeof($hosts)) {
		foreach($hosts as $host) {
			$return[] = array('label' => html_escape(strip_domain($host['description'])), 'value' => html_escape($host['description']), 'id' => $host['id']);
		}
	}

	print json_encode($return);
}

/**
 * get_allowed_ajax_graph_templates - returns a list of graph_template in a way that can be easily
 *   read through a callback, in JSON.  The 'term' request variable will include an optional search term.
 *
 * @param  (bool)   Include the 'Any' item as the first in the list
 @ @param  (bool)   Include the 'None' item as the first or second in the list
 * @param  (string) SQL Where expression to use to gather the graph templates in addition to the 'term'
 *   request variable.
 *
 * @return (string) A json array of matching graph templates upto a limit specified in the system
 *   settings
 */
function get_allowed_ajax_graph_templates($include_any = true, $include_none = true, $sql_where = '') {
	$user_id = $_SESSION['sess_user_id'];

	if (!auth_valid_user($user_id)) {
		return array();
	}

	$return = array();

	$term = get_filter_request_var('term', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	if ($term != '') {
		$sql_where .= ($sql_where != '' ? ' AND ' : '') . 'name LIKE ' . db_qstr("%$term%");
	}

	if (get_request_var('term') == '') {
		if ($include_any) {
			$return[] = array('label' => __('Any'), 'value' => 'Any', 'id' => '-1');
		}
		if ($include_none) {
			$return[] = array('label' => __('None'), 'value' => 'None', 'id' => '0');
		}
	}

	$total_rows = -1;

	$templates = get_allowed_graph_templates($sql_where, 'gt.name', read_config_option('autocomplete_rows'), $total_rows);
	if (cacti_sizeof($templates)) {
		foreach($templates as $template) {
			$return[] = array('label' => html_escape($template['name']), 'value' => html_escape($template['name']), 'id' => $template['id']);
		}
	}

	print json_encode($return);
}

/**
 * get_allowed_ajax_graph_items - returns a list of graph items in a way that can be easily
 *   read through a callback, in JSON.  The 'term' request variable will include an optional search term.
 *
 @ @param  (bool)   Include the 'None' item as the first item in the list
 * @param  (string) SQL Where expression to use to gather the hosts in addition to the 'term'
 *   request variable.
 *
 * @return (string) A json array of matching graph items upto a limit specified in the system
 *   settings
 */
function get_allowed_ajax_graph_items($include_none = true, $sql_where = '') {
	$user_id = $_SESSION['sess_user_id'];

	if (!auth_valid_user($user_id)) {
		return array();
	}

	$return = array();

	$term = get_filter_request_var('term', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	if ($term != '') {
		$sql_where .= ($sql_where != '' ? ' AND ' : '') .
			'name_cache LIKE ' . db_qstr("%$term%") .
			' OR data_source_name LIKE ' . db_qstr("%$term%");
	}

	if (get_request_var('term') == '') {
		if ($include_none) {
			$return[] = array('label' => __('None'), 'value' => 'None', 'id' => '0');
		}
	}

	$graph_items = get_allowed_graph_items($sql_where, 'name_cache', read_config_option('autocomplete_rows'));
	if (cacti_sizeof($graph_items)) {
		foreach($graph_items as $gi) {
			$return[] = array('label' => html_escape($gi['name']), 'value' => html_escape($gi['name']), 'id' => $gi['id']);
		}
	}

	print json_encode($return);
}

/**
 * get_allowed_ajax_graph - returns a list of allowed graphs in a way that can be easily
 *   read through a callback, in JSON.  The 'term' request variable will include an optional search term.
 *
 * @param  (string) SQL Where expression to use to gather the graphs in addition to the 'term'
 *   request variable.
 *
 * @return (string) A json array of matching graphs upto a limit specified in the system
 *   settings
 */
function get_allowed_ajax_graphs($sql_where = '') {
	$user_id = $_SESSION['sess_user_id'];

	if (!auth_valid_user($user_id)) {
		return array();
	}

	$return = array();

	$term = get_filter_request_var('term', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	if ($term != '') {
		$sql_where .= ($sql_where != '' ? ' AND ' : '') . 'title_cache LIKE ' . db_qstr("%$term%");
	}

	$total_rows = -1;

	$graphs = get_allowed_graphs($sql_where, 'gtg.title_cache', read_config_option('autocomplete_rows'), $total_rows);
	if (cacti_sizeof($graphs)) {
		foreach($graphs as $graph) {
			$return[] = array('label' => html_escape($graph['title_cache']), 'value' => html_escape($graph['title_cache']), 'id' => $graph['local_graph_id']);
		}
	}

	print json_encode($return);
}

/**
 * get_allowed_graph_items - returns a array of allowed graph items in a way that can be easily
 *   use in a table or list.
 *
 * @param  (string) The SQL Where expression to use to gather the graph items
 * @param  (string) The SQL Order clause to use for the sorting of devices
 * @param  (int)    The limit on items to return.  If empty or -1, return all items
 * @param  (int)    The number of rows found, to be returned to the caller
 * @param  (int)    If checking a user, specify the user_id otherwise for the current user leave blank
 *
 * @return (array) An array of permitted graph items
 */
function get_allowed_graph_items($sql_where, $sql_order = 'name', $sql_limit = 20, $user_id = 0) {
	if (!auth_valid_user($user_id)) {
		return array();
	}

	$return = array();

	if ($user_id == 0 && isset($_SESSION['sess_user_id'])) {
		$user_id = $_SESSION['sess_user_id'];
	}

	if ($sql_where != '') {
		$sql_where = 'WHERE ' . $sql_where;
	}

	if ($sql_limit != '' && $sql_limit != -1) {
		$sql_limit = 'LIMIT ' . $sql_limit;
	} else {
		$sql_limit = '';
	}

	if ($sql_order != '') {
		$sql_order = "ORDER BY $sql_order";
	}

	$items = db_fetch_assoc("SELECT
		CONCAT_WS('', dtd.name_cache,' (', dtr.data_source_name, ')') as name, dtr.id, dl.host_id
		FROM data_local AS dl
		INNER JOIN data_template_data AS dtd
		ON dtd.local_data_id=dl.id
		INNER JOIN data_template_rrd AS dtr
		ON dtr.local_data_id=dl.id
		LEFT JOIN host AS h
		ON dl.host_id=h.id
		$sql_where
		$sql_order
		$sql_limit");

	if (cacti_sizeof($items)) {
		foreach($items as $i) {
			if (is_device_allowed($i['host_id'], $user_id)) {
				$return[] = array('id' => $i['id'], 'name' => $i['name']);
			}
		}
	}

	return $return;
}

/**
 * auth_get_username - returns the login username for the user attempting to login
 *
 * @return (string) the username attempting to login
 */
function auth_get_username() {
	$auth_method = read_config_option('auth_method');

	if ($auth_method == 2) {
		$username = get_basic_auth_username();

		/* Get the Web Basic Auth username and set action so we login right away */
		set_request_var('action', 'login');

	} elseif (get_nfilter_request_var('action') == 'login') {
		$username = get_nfilter_request_var('login_username');
	} else {
		$username = '';
	}

	$username = sanitize_search_string($username);

	return $username;
}

/**
 * auth_checkclear_lockout - checks the lockout status of a user and unlocks if necessary
 *
 * @param  (string) $username The username of the user to check
 * @param  (int)    $realm The realm of the user to check
 *
 * @return (void)
 */
function auth_checkclear_lockout($username, $realm) {
	// Unlock the user account if timing permits
	$secPassLockFailed = read_config_option('secpass_lockfailed');
	if ($secPassLockFailed > 0) {
		$max = intval($secPassLockFailed);
		if ($max > 0) {
			$user = db_fetch_row_prepared("SELECT id, username, lastfail, failed_attempts, `locked`, password
				FROM user_auth
				WHERE username = ?
				AND realm = ?
				AND enabled = 'on'",
				array($username, $realm));

			if (cacti_sizeof($user)) {
				$unlock = intval(read_config_option('secpass_unlocktime'));
				if ($unlock > 1440) {
					$unlock = 1440;
				}

				$secs_unlock = $unlock * 60;
				$secs_fail = time() - $user['lastfail'];

				cacti_log('DEBUG: User \'' . $username . '\' secs_fail = ' . $secs_fail . ', secs_unlock = ' . $secs_unlock, false, 'AUTH', POLLER_VERBOSITY_DEBUG);

				if ($unlock > 0 && ($secs_fail > $secs_unlock)) {
					db_execute_prepared("UPDATE user_auth
						SET lastfail = 0, failed_attempts = 0, `locked` = ''
						WHERE username = ?
						AND realm = ?
						AND enabled = 'on'",
						array($username, $realm));
				}
			}
		}
	}
}

/**
 * auth_process_lockout_check - checks to see if the user is locked out of their account
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that a lockout is present and not to proceed with login.
 *
 * @param  (string) $username - The name of the user account
 * @param  (int)    $realm - The logging realm for the user
 *
 * @return (bool)   True if locked out, otherwise false
 */
function auth_process_lockout_check($username, $realm) {
	global $error, $error_msg;

	// Mark failed login attempts
	$secPassLockFailed = read_config_option('secpass_lockfailed');
	if ($secPassLockFailed > 0) {
		$max = intval($secPassLockFailed);
		if ($max > 0) {
			$user = db_fetch_row_prepared("SELECT id, username, lastfail, failed_attempts, `locked`, password
				FROM user_auth
				WHERE username = ?
				AND realm = ?
				AND enabled = 'on'",
				array($username, $realm));

			if (cacti_sizeof($user)) {
				if ($user['locked'] == 'on') {
					$error     = true;
					$error_msg = __('Your account has been locked.  Please contact your Administrator.');

					return true;
				}
			}
		}
	}

	return false;
}

/**
 * auth_process_lockout - called when a user login attempt fails to increment or lockout the user
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that a lockout is present and not to proceed with login.
 *
 * @param  (string) $username - The name of the user account
 * @param  (int)    $realm - The logging realm for the user
 *
 * @return (void)
 */
function auth_process_lockout($username, $realm) {
	global $error, $error_msg;

	// Mark failed login attempts
	$secPassLockFailed = read_config_option('secpass_lockfailed');
	if ($secPassLockFailed > 0) {
		$max = intval($secPassLockFailed);
		if ($max > 0) {
			$user = db_fetch_row_prepared("SELECT id, username, enabled, lastfail, failed_attempts, `locked`, password
				FROM user_auth
				WHERE username = ?
				AND realm = ?",
				array($username, $realm));

			if (cacti_sizeof($user)) {
				if ($user['enabled'] == '') {
					cacti_log("LOGIN FAILED: Local Login Failed for user '" . $username . "' from IP Address '" . get_client_addr() . "'.  User account Disabled.", false, 'AUTH');

					$error     = true;
					$error_msg = __('Access Denied!  Login Disabled.');
				}

				$failed = intval($user['failed_attempts']) + 1;

				cacti_log('LOGIN FAILED: User \'' . $username . '\' failed authentication, incrementing lockout (' . $failed . ' of ' . $max . ')', false, 'AUTH', POLLER_VERBOSITY_LOW);

				if ($failed >= $max) {
					db_execute_prepared("UPDATE user_auth
						SET `locked` = 'on'
						WHERE username = ?
						AND realm = ?
						AND enabled = 'on'",
						array($username, $realm));

					$user['locked'] = 'on';
				}

				$user['lastfail'] = time();

				db_execute_prepared("UPDATE user_auth
					SET lastfail = ?, failed_attempts = ?
					WHERE username = ?
					AND realm = ?
					AND enabled = 'on'",
					array($user['lastfail'], $failed, $username, $realm));

				// Log the invalid password attempt
				db_execute_prepared('INSERT IGNORE INTO user_log
					(username, user_id, result, ip, time)
					VALUES (?, ?, 0, ?, NOW())',
					array($username, isset($user['id']) ? $user['id']:0, get_client_addr()));

				if ($user['locked'] == 'on') {
					cacti_log("LOGIN FAILED: Local Login Failed for user '" . $username . "' from IP Address '" . get_client_addr() . "'.  Account is locked out.", false, 'AUTH');

					$error     = true;
					$error_msg = __('Your account has been locked.  Please contact your Administrator.');
				} else {
					cacti_log("LOGIN FAILED: Local Login Failed for user '" . $username . "' from IP Address '" . get_client_addr() . "'.", false, 'AUTH');

					/* error */
					$error     = true;
					$error_msg = __('Access Denied!  Login Failed.');
				}
			} else {
				cacti_log("LOGIN FAILED: Local Login Failed to find user '" . $username . "' from IP Address '" . get_client_addr() . "'.", false, 'AUTH');

				$error     = true;
				$error_msg = __('Access Denied!  Login Failed.');
			}
		}
	}
}

/**
 * basic_auth_login_process - login a basic auth account or generate an error
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that a lockout is present and not to proceed with login.  This function will also
 *   exit and return html to the display to notify the user of critical errors.
 *
 * @param  (string) $username The user to process
 *
 * @return (array|void) $user The valid user, an empty array if the user must be created
 *   or void in the case of an exit condition
 */
function basic_auth_login_process($username) {
	global $error, $error_msg;

	if (empty($username)) {
		cacti_log('ERROR: No username passed with Web Basic Authentication enabled.', false, 'AUTH');
		auth_display_custom_error_message(__('Web Basic Authentication configured, but no username was passed from the web server. Please make sure you have authentication enabled on the web server.'));

		exit;
	}

	/* Locate user in database */
	$user = db_fetch_row_prepared('SELECT *
		FROM user_auth
		WHERE username = ?
		AND realm = 2',
		array($username));

	if (!$user && get_template_account($username) == 0 && get_guest_account() === 0) {
		$error     = true;
		$error_msg = __esc('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username);

		cacti_log("LOGIN FAILED: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');

		auth_display_custom_error_message($error_msg);
		exit;
	}

	return $user;
}

/**
 * local_auth_login_process - login a local account or generate an error
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that error and not to proceed with login.
 *
 * @param  (string) $username - The user to process
 *
 * @return (array)  $user - The valid user information, or empty array if user must be created
 */
function local_auth_login_process($username) {
	$user = array();

	if (!api_plugin_hook_function('login_process', false)) {
		$user = secpass_login_process($username);

		/**
		 * If the password needs to be rehashed for security purposes,
		 * do that now.
		 */
		$stored_pass = db_fetch_cell_prepared('SELECT password
			FROM user_auth
			WHERE username = ?
			AND realm = 0',
			array($username));

		if ($stored_pass != '') {
			$password = get_nfilter_request_var('login_password');

			$valid = compat_password_verify($password, $stored_pass);

			cacti_log("DEBUG: User '" . $username . "' password for rehash is " . ($valid ? '':'in') . 'valid', false, 'AUTH', POLLER_VERBOSITY_DEBUG);

			if ($valid) {
				$user = db_fetch_row_prepared('SELECT *
					FROM user_auth
					WHERE username = ?
					AND realm = 0',
					array($username));

				if (compat_password_needs_rehash($stored_pass, PASSWORD_DEFAULT)) {
					$password = compat_password_hash($password, PASSWORD_DEFAULT);
					db_check_password_length();
					db_execute_prepared('UPDATE user_auth
						SET password = ?
						WHERE username = ?',
						array($password, $username));
				}
			}
		}
	}

	return $user;
}

/**
 * ldap_login_process - login to an LDAP account or generate an error
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that error and not to proceed with login.
 *
 * @param  (string) $username - The user to process
 *
 * @return (array)  $user - The valid user information, or empty array if user must be created
 */
function ldap_login_process($username) {
	global $error, $error_msg;

	$password = get_nfilter_request_var('login_password');

	if ($username == '') {
		$error     = true;
		$error_msg = __('Access Denied!  Login Failed.');

		cacti_log('LOGIN FAILED: Empty LDAP Username provided', false, 'AUTH');

		return array();
	}

	auth_checkclear_lockout($username, 3);

	if (auth_process_lockout_check($username, 3)) {
		return array();
	}

	$user  = array();
	$realm = 3;

	if ($password != '') {
		/* get user DN */
		$ldap_dn_search_response = cacti_ldap_search_dn($username);

		if ($ldap_dn_search_response['error_num'] == '0') {
			$ldap_dn = $ldap_dn_search_response['dn'];
		} else {
			/* error searching */
			$error     = true;
			$error_msg =  __('Access Denied!  LDAP Search Error: %s', $ldap_dn_search_response['error_text']);

			cacti_log('LOGIN FAILED: LDAP Error: ' . $ldap_dn_search_response['error_text'], false, 'AUTH');
		}

		if (!$error) {
			/* auth user with LDAP */
			$ldap_auth_response = cacti_ldap_auth($username, $password, $ldap_dn);

			if ($ldap_auth_response['error_num'] == '0') {
				/* Locate user in database */
				cacti_log("LOGIN: LDAP User '" . $username . "' Authenticated", false, 'AUTH');

				$user = db_fetch_row_prepared('SELECT *
					FROM user_auth
					WHERE username = ?
					AND realm = ?',
					array($username, $realm));
			} else {
				/* error */
				$error     = true;
				$error_msg = __('Access Denied!  LDAP Error: %s', $ldap_auth_response['error_text']);

				cacti_log('LOGIN FAILED: LDAP Error: ' . $ldap_auth_response['error_text'], false, 'AUTH');

				if ($ldap_auth_response['error_num'] == 1) {
					auth_process_lockout($username, $realm);
				}
			}
		}
	} else {
		/* error */
		$error     = true;
		$error_msg = __('Access Denied!  No password provided by user.');

		cacti_log(sprintf('LOGIN FAILED: LDAP No password provided for user %s', $username), false, 'AUTH');

		auth_process_lockout($username, $realm);
	}

	return $user;
}

/**
 * domains_login_process - login to an LDAP domain account or generate an error
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that error and not to proceed with login.
 *
 * @param  (string) $username - The user to process
 *
 * @return (array)  $user - The valid user information, or empty array if user must be created
 */
function domains_login_process($username) {
	global $realm, $error, $error_msg;

	$realm    = get_nfilter_request_var('realm');
	$password = get_nfilter_request_var('login_password');

	if ($username == '') {
		$error     = true;
		$error_msg = __('Access Denied!  Login Failed.');

		cacti_log('LOGIN FAILED: Empty Domains Username provided', false, 'AUTH');

		return array();
	}

	auth_checkclear_lockout($username, $realm);

	if (auth_process_lockout_check($username, $realm)) {
		return array();
	}

	$user = array();

	if ($realm > 3 && $password != '') {
		/* get user DN */
		$ldap_dn_search_response = domains_ldap_search_dn($username, $realm);
		if ($ldap_dn_search_response['error_num'] == '0') {
			$ldap_dn = $ldap_dn_search_response['dn'];
		} else {
			/* error searching */
			$error     = true;
			$error_msg = __('LDAP Search Error: %s', $ldap_dn_search_response['error_text']);

			cacti_log('LOGIN FAILED: LDAP Error: ' . $ldap_dn_search_response['error_text'], false, 'AUTH');
		}

		if (!$error) {
			/* auth user with LDAP */
			$ldap_auth_response = domains_ldap_auth($username, $password, $ldap_dn, $realm);

			if ($ldap_auth_response['error_num'] == '0') {
				/* User ok */
				$domain_name = db_fetch_cell_prepared('SELECT domain_name
					FROM user_domains
					WHERE domain_id = ?',
					array($realm-1000));

				/* Locate user in database */
				cacti_log("LOGIN: LDAP User '$username' Authenticated from Domain '$domain_name'", false, 'AUTH');

				$user = db_fetch_row_prepared('SELECT *
					FROM user_auth
					WHERE username = ?
					AND realm = ?',
					array($username, $realm));

				/* Create user from template if requested */
				$template_user = db_fetch_cell_prepared('SELECT user_id
					FROM user_domains
					WHERE domain_id = ?',
					array($realm-1000));

				$template_username = db_fetch_cell_prepared('SELECT username
					FROM user_auth
					WHERE id = ?',
					array($template_user));

				if (!cacti_sizeof($user) && $template_user > 0 && $username != '') {
					cacti_log("NOTE: User '" . $username . "' does not exist, copying template user", false, 'AUTH');

					/* check that template user exists */
					$user_template = db_fetch_row_prepared('SELECT *
						FROM user_auth
						WHERE id = ?',
						array($template_user));

					if (cacti_sizeof($user_template)) {
						/* template user found */
						$cn_full_name = db_fetch_cell_prepared('SELECT cn_full_name
							FROM user_domains_ldap
							WHERE domain_id = ?',
							array($realm-1000));

						$cn_email = db_fetch_cell_prepared('SELECT cn_email
							FROM user_domains_ldap
							WHERE domain_id = ?',
							array($realm-1000));

						if ($cn_full_name != '' || $cn_email != '') {
							$ldap_cn_search_response = cacti_ldap_search_cn($username, array($cn_full_name, $cn_email));

							if (isset($ldap_cn_search_response['cn'])) {
								$data_override = array();

								if (array_key_exists($cn_full_name, $ldap_cn_search_response['cn'])) {
									$data_override['full_name'] = $ldap_cn_search_response['cn'][$cn_full_name];
								} else {
									$data_override['full_name'] = '';
								}

								if (array_key_exists($cn_email, $ldap_cn_search_response['cn'])) {
									$data_override['email_address'] = $ldap_cn_search_response['cn'][$cn_email];
								} else {
									$data_override['email_address'] = '';
								}

								user_copy($user_template['username'], $username, 0, $realm, false, $data_override);
							} else {
								cacti_log('LOGIN: fields not found ' . $ldap_cn_search_response[0] . 'code: ' . $ldap_cn_search_response['error_num'], false, 'AUTH');
								user_copy($user_template['username'], $username, 0, $realm);
							}
						} else {
							user_copy($user_template['username'], $username, 0, $realm);
						}

						/* requery newly created user */
						$user = db_fetch_row_prepared('SELECT *
							FROM user_auth
							WHERE username = ?
							AND realm = ?',
							array($username, $realm));
					} else {
						/* error */
						$error     = true;
						$error_msg = __('Access Denied!  Template user id %s does not exist.  Please contact your Administrator.', $template_user);

						cacti_log("LOGIN FAILED: Template user id '" . $template_user . "' does not exist.", false, 'AUTH');
					}
				}
			} else {
				/* error */
				$error     = true;
				$error_msg = __('Access Denied!  LDAP Error: %s', $ldap_auth_response['error_text']);

				cacti_log('LOGIN FAILED: LDAP Error: ' . $ldap_auth_response['error_text'], false, 'AUTH');

				if ($ldap_auth_response['error_text'] == 1) {
					auth_lockout_process($username, $realm);
				}
			}
		}
	} elseif ($password == '') {
		/* error */
		$error     = true;
		$error_msg = __('Access Denied!  No password provided by user.');

		cacti_log(sprintf('LOGIN FAILED: LDAP No password provided for user %s', $username), false, 'AUTH');

		auth_process_lockout($username, $realm);
	}

	return $user;
}

/**
 * domains_ldap_auth - authentications a LDAP domain login
 *
 * @param  (string) $username  - The user to process
 * @param  (string) $password  - The users password
 * @param  (string) $dn        - The domain name
 * @param  (int)    $realm     - The LDAP Realm number
 *
 * @return (array)  $response - The ldap response of false on a general error
 */
function domains_ldap_auth($username, $password = '', $dn = '', $realm = 0) {
	$ldap = new Ldap;

	if (!empty($username)) $ldap->username = $username;
	if (!empty($password)) $ldap->password = $password;

	$ldap->dn = $dn;

	$ld = db_fetch_row_prepared('SELECT *
		FROM user_domains_ldap
		WHERE domain_id = ?',
		array($realm-1000));

	if (cacti_sizeof($ld)) {
		if (empty($dn) && !empty($ld['dn'])) {
			$ldap->dn = $ld['dn'];
		}

		if (!empty($ld['server']))            $ldap->host              = $ld['server'];
		if (!empty($ld['port']))              $ldap->port              = $ld['port'];
		if (!empty($ld['port_ssl']))          $ldap->port_ssl          = $ld['port_ssl'];
		if (!empty($ld['proto_version']))     $ldap->version           = $ld['proto_version'];
		if (!empty($ld['encryption']))        $ldap->encryption        = $ld['encryption'];
		if (!empty($ld['referrals']))         $ldap->referrals         = $ld['referrals'];

		if (!empty($ld['mode']))              $ldap->mode              = $ld['mode'];
		if (!empty($ld['search_base']))       $ldap->search_base       = $ld['search_base'];
		if (!empty($ld['search_filter']))     $ldap->search_filter     = $ld['search_filter'];
		if (!empty($ld['specific_dn']))       $ldap->specific_dn       = $ld['specific_dn'];
		if (!empty($ld['specific_password'])) $ldap->specific_password = $ld['specific_password'];

		if ($ld['group_require'] == 'on') {
			$ldap->group_require = true;
		} else {
			$ldap->group_require = false;
		}

		if (!empty($ld['group_dn']))          $ldap->group_dn          = $ld['group_dn'];
		if (!empty($ld['group_attrib']))      $ldap->group_attrib      = $ld['group_attrib'];
		if (!empty($ld['group_member_type'])) $ldap->group_member_type = $ld['group_member_type'];

		/* If the server list is a space delimited set of servers
		 * process each server until you get a bind, or fail
		 */
		$ldap_servers = preg_split('/\s+/', $ldap->host);

		foreach($ldap_servers as $ldap_server) {
			$ldap->host = $ldap_server;

			$response = $ldap->Authenticate();

			if ($response['error_num'] == 0) {
				return $response;
			}
		}

		return $response;
	} else {
		return false;
	}
}

/**
 * domains_ldap_search_dn - searches the user dn for existence
 *
 * @param  (string) $username  - The user to process
 * @param  (int)    $realm     - The LDAP Realm number
 *
 * @return (array)  $response - The ldap response, or false on general error
 */
function domains_ldap_search_dn($username, $realm) {
	$ldap = new Ldap;

	if (!empty($username)) $ldap->username = $username;

	$ld = db_fetch_row_prepared('SELECT *
		FROM user_domains_ldap
		WHERE domain_id = ?',
		array($realm-1000));

	if (cacti_sizeof($ld)) {
		if (!empty($ld['dn']))                $ldap->dn                = $ld['dn'];
		if (!empty($ld['server']))            $ldap->host              = $ld['server'];
		if (!empty($ld['port']))              $ldap->port              = $ld['port'];
		if (!empty($ld['port_ssl']))          $ldap->port_ssl          = $ld['port_ssl'];
		if (!empty($ld['proto_version']))     $ldap->version           = $ld['proto_version'];
		if (!empty($ld['encryption']))        $ldap->encryption        = $ld['encryption'];
		if (!empty($ld['referrals']))         $ldap->referrals         = $ld['referrals'];

		if (!empty($ld['mode']))              $ldap->mode              = $ld['mode'];
		if (!empty($ld['search_base']))       $ldap->search_base       = $ld['search_base'];
		if (!empty($ld['search_filter']))     $ldap->search_filter     = $ld['search_filter'];
		if (!empty($ld['specific_dn']))       $ldap->specific_dn       = $ld['specific_dn'];
		if (!empty($ld['specific_password'])) $ldap->specific_password = $ld['specific_password'];

		if ($ld['group_require'] == 'on') {
			$ldap->group_require = true;
		} else {
			$ldap->group_require = false;
		}

		if (!empty($ld['group_dn']))          $ldap->group_dn          = $ld['group_dn'];
		if (!empty($ld['group_attrib']))      $ldap->group_attrib      = $ld['group_attrib'];
		if (!empty($ld['group_member_type'])) $ldap->group_member_type = $ld['group_member_type'];

		/* If the server list is a space delimited set of servers
		 * process each server until you get a bind, or fail
		 */
		$ldap_servers = preg_split('/\s+/', $ldap->host);

		foreach($ldap_servers as $ldap_server) {
			$ldap->host = $ldap_server;

			$response = $ldap->Search();

			if ($response['error_num'] == 0) {
				return $response;
			}
		}

		return $response;
	} else {
		return false;
	}
}

/**
 * secpass_login_process - process a local login checking for triggers
 *   such as those that would force a password check and take the appropriate action.
 *   if there is an error, the globals error and error_msg will be set to notify the caller
 *   that error and not to proceed with login.
 *
 * @param  (string) $username  - The user to process
 *
 * @return (array)  $user - The login user or an empty array if the user does not exist
 */
function secpass_login_process($username) {
	global $error, $error_msg;

	$password = get_nfilter_request_var('login_password');

	if ($username == '') {
		$error     = true;
		$error_msg = __('Access Denied!  Login Failed.');

		cacti_log('LOGIN FAILED: Empty Local Username provided', false, 'AUTH');

		return array();
	}

	auth_checkclear_lockout($username, 0);

	if (auth_process_lockout_check($username, 0)) {
		return array();
	}

	if (db_column_exists('user_auth', 'lastfail')) {
		$user = db_fetch_row_prepared("SELECT id, username, lastfail, failed_attempts, `locked`, enabled, password
			FROM user_auth
			WHERE username = ?
			AND realm = 0",
			array($username));
	} else {
		$user = db_fetch_row_prepared("SELECT id, username, password, enabled
			FROM user_auth
			WHERE username = ?
			AND realm = 0",
			array($username));
	}

	if (cacti_sizeof($user)) {
		if ($user['enabled'] != 'on') {
			$error     = true;
			$error_msg = __('Access Denied!  Login Failed.');

			cacti_log(sprintf('LOGIN FAILED: User %s, account disabled.', $username), false, 'AUTH');

			return array();
		}

		if (trim($password) == '') {
			/* error */
			$error     = true;
			$error_msg = __('Access Denied!  No password provided by user.');

			cacti_log(sprintf('LOGIN FAILED: No password provided for user %s', $username), false, 'AUTH');

			$valid_pass = false;
		} else {
			$valid_pass = compat_password_verify($password, $user['password']);
		}

		cacti_log('DEBUG: User \'' . $username . '\' valid password = ' . $valid_pass, false, 'AUTH', POLLER_VERBOSITY_DEBUG);

		if (!$valid_pass) {
			auth_process_lockout($username, 0);

			if (!$error) {
				$error     = true;
				$error_msg = __('Access Denied! Login failed.');
			}

			return array();
		}
	} else {
		/* error */
		$error     = true;
		$error_msg = __('Access Denied!  Login Failed.');

		cacti_log(sprintf('LOGIN FAILED: Invalid user %s specified.', $username), false, 'AUTH');
	}

	/**
	 * Check if old password doesn't meet specifications and must be changed
	 * This only applies to local logins where we store the actual hashed
	 * password.
	 */
	if (read_config_option('secpass_forceold') == 'on') {
		$message = secpass_check_pass($password);

		if ($message != 'ok') {
			db_execute_prepared("UPDATE user_auth
				SET must_change_password = 'on'
				WHERE username = ?
				AND realm = 0
				AND enabled = 'on'",
				array($username));

			$error_msg = __('Your Cacti administrator has forced complex passwords for logins and your current Cacti password does not match the new requirements.  Therefore, you must change your password now.');

			raise_message('forced_password', $error_msg, MESSAGE_LEVEL_INFO);
			header('Location: auth_changepassword.php?header=false');
			exit;
		}
	}

	// Set the last Login time
	if (read_config_option('secpass_expireaccount') > 0) {
		db_execute_prepared("UPDATE user_auth
			SET lastlogin = ?
			WHERE username = ?
			AND realm = 0
			AND enabled = 'on'",
			array(time(), $username));
	}

	return $user;
}

/**
 * secpass_check_pass - Validate a given password for various password rules
 *
 * @param  (string) $password - The user password
 *
 * @return (string) Either 'ok', or an error message to present to the user
 */
function secpass_check_pass($password) {
	$minlen = read_config_option('secpass_minlen');
	if (strlen($password) < $minlen) {
		return __('Password must be at least %d characters!', $minlen);
	}

	if (read_config_option('secpass_reqnum') == 'on' &&
		str_replace(array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9'), '', $password) == $password
	) {
		return __('Your password must contain at least 1 numerical character!');
	}

	if (read_config_option('secpass_reqmixcase') == 'on' && strtolower($password) == $password) {
		return __('Your password must contain a mix of lower case and upper case characters!');
	}

	if (read_config_option('secpass_reqspec') == 'on' &&
		str_replace(array('~', '`', '!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '-', '_', '+', '=', '[', '{', ']', '}', ';', ':', '<', ',', '.', '>', '?', '|', '/', '\\'), '', $password) == $password
	) {
		return __('Your password must contain at least 1 special character!');
	}

	return 'ok';
}

/**
 * secpass_check_history - Checks for password reuse for local accounts
 *
 * @param  (int)    $id - The user id to check
 * @param  (string) $password  - The user password
 *
 * @return (bool)   True if the user password provided meets history rules
 */
function secpass_check_history($id, $password) {
	$history = intval(read_config_option('secpass_history'));

	if ($history > 0) {
		$user = db_fetch_row_prepared("SELECT password, password_history
			FROM user_auth
			WHERE id = ?
			AND realm = 0
			AND enabled = 'on'",
			array($id));

		if (compat_password_verify($password, $user['password'])) {
			return false;
		}

		$passes = explode('|', $user['password_history']);
		// Double check this incase the password history setting was changed
		while (cacti_count($passes) > $history) {
			array_shift($passes);
		}

		if (!empty($passes)) {
			foreach ($passes as $hash) {
				if (compat_password_verify($password, $hash)) {
					return false;
				}
			}
		}
	}

	return true;
}

/**
 * rsa_check_keypair - Checks that Cacti ras_public_key is present.  If not
 *   it will insert the information into the Cacti database.
 *
 * @return (void)
 */
function rsa_check_keypair() {
	global $config;

	set_include_path($config['include_path'] . '/vendor/phpseclib/');
	include('Crypt/Base.php');
	include('Math/BigInteger.php');
	include('Crypt/Hash.php');
	include('Crypt/RSA.php');
	include('Crypt/Rijndael.php');
	include('Crypt/AES.php');

	$public_key = read_config_option('rsa_public_key');

	if(!$public_key) {
		$rsa = new phpseclib\Crypt\RSA();
		$keys = $rsa->createKey(2048);
		$rsa->loadKey($keys['publickey']);
		$fingerprint = $rsa->getPublicKeyFingerprint();

		db_execute_prepared("INSERT INTO settings
			(`name`, `value`)
			VALUES
			('rsa_public_key', '" . $keys['publickey'] . "'),
			('rsa_private_key', '" . $keys['privatekey'] . "'),
			('rsa_fingerprint', '" . $fingerprint . "')"
		);
	}
}

/**
 * reset_group_perms - sets a flag for all users of a group logged in that their perms
 *   need to be reloaded from the database
 *
 * @param  (int) $group_id - the id of the group to check
 *
 * @return (void)
 */
function reset_group_perms($group_id) {
	$users = array_rekey(db_fetch_assoc_prepared('SELECT user_id
		FROM user_auth_group_members
		WHERE group_id = ?',
		array($group_id)), 'user_id', 'user_id');

	if (cacti_sizeof($users)) {
		db_execute('UPDATE user_auth
			SET reset_perms=FLOOR(RAND() * 4294967295) + 1
			WHERE id IN (' . implode(',', $users) . ')');
	}
}

/**
 * reset_user_perms - sets a flag for all users logged in as this user that their perms
 *   need to be reloaded from the database
 *
 * @param  (int) $user_id - the id of the current user
 *
 * @return (void)
 */
function reset_user_perms($user_id) {
	db_execute_prepared('UPDATE user_auth
		SET reset_perms=FLOOR(RAND() * 4294967295) + 1
		WHERE id = ?',
		array($user_id));

	if ($user_id == $_SESSION['sess_user_id']) {
		kill_session_var('sess_user_realms');
		kill_session_var('sess_user_config_array');
		kill_session_var('sess_config_array');
		kill_session_var('sess_auth_names');
	}
}

/**
 * is_user_perms_valid - checks to see if the admin has changed users permissions
 *
 *  @param  (int)  $user_id - the id of the current user
 *
 *  @return (bool) true if still valid, false otherwise
 */
function is_user_perms_valid($user_id) {
	global $config;

	static $valid = null;
	static $key   = null;

	if ($valid === null && cacti_version_compare($config['cacti_db_version'], '1.0.0', '>=')) {
		$key = db_fetch_cell_prepared('SELECT reset_perms
			FROM user_auth
			WHERE id = ?',
			array($user_id));
	}

	if (isset($_SESSION['sess_user_perms_key'])) {
		if ($key != $_SESSION['sess_user_perms_key']) {
			$valid = false;
		} else {
			$valid = true;
		}
	} else {
		$valid = true;
	}

	$_SESSION['sess_user_perms_key'] = $key;

	return $valid;
}

/**
 * compat_password_verify - if the secure function exists, verify against that
 *   first.  If that checks fails or does not exist, check against older md5
 *   version
 *
 * @param  (string) $password - password to verify
 * @param  (string) $hash     - current password hash
 *
 * @return (bool)   true if password hash matches, false otherwise
 */
function compat_password_verify($password, $hash) {
	if (function_exists('password_verify')) {
		if (password_verify($password, $hash)) {
			return true;
		}
	}

	$md5 = md5($password);

	return ($md5 == $hash);
}

/**
 * compat_password_hash - if the secure function exists, hash using that.
 *   If that does not exist, hash older md5 function instead
 *
 * @param  (string) $password - password to hash
 * @param  (string) $algo     - algorithm to use (PASSWORD_DEFAULT)
 *
 * @return (bool)   true if password hash matches, false otherwise
 */
function compat_password_hash($password, $algo, $options = array()) {
	if (function_exists('password_hash')) {
		// Check if options array has anything, only pass when required
		return (cacti_sizeof($options) > 0) ?
			password_hash($password, $algo, $options) :
			password_hash($password, $algo);
	}

	return md5($password);
}

/**
 * compat_password_needs_rehash - if the secure function exists, check hash
 *   using that. If that does not exist, return false as md5 doesn't need a
 *   rehash
 *
 * @param  (string) $password - password to hash
 * @param  (string) $algo     - algorithm to use (PASSWORD_DEFAULT)
 *
 * @return (bool)   true if password hash needs changing, false otherwise
 */
function compat_password_needs_rehash($password, $algo, $options = array()) {
	if (function_exists('password_needs_rehash')) {
		// Check if options array has anything, only pass when required
		return (cacti_sizeof($options) > 0) ?
			password_needs_rehash($password, $algo, $options) :
			password_needs_rehash($password, $algo);
	}

	return true;
}

/**
 * auth_user_has_access - Verify that the user account has some access to cacti
 *
 * @param  (int)  $user - The user id of the account to check
 *
 * @return (bool) True if the user has access false otherwise
 */
function auth_user_has_access($user) {
	$access = false;

	// See if they have access to any realms
	$realms = db_fetch_cell_prepared('SELECT COUNT(*)
		FROM user_auth_realm
		WHERE user_id = ?',
		array($user['id']));

	if ($realms > 0) {
		return true;
	}

	// See if they have general graph access as a guest account
	if (read_config_option('guest_user') > 0) {
		if ($user['show_tree'] == 'on' || $user['show_list'] == 'on' || $user['show_preview'] == 'on') {
			return true;
		}
	}

	// See if they have access to any group realms
	$user_groups = db_fetch_assoc_prepared('SELECT *
		FROM user_auth_group_members
		WHERE user_id = ?',
		array($user['id']));

	if (cacti_sizeof($user_groups)) {
		foreach($user_groups as $g) {
			$realms = db_fetch_cell_prepared('SELECT COUNT(*)
				FROM user_auth_group_realm
				WHERE group_id = ?',
				array($g['group_id']));

			if ($realms > 0) {
				return true;
			}

			// See if they have general graph access as a guest account
			if (read_config_option('guest_user') > 0) {
				if ($g['show_tree'] == 'on' || $g['show_list'] == 'on' || $g['show_preview'] == 'on') {
					return true;
				}
			}
		}
	}

	return false;
}

/**
 * auth_display_custom_error_message - displays a custom error message to the browser that looks like
 *   the pre-defined error messages
 *
 * @param  (string) $message - the actual text of the error message to display
 *
 * @return (void)
 */
function auth_display_custom_error_message($message) {
	global $config;

	$auth_method = read_config_option('auth_method');

	if ($auth_method == 2) {
		$custom_message = read_config_option('basic_auth_fail_message');
	} else {
		$custom_message = '';
	}

	/* kill the session */
	cacti_cookie_logout();

	/* print error */
	print '<!DOCTYPE html>';
	print '<html>';
	print '<head>';

	html_common_header(__('Cacti Login Failure'));

	print '</head>';
	print '<body><center>';
	print '<div class="ui-state-error ui-corner-all" style="width:50%;margin-left:auto;margin-right:auto;margin-top:200px;padding:20px"><p>' . $message . '</p><p>' . $custom_message . '</p></div>';

	if ($auth_method != 2) {
		print '<div class="ui-corner-all" style="width:50%;margin:auto;padding:20px"><a href="index.php">' . __('Login Again') . '</a></div><script type="text/javascript">$(function() { $("a").button(); });</script>';
	}

	print '</center></body></html>';
}

/**
 * auth_login_redirect - provide default page re-direction when a user first logs in.
 *
 * @param  (string|array) $login_opts - optional array of user details
 *
 * @return (void)
 */
function auth_login_redirect($login_opts = '') {
	global $config;

	if ($login_opts == '') {
		$login_opts = db_fetch_cell_prepared('SELECT login_opts
			FROM user_auth
			WHERE id = ?',
			array($_SESSION['sess_user_id']));
	}

	$newtheme = false;
	if (user_setting_exists('selected_theme', $_SESSION['sess_user_id']) && read_config_option('selected_theme') != read_user_setting('selected_theme')) {
		unset($_SESSION['selected_theme']);
		$newtheme = true;
	}

	// Decide what to do with an authenticated user
	switch ($login_opts) {
		case '1': /* referer */
			/**
			 * because we use plugins, we can't redirect back to graph_view.php if they don't
			 * have console access
			 */
			if (isset($_SERVER['REDIRECT_URL'])) {
				$referer = sanitize_uri($_SERVER['REDIRECT_URL']);

				if (isset($_SERVER['REDIRECT_QUERY_STRING'])) {
					$referer .= '?' . $_SERVER['REDIRECT_QUERY_STRING'];
				}

				cacti_log(sprintf("DEBUG: Referer from REDIRECT_URL with Value: '%s', Effective: '%s'", $_SERVER['REDIRECT_URL'], $referer), false, 'AUTH', POLLER_VERBOSITY_DEBUG);
			} elseif (isset($_SERVER['HTTP_REFERER'])) {
				$referer = $_SERVER['HTTP_REFERER'];

				if (auth_basename($referer) == 'logout.php') {
					$referer = $config['url_path'] . 'index.php';
				} elseif (strpos($referer, $config['url_path']) === false) {
					if (!is_realm_allowed(8)) {
						$referer = $config['url_path'] . 'graph_view.php' . ($newtheme ? '?newtheme=1':'');
					} else {
						$referer = $config['url_path'] . 'index.php' . ($newtheme ? '?newtheme=1':'');
					}
				}

				cacti_log(sprintf("DEBUG: Referer from HTTP_REFERER with Value: '%s', Effective: '%s'", $_SERVER['HTTP_REFERER'], $referer), false, 'AUTH', POLLER_VERBOSITY_DEBUG);
			} elseif (isset($_SERVER['REQUEST_URI'])) {
				$referer = sanitize_uri($_SERVER['REQUEST_URI']);

				if (auth_basename($referer) == 'logout.php') {
					$referer = $config['url_path'] . 'index.php';
				}

				cacti_log(sprintf("DEBUG: Referer from REQUEST_URI with Value: '%s', Effective: '%s'", $_SERVER['REQUEST_URI'], $referer), false, 'AUTH', POLLER_VERBOSITY_DEBUG);
			} else {
				$referer = $config['url_path'] . 'index.php';

				cacti_log(sprintf("DEBUG: Referer Short Circuit to '%s'", 'index.php'), false, 'AUTH', POLLER_VERBOSITY_DEBUG);
			}

			$referer .= ($newtheme ? (strpos($referer, '?') === false ? '?':'&') . 'newtheme=1':'');

			/* Strip out the login from the referer if present */
			$referer  = str_replace('?action=login', '', $referer);

			if (api_user_realm_auth(auth_basename($referer))) {
				header('Location: ' . $referer);
			} elseif (!is_realm_allowed(8)) {
				cacti_log(sprintf("DEBUG: Referer Overridden Due to Permissions to '%s'", 'graph_view.php'), false, 'AUTH', POLLER_VERBOSITY_DEBUG);

				header('Location: graph_view.php');
			} else {
				cacti_log(sprintf("DEBUG: Referer Overridden Due to Permissions to '%s'", 'index.php'), false, 'AUTH', POLLER_VERBOSITY_DEBUG);

				header('Location: index.php');
			}

			break;
		case '2': /* default console page */
			if (!is_realm_allowed(8)) {
				header('Location: ' . $config['url_path'] . 'graph_view.php' . ($newtheme ? '?newtheme=1':''));
			} else {
				header('Location: ' . $config['url_path'] . 'index.php' . ($newtheme ? '?newtheme=1':''));
			}

			break;
		case '3': /* default graph page */
			header('Location: ' . $config['url_path'] . 'graph_view.php' . ($newtheme ? '?newtheme=1':''));

			break;
		default:
			api_plugin_hook_function('login_options_navigate', $login_opts);
	}

	exit;
}

/**
 * auth_basename - provides a URL knowledgable basename function
 *
 * @param  (string) $referer - a URL that will included a basename
 *
 * @return (string) the file name without the arguments
 */
function auth_basename($referer) {
	$parts = explode('?', $referer);

	return basename($parts[0]);
}

/**
 * auth_login_create_user_from_template - creates a new user account from a template account
 *   if there is an error that would block login, the function set's the globals
 *   error and error_msg to inform the caller not to proceed with the login.
 *   in special cases, such as basic auth, the function will print out a custom
 *   error message and exit.
 *
 * @param  (string) $username - The username to use for the copy
 * @param  (int)    $realm - The login realm to use for the copy
 *
 * @return (array|void)  The copied new user account details or void on exit
 */
function auth_login_create_user_from_template($username, $realm) {
	global $error, $error_msg;

	cacti_log("NOTE: User '" . $username . "' does not exist, copying template user", false, 'AUTH');

	$user = array();

	$user_template = db_fetch_row_prepared('SELECT *
		FROM user_auth
		WHERE id = ?',
		array(get_template_account($username)));

	/* check that template user exists */
	if (!empty($user_template)) {
		if ($realm == 3) { // This is an ldap login
			/* get user CN*/
			$cn_full_name = read_config_option('cn_full_name');
			$cn_email     = read_config_option('cn_email');

			if ($cn_full_name != '' || $cn_email != '') {
				$ldap_cn_search_response = cacti_ldap_search_cn($username, array($cn_full_name, $cn_email));

  					if (isset($ldap_cn_search_response['cn'])) {
					$data_override = array();

					if (array_key_exists($cn_full_name, $ldap_cn_search_response['cn'])) {
						$data_override['full_name'] = $ldap_cn_search_response['cn'][$cn_full_name];
					} else {
						$data_override['full_name'] = '';
					}

					if (array_key_exists($cn_email, $ldap_cn_search_response['cn'])) {
						$data_override['email_address'] = $ldap_cn_search_response['cn'][$cn_email];
					} else {
						$data_override['email_address'] = '';
					}

					user_copy($user_template['username'], $username, $user_template['realm'], $realm, false, $data_override);
				} else {
					$ldap_response = (isset($ldap_cn_search_response[0]) ? $ldap_cn_search_response[0] : '(no response given)');
					$ldap_code = (isset($ldap_cn_search_response['error_num']) ? $ldap_cn_search_response['error_num'] : '(no code given)');
					cacti_log('LOGIN: Email Address and Full Name fields not found, reason: ' . $ldap_response . 'code: ' . $ldap_code, false, 'AUTH');
					user_copy($user_template['username'], $username, $user_template['realm'], $realm);
				}
			} else {
				user_copy($user_template['username'], $username, $user_template['realm'], $realm);
			}
		} else {
			user_copy($user_template['username'], $username, $user_template['realm'], $realm);
		}

		/* requery newly created user */
		$user = db_fetch_row_prepared('SELECT *
			FROM user_auth
			WHERE username = ?
			AND realm = ?',
			array($username, $realm));
	} else {
		/* error */
		$error     = true;
		$error_msg = __('Access Denied!  Template user id %s does not exist.  Please contact your Administrator.', read_config_option('user_template'));

		cacti_log("LOGIN FAILED: Template user id '" . read_config_option('user_template') . "' does not exist.", false, 'AUTH');

		if ($auth_method == 2) {
			auth_display_custom_error_message($error_msg);
			exit;
		}
	}

	return $user;
}

/**
 * check_reset_no_authentication - Attempts to switch Cacti from No Authentication to Local
 *   authentication, or generate an error on failure through the globals error, and error_msg.
 *
 * @param  (int)  $auth_method - The current auth method
 *
 * @return (bool) Returns false on failure to set user account, otherwise redirects
 */
function check_reset_no_authentication($auth_method) {
	global $error, $error_msg;

	if ($auth_method == 0) {
		$admin_id = db_execute_prepared('SELECT id
			FROM user_auth
			WHERE id = ?',
			array(read_config_option('admin_user')));

		cacti_log('Admin User (' . read_config_option('admin_user') . ' vs ' . $admin_id . ')', true, 'AUTH_NONE', POLLER_VERBOSITY_DEVDBG);

		if (!$admin_id) {
			$admin_sql_query = 'SELECT TOP 1 id FROM (
				SELECT ua.id
				FROM user_auth AS ua
				INNER JOIN user_auth_realm AS uar
				ON uar.user_id = ua.id
				WHERE uar.realm_id = ?';

			$admin_sql_params = array(15);

			if (db_table_exists('user_auth_group_realm')) {
				$admin_sql_query .= '
				UNION
				SELECT ua.id
				FROM user_auth AS ua
				INNER JOIN user_auth_group_members AS uagm
				ON uagm.user_id = ua.id
				INNER JOIN user_auth_group AS uag
				ON uag.id = uagm.group_id
				INNER JOIN user_auth_group_realm AS uagr
				ON uagr.group_id=uag.group_id
				WHERE uag.enabled="on" AND ua.enabled="on"
				AND uagr.realm_id = ?';

				$admin_sql_params[] = 15;
			}

			$admin_sql_query .= '
				) AS id';

			cacti_log('SQL query ' . $admin_sql_query, true, 'AUTH_NONE', POLLER_VERBOSITY_DEVDBG);
			cacti_log('SQL param ' . implode(',', $admin_sql_params), true, 'AUTH_NONE', POLLER_VERBOSITY_DEVDBG);
			$admin_id = db_fetch_cell_prepared($admin_sql_query, $admin_sql_params);
			cacti_log('SQL result ' . $admin_id, true, 'AUTH_NONE', POLLER_VERBOSITY_DEVDBG);
		}

		if (!$admin_id) {
			$admin_id = db_fetch_cell('SELECT id FROM user_auth WHERE username = \'admin\'');
			cacti_log('Final attempt ' . $admin_id, true, 'AUTH_NONE', POLLER_VERBOSITY_DEVDBG);
		}

		if (!$admin_id) {
			$error     = true;
			$error_msg = __('Authentication was previously not set.  Attempted to set to Local Authentication, but no Administrative account was found.');

			return false;
		}

		// Authentication method is currently set to none
		// lets switch this to basic and allow setting of
		// a password.
		db_execute_prepared("UPDATE user_auth SET
			password = '',
			must_change_password = 'on',
			password_change = 'on'
			WHERE id = ?",
			array($admin_id));

		$auth_method = 1;
		set_config_option('auth_method', $auth_method, true);

		$_SESSION['sess_user_id'] = $admin_id;
		$_SESSION['sess_change_password'] = true;
		header ('Location: ' . $config['url_path'] . 'auth_changepassword.php?action=force&ref=' . (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'index.php'));
		exit;
	}
}