Using the new role approach. The user authentification now depends in the SecurityServiceProvider settings. This service depends as well in the SessionServiceProvider.

Users are login/logout using that service, we don't use anymore the local.inc.php (the cas, openid, will be disabled for now).
This service loads the user information depending in the Entity\User and Entity\Repository\UserRepository see #6257

main/admin/index.php

@@ -7,6 +7,7 @@
 /**
  * Code
  */
+
 // Language files that need to be included.
 $language_file = array('admin', 'tracking','coursebackup');
 

main/admin/user_add.php

@@ -210,6 +210,7 @@ if (isset($drh_list) && is_array($drh_list)) {
 }
 $form->addElement('html', '</div>');
 
+/*
 if (api_is_platform_admin()) {
     // Platform admin
     $group = array();
@@ -219,7 +220,7 @@ if (api_is_platform_admin()) {
     $form->addElement('html', '<div id="id_platform_admin" style="display:'.$display.';">');
     $form->addGroup($group, 'admin', get_lang('PlatformAdmin'), '&nbsp;');
     $form->addElement('html', '</div>');
-}
+}*/
 
 $form->addElement('select_language', 'language', get_lang('Language'), null);
 
@@ -383,9 +384,7 @@ if ($form->validate()) {
                     UserManager::update_extra_field_value($user_id, substr($key, 6), $value);
                 }
             }
-            if ($platform_admin) {
-                UserManager::add_user_as_admin($user_id);
-            }
+
             $message = get_lang('UserAdded');
         }
         if (isset($user['submit_plus'])) {

main/admin/user_list.php

@@ -9,7 +9,6 @@
 // name of the language file that needs to be included
 $language_file = array ('registration','admin');
 $cidReset = true;
-require_once '../inc/global.inc.php';
 
 global $_configuration;
 
@@ -410,7 +409,7 @@ function get_user_data($from, $number_of_items, $column, $direction, $get_count
 		}
         if ($user[7] == 1 && $user[10] != '0000-00-00 00:00:00') {
             // check expiration date
-            $expiration_time = convert_sql_date($user[10]);
+            $expiration_time = api_convert_sql_date($user[10]);
             // if expiration date is passed, store a special value for active field
             if ($expiration_time < $t) {
         	   $user[7] = '-1';
@@ -462,8 +461,9 @@ function modify_filter($user_id, $url_params, $row) {
 	}
 	$result = '';
 	if (!$user_is_anonymous) {
+        $icon = Display::return_icon('course.gif', get_lang('Courses'), array('onmouseout' =>'"clear_course_list (\'div_'.$user_id.'\')" '));
 		$result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
-					<img onmouseout="clear_course_list (\'div_'.$user_id.'\')" src="../img/course.gif" title="'.get_lang('Courses').'" alt="'.get_lang('Courses').'"/>
+					'.$icon.'
 					<div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
 					</a>&nbsp;&nbsp;';
 	} else {
@@ -509,6 +509,9 @@ function modify_filter($user_id, $url_params, $row) {
         }
     } // Else don't show anything, because the option is not available at all
 
+
+    $result .= Display::url('<i class="icon-key icon-large"></i>', 'roles');
+
 	if ($current_user_status_label != $statusname[STUDENT]) {
 		$result .= Display::return_icon('statistics_na.gif', get_lang('Reporting')).'&nbsp;&nbsp;';
 	} else {

main/inc/global.inc.php

@@ -337,7 +337,12 @@ if ($alreadyInstalled) {
     api_set_internationalization_default_encoding($charset);
 
     // include the local (contextual) parameters of this course or section
-    require $includePath.'/local.inc.php';
+    $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
+
+    // $cidReset can be set in URL-parameter
+    $cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq'] != $_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
+
+    // require $includePath.'/local.inc.php';
 
     // reconfigure template now we know the user
     $app['template.hide_global_chat'] = !api_is_global_chat_enabled();
@@ -546,7 +551,37 @@ $app->before(
 
         // Check and modify the date of user in the track.e.online table
         Online::loginCheck(api_get_user_id());
+
         $app['request']->getSession()->start();
+
+        //var_dump($app['security']->isGranted('IS_AUTHENTICATED_FULLY'));
+
+        if ($app['security']->isGranted('IS_AUTHENTICATED_FULLY')) {
+            $token = $app['security']->getToken();
+            if (null !== $token) {
+                $user = $token->getUser();
+            }
+            $userInfo = api_get_user_info($user->getUserId());
+            $userInfo['is_anonymous'] = false;
+
+            Session::write('_user', $userInfo);
+            $app['current_user'] = $userInfo;
+
+            if ($app['security']->isGranted('ROLE_ADMIN')) {
+                Session::write('is_platformAdmin', true);
+            }
+
+            if ($app['security']->isGranted('ROLE_TEACHER')) {
+                Session::write('is_allowedCreateCourse', true);
+            }
+
+        } else {
+            Session::erase('_user');
+            Session::erase('is_platformAdmin');
+            Session::erase('is_allowedCreateCourse');
+        }
+
+        //Session::write('_user', $uData);
     }
 );
 

main/inc/lib/usermanager.lib.php

@@ -45,7 +45,8 @@ class UserManager
     /**
      * Empty constructor. This class is mostly static.
      */
-    public function __construct () {
+    public function __construct ()
+    {
 
     }
 
@@ -344,10 +345,16 @@ class UserManager
             }
 
             global $app;
+            // Adding user
             /** @var Entity\User $user */
             $em = $app['orm.ems']['db_write'];
             $user = $em->getRepository('Entity\User')->find($return);
-            $role = $em->getRepository('Entity\Role')->findOneByRole('ROLE_STUDENT');
+            $role = $em->getRepository('Entity\Role')->find($status);
+
+            if ($role->getRole() == 'ROLE_ADMIN') {
+                UserManager::add_user_as_admin($return);
+            }
+
             $user->getRolesObj()->add($role);
             $em->persist($user);
             $em->flush();
@@ -1347,7 +1354,7 @@ class UserManager
             $filename = in_array($old_extension, $allowed_types) ? substr($old_file, 0, -strlen($old_extension)) : $old_file;
             $filename = (substr($filename, -1) == '.') ? $filename.$extension : $filename.'.'.$extension;
         } else {
-            $filename = replace_dangerous_char($filename);
+            $filename = api_replace_dangerous_char($filename);
             if (PREFIX_IMAGE_FILENAME_WITH_UID) {
                 $filename = uniqid('').'_'.$filename;
             }

main/inc/local.inc.php

@@ -65,6 +65,8 @@ $logging_in = false;
 $errorMessage = null;
 $loginFailed = true;
 
+return;
+
 if (!empty($_SESSION['_user']['user_id']) && !$login) {
     // uid is in session => login already done, continue with this value
     $_user['user_id'] = $_SESSION['_user']['user_id'];

main/inc/services.php

@@ -38,44 +38,35 @@ $app->register(new Silex\Provider\HttpCacheServiceProvider(), array(
 ));*/
 
 // http://symfony.com/doc/master/reference/configuration/security.html
-/*
+
 $app->register(new Silex\Provider\SecurityServiceProvider(), array(
     'security.firewalls' => array(
         'login' => array(
             'pattern' => '^/login$',
             'anonymous' => true
         ),
-        'secured' => array(
+        'admin' => array(
             //'http' => true,
-            'pattern' => '^/secured',
+            'pattern' => '^/.*$',
             'form'    => array(
                 'login_path' => '/login',
-                'check_path' => '/secured/login_check',
-                'default_target_path' => 'admin/',
+                'check_path' => '/admin/login_check',
+                'default_target_path' => '/userportal',
                 'username_parameter' => 'username',
                 'password_parameter' => 'password',
             ),
             'logout' => array(
-                'logout_path' => '/secured/logout',
+                'logout_path' => '/admin/logout',
                 'target' => '/'
             ),
             'users' => $app->share(function() use ($app) {
                 return $app['orm.em']->getRepository('Entity\User');
             }),
-            'anonymous' => false
-        ),
-        'classic' => array(
-            'pattern' => '^/.*$',
             'anonymous' => true
-        )
-    ),
-    'security.role_hierarchy'=> array(
-        'ROLE_ADMIN' => array('ROLE_TEACHER'),
-        "ROLE_TEACHER" => array('ROLE_STUDENT'),
-        "ROLE_STUDENT" => array('ROLE_STUDENT'),
-        "ROLE_ANONYMOUS" => array("ROLE_ANONYMOUS"),
-        "ROLE_RRHH" => array("ROLE_RRHH"),
-        "ROLE_QUESTION_MANAGER" => array("ROLE_QUESTION_MANAGER")
+        ),/*
+        'classic' => array(
+            'pattern' => '^/.*$'
+        )*/
     )
 ));
 
@@ -86,10 +77,25 @@ $app['security.encoder.digest'] = $app->share(function($app) {
     // use only 1 iteration
     return new MessageDigestPasswordEncoder('sha1', false, 1);
 });
-*/
 
-/*
- *
+$app['security.role_hierarchy'] = array(
+    'ROLE_ADMIN' => array('ROLE_QUESTION_MANAGER', 'ROLE_TEACHER', 'ROLE_ALLOWED_TO_SWITCH'),
+    'ROLE_TEACHER' => array('ROLE_STUDENT'),
+    'ROLE_RRHH' => array('ROLE_TEACHER'),
+    'ROLE_QUESTION_MANAGER' => array('ROLE_QUESTION_MANAGER'),
+    'ROLE_STUDENT' => array('ROLE_STUDENT'),
+    'ROLE_ANONYMOUS' => array('ROLE_ANONYMOUS')
+);
+
+$app['security.access_rules'] = array(
+    array('^/admin/administrator', 'ROLE_ADMIN'),
+    array('^/admin/questionmanager', 'ROLE_QUESTION_MANAGER'),
+    array('^/main/admin/.*', 'ROLE_ADMIN'),
+    array('^/main/.*', array('ROLE_STUDENT'))
+    //array('^.*$', 'ROLE_USER'),
+);
+
+/**
 $app['security.access_manager'] = $app->share(function($app) {
     return new AccessDecisionManager($app['security.voters'], 'unanimous');
 });*/

main/template/default/admin/administrator/role/list.tpl

@@ -1,7 +1,9 @@
 {% extends app.template_style ~ "/layout/layout_1_col.tpl" %}
 {% block content %}
     {% for item in items %}
-         {{ item.name }} - {{ item.role}}  <a class="btn" href="{{ url('admin_administrator_roles_edit', { id: item.id }) }}"> Edit</a>
+         {{ item.name }} - {{ item.role}}
+        <a class="btn" href="{{ url('admin_administrator_roles_edit', { id: item.id }) }}"> Edit</a>
+        <a class="btn" href="{{ url('admin_administrator_roles_delete', { id: item.id }) }}"> Delete</a>
         <br />
     {% endfor %}
 

main/template/default/auth/login.tpl

@@ -1,6 +1,42 @@
-<form action="{{ url('secured_login_check') }}" method="post">
+{% extends app.template_style ~ "/layout/layout_1_col.tpl" %}
+{% block content %}
+<style type="text/css">
+    body {
+    padding-top: 40px;
+    padding-bottom: 40px;
+    background-color: #f5f5f5;
+    }
+
+    .form-signin {
+    max-width: 300px;
+    padding: 19px 29px 29px;
+    margin: 0 auto 20px;
+    background-color: #fff;
+    border: 1px solid #e5e5e5;
+    -webkit-border-radius: 5px;
+       -moz-border-radius: 5px;
+            border-radius: 5px;
+    -webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
+       -moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
+            box-shadow: 0 1px 2px rgba(0,0,0,.05);
+    }
+    .form-signin .form-signin-heading,
+    .form-signin .checkbox {
+    margin-bottom: 10px;
+    }
+    .form-signin input[type="text"],
+    .form-signin input[type="password"] {
+    font-size: 16px;
+    height: auto;
+    margin-bottom: 15px;
+    padding: 7px 9px;
+    }
+</style>
+<form class="form-signin" action="{{ url('admin_login_check') }}" method="post">
     {{ error }}
-    <input type="text" name="username"  />
-    <input type="password" name="password" value="" />
-    <input type="submit" />
+    <input class="input-block-level" type="text" name="username" />
+    <input class="input-block-level" type="password" name="password" value="" />
+    <button class="btn btn-large btn-primary" type="submit">Sign in</button>
 </form>
+
+{% endblock %}

main/template/default/layout/main.tpl

@@ -2,6 +2,9 @@
 {% include app.template_style ~ "/layout/main_header.tpl" %}
 {% endblock %}
 {% block body %}
+    {% block content %}
+    {% endblock %}
+
 	{% if show_sniff == 1 %}
 	 	{% include app.template_style ~ "/layout/sniff.tpl" %}
 	{% endif %}
@@ -17,4 +20,4 @@
     {% endif %}
 {% include app.template_style ~ "/layout/main_footer.tpl" %}
 {{ xhprof }}
-{% endblock %}
+{% endblock %}

main/template/default/layout/messages.tpl

@@ -0,0 +1,9 @@
+{% set alertTypeAvaillable = [ 'info', 'success', 'warning', 'error', 'notice'] %}
+{% for alert in alertTypeAvaillable %}
+    {% for message in app.session.getFlashBag.get(alert) %}
+        <div class="alert alert-{{ alert }}" >
+            <button class="close" data-dismiss="alert">×</button>
+            {{ message|trans }}
+        </div>
+    {% endfor %}
+{% endfor %}

main/template/default/layout/page_body.tpl

@@ -23,6 +23,8 @@
     </section>
 {% endif %}
 
+{% include app.template_style ~ "/layout/messages.tpl" %}
+
 {#  Welcome to course block  #}
 {% if welcome_to_course_block %}
     <section id="welcome_to_course">

src/ChamiloLMS/Controller/IndexController.php

@@ -27,7 +27,6 @@ class IndexController extends CommonController
         $userId = api_get_user_id();
         \Online::logout($userId, true);
 
-
         // the Online::logout function already does a redirect
         //return $app->redirect($app['url_generator']->generate('index'));
     }
@@ -138,7 +137,6 @@ class IndexController extends CommonController
         if (api_get_setting('allow_terms_conditions') == 'true') {
             unset($_SESSION['term_and_condition']);
         }
-
         // If we are not logged in and custompages activated
         if (!api_get_user_id() && \CustomPages::enabled()) {
             $loggedOut = $request->get('loggedout');
@@ -309,20 +307,23 @@ class IndexController extends CommonController
           return $app['template']->assign('form', $form->createView());
          */
 
-        $form = new \FormValidator('formLogin', 'POST', $app['url_generator']->generate('index'), null, array('class' => 'form-vertical'));
+        $form = new \FormValidator('formLogin', 'POST', $app['url_generator']->generate('admin_login_check'), null, array('class' => 'form-vertical'));
         $form->addElement(
             'text',
-            'login',
+            'username',
             get_lang('UserName'),
-            array('class' => 'input-medium autocapitalize_off', 'autofocus' => 'autofocus')
+            array(
+                'class' => 'input-medium autocapitalize_off',
+                'autofocus' => 'autofocus'
+            )
         );
         $form->addElement('password', 'password', get_lang('Pass'), array('class' => 'input-medium '));
         $form->addElement('style_submit_button', 'submitAuth', get_lang('LoginEnter'), array('class' => 'btn'));
         $html = $form->return_form();
-        if (api_get_setting('openid_authentication') == 'true') {
+        /*if (api_get_setting('openid_authentication') == 'true') {
             include_once 'main/auth/openid/login.php';
             $html .= '<div>'.openid_form().'</div>';
-        }
+        }*/
         return $html;
     }
 
@@ -466,4 +467,15 @@ class IndexController extends CommonController
         }
         return \Display::return_message($message, 'error');
     }
+
+    function dashboardAction(Application $app)
+    {
+        $template = $app['template'];
+
+        $template->assign('content', 'welcome!');
+        $response = $template->render_layout('layout_2_col.tpl');
+
+        //return new Response($response, 200, array('Cache-Control' => 's-maxage=3600, public'));
+        return new Response($response, 200, array());
+    }
 }