modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2009 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  57             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  58             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  59         );
  60     }
  61
  62     function handler_index(&$page)
  63     {
  64         // Include X-XRDS-Location response-header for Yadis discovery
  65         global $globals;
  66         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  67
  68         // Redirect to the suitable page
  69         if (S::logged()) {
  70             pl_redirect('events');
  71         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  72             pl_redirect('review');
  73         }
  74     }
  75
  76     function handler_cacert(&$page)
  77     {
  78         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  79         header("Pragma:");
  80         header("Set-Cookie:");
  81         header("Cache-Control:");
  82         header("Expires:");
  83         header("Content-Type: application/x-x509-ca-cert");
  84         header("Content-Length: ".strlen($data));
  85         echo $data;
  86         exit;
  87     }
  88
  89     function handler_changelog(&$page)
  90     {
  91         $page->changeTpl('platal/changeLog.tpl');
  92
  93         $clog = pl_entities(file_get_contents(dirname(__FILE__).'/../ChangeLog'));
  94         $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  95         // url catch only (not all wiki syntax)
  96         $clog = preg_replace(array(
  97             '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  98             '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  99             '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
 100           array(
 101             '<a href="\\0">\\0</a>',
 102             '\\1<a href="http://www.\\2">www.\\2</a>',
 103             '<a href="mailto:\\0">\\0</a>'),
 104           $clog);
 105         $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 106         $clog = preg_replace('!vim:.*$!', '', $clog);
 107         $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 108         $page->assign('ChangeLog', $clog);
 109     }
 110
 111     function __set_rss_state($state)
 112     {
 113         if ($state) {
 114             $_SESSION['core_rss_hash'] = rand_url_id(16);
 115             XDB::execute('UPDATE  auth_user_quick
 116                                    SET  core_rss_hash={?} WHERE user_id={?}',
 117                                    S::v('core_rss_hash'), S::v('uid'));
 118         } else {
 119             XDB::execute('UPDATE  auth_user_quick
 120                                    SET  core_rss_hash="" WHERE user_id={?}',
 121                                    S::v('uid'));
 122             S::kill('core_rss_hash');
 123         }
 124     }
 125
 126     function handler_prefs(&$page)
 127     {
 128         $page->changeTpl('platal/preferences.tpl');
 129         $page->setTitle('Mes préférences');
 130
 131         if (Post::has('mail_fmt')) {
 132             $fmt = Post::v('mail_fmt');
 133             if ($fmt != 'texte') $fmt = 'html';
 134             XDB::execute("UPDATE auth_user_quick
 135                                        SET core_mail_fmt = '$fmt'
 136                                      WHERE user_id = {?}",
 137                                      S::v('uid'));
 138             $_SESSION['mail_fmt'] = $fmt;
 139         }
 140
 141         if (Post::has('rss')) {
 142             $this->__set_rss_state(Post::b('rss'));
 143         }
 144
 145         # FIXME: this code is not multi-domain compatible. We should decide how
 146         # carva will extend to users not in the main domain.
 147         $res = XDB::query("SELECT  alias
 148                              FROM  aliases
 149                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 150                           S::user()->id());
 151         $page->assign('bestalias', $res->fetchOneCell());
 152     }
 153
 154     function handler_webredir(&$page)
 155     {
 156         $page->changeTpl('platal/webredirect.tpl');
 157
 158         $page->setTitle('Redirection de page WEB');
 159
 160         $log =& S::v('log');
 161         $url = Env::v('url');
 162
 163         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 164             XDB::execute('UPDATE auth_user_quick
 165                                        SET redirecturl = {?} WHERE user_id = {?}',
 166                                    $url, S::v('uid'));
 167             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 168             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 169         } elseif (Env::v('submit') == "Supprimer") {
 170             XDB::execute("UPDATE auth_user_quick
 171                                        SET redirecturl = ''
 172                                      WHERE user_id = {?}",
 173                                    S::v('uid'));
 174             S::logger()->log("carva_del", $url);
 175             Post::kill('url');
 176             $page->trigSuccess('Redirection supprimée');
 177         }
 178
 179         $res = XDB::query('SELECT redirecturl
 180                                        FROM auth_user_quick
 181                                       WHERE user_id = {?}',
 182                                     S::v('uid'));
 183         $page->assign('carva', $res->fetchOneCell());
 184
 185         # FIXME: this code is not multi-domain compatible. We should decide how
 186         # carva will extend to users not in the main domain.
 187         $res = XDB::query("SELECT  alias
 188                              FROM  aliases
 189                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 190                           S::user()->id());
 191         $page->assign('bestalias', $res->fetchOneCell());
 192     }
 193
 194     function handler_prefs_rss(&$page)
 195     {
 196         $page->changeTpl('platal/filrss.tpl');
 197
 198         $page->assign('goback', Env::v('referer', 'login'));
 199
 200         if (Env::v('act_rss') == 'Activer') {
 201             $this->__set_rss_state(true);
 202             $page->trigSuccess("Ton Fil RSS est activé.");
 203         }
 204     }
 205
 206     function handler_password(&$page)
 207     {
 208         global $globals;
 209
 210         if (Post::has('response2'))  {
 211             require_once 'secure_hash.inc.php';
 212             S::assert_xsrf_token();
 213
 214             $_SESSION['password'] = $password = Post::v('response2');
 215
 216             XDB::execute('UPDATE  auth_user_md5
 217                              SET  password={?}
 218                            WHERE  user_id={?}', $password,
 219                            S::v('uid'));
 220
 221             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 222             // updates the Google Apps password as well.
 223             if ($globals->mailstorage->googleapps_domain) {
 224                 require_once 'googleapps.inc.php';
 225                 $account = new GoogleAppsAccount(S::user());
 226                 if ($account->active() && $account->sync_password) {
 227                     $account->set_password($password);
 228                 }
 229             }
 230
 231             S::logger()->log('passwd');
 232             Platal::session()->setAccessCookie(true);
 233
 234             $page->changeTpl('platal/motdepasse.success.tpl');
 235             $page->run();
 236         }
 237
 238         $page->changeTpl('platal/motdepasse.tpl');
 239         $page->addJsLink('motdepasse.js');
 240         $page->setTitle('Mon mot de passe');
 241     }
 242
 243     function handler_smtppass(&$page)
 244     {
 245         $page->changeTpl('platal/acces_smtp.tpl');
 246         $page->setTitle('Acces SMTP/NNTP');
 247
 248         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 249         $wp->buildCache();
 250         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 251         $wp->buildCache();
 252
 253         $uid  = S::v('uid');
 254         $pass = Env::v('smtppass1');
 255         $log  = S::v('log');
 256
 257         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 258         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 259         {
 260             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 261                                      WHERE user_id = {?}', $pass, $uid);
 262             $page->trigSuccess('Mot de passe enregistré');
 263             S::logger()->log("passwd_ssl");
 264         } elseif (Env::v('op') == "Supprimer") {
 265             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 266                                      WHERE user_id = {?}', $uid);
 267             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 268             S::logger()->log("passwd_del");
 269         }
 270
 271         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 272                                        FROM auth_user_md5
 273                                       WHERE user_id = {?}", $uid);
 274         $page->assign('actif', $res->fetchOneCell());
 275     }
 276
 277     function handler_recovery(&$page)
 278     {
 279         global $globals;
 280
 281         $page->changeTpl('platal/recovery.tpl');
 282
 283         if (!Env::has('login') || !Env::has('birth')) {
 284             return;
 285         }
 286
 287         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 288             $page->trigError('Date de naissance incorrecte ou incohérente');
 289             return;
 290         }
 291
 292         $birth   = sprintf('%s-%s-%s',
 293                            substr(Env::v('birth'), 4, 4),
 294                            substr(Env::v('birth'), 2, 2),
 295                            substr(Env::v('birth'), 0, 2));
 296
 297         $mailorg = strtok(Env::v('login'), '@');
 298
 299         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 300         // avec celle fournie ici en espérant que c'est la bonne
 301
 302         $res = XDB::query(
 303                 "SELECT  user_id, naissance
 304                    FROM  auth_user_md5 AS u
 305              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 306                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 307         list($uid, $naissance) = $res->fetchOneRow();
 308
 309         if ($naissance == $birth) {
 310             $res = XDB::query("SELECT  COUNT(*)
 311                                  FROM  emails
 312                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 313             $count = intval($res->fetchOneCell());
 314             if ($count == 0) {
 315                 $page->assign('no_addr', true);
 316                 return;
 317             }
 318
 319             $page->assign('ok', true);
 320
 321             $url   = rand_url_id();
 322             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 323                                VALUES  ({?},{?},NOW())', $url, $uid);
 324             $res   = XDB::query('SELECT  email
 325                                    FROM  emails
 326                                   WHERE  uid = {?} AND email = {?}',
 327                                 $uid, Post::v('email'));
 328             if ($res->numRows()) {
 329                 $mails = $res->fetchOneCell();
 330             } else {
 331                 $user  = User::getSilent($uid);
 332                 $mails = $user->bestEmail();
 333                 $res   = XDB::query("SELECT  email
 334                                        FROM  emails
 335                                       WHERE  uid = {?} AND NOT FIND_IN_SET('filter', flags)
 336                                              AND NOT FIND_IN_SET('active', flags)",
 337                                     $uid);
 338                 if ($res->numRows() > 0) {
 339                     $mails .= ', ' . implode(', ', $res->fetchColumn());
 340                 }
 341             }
 342             $mymail = new PlMailer();
 343             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 344             $mymail->addTo($mails);
 345             $mymail->setSubject('Ton certificat d\'authentification');
 346             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 347 {$globals->baseurl}/tmpPWD/$url
 348
 349 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 350
 351 --
 352 Polytechnique.org
 353 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 354
 355 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 356 Adresse de secours : " . Post::v('email') : ""));
 357             $mymail->send();
 358
 359             // on cree un objet logger et on log l'evenement
 360             S::logger($uid)->log('recovery', $mails);
 361         } else {
 362             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 363                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 364         }
 365     }
 366
 367     function handler_tmpPWD(&$page, $certif = null)
 368     {
 369         global $globals;
 370         XDB::execute('DELETE FROM perte_pass
 371                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 372
 373         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 374         $ligne = $res->fetchOneAssoc();
 375         if (!$ligne) {
 376             $page->changeTpl('platal/index.tpl');
 377             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 378         }
 379
 380         $uid = $ligne["uid"];
 381         if (Post::has('response2')) {
 382             $password = Post::v('response2');
 383             XDB::query('UPDATE  auth_user_md5 SET password={?}
 384                                    WHERE  user_id={?} AND perms IN("admin","user")',
 385                                  $password, $uid);
 386             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 387
 388             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 389             // updates the Google Apps password as well.
 390             if ($globals->mailstorage->googleapps_domain) {
 391                 require_once 'googleapps.inc.php';
 392                 $account = new GoogleAppsAccount(User::getSilent($uid));
 393                 if ($account->active() && $account->sync_password) {
 394                     $account->set_password($password);
 395                 }
 396             }
 397
 398             S::logger($uid)->log("passwd", "");
 399             $page->changeTpl('platal/tmpPWD.success.tpl');
 400         } else {
 401             $page->changeTpl('platal/motdepasse.tpl');
 402             $page->addJsLink('motdepasse.js');
 403         }
 404     }
 405
 406     function handler_skin(&$page)
 407     {
 408         global $globals;
 409
 410         $page->changeTpl('platal/skins.tpl');
 411         $page->setTitle('Skins');
 412
 413         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 414             XDB::execute('UPDATE auth_user_quick
 415                              SET skin={?} WHERE user_id={?}',
 416                          Env::i('newskin'), S::v('uid'));
 417             S::kill('skin');
 418             Platal::session()->setSkin();
 419         }
 420
 421         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 422         $page->assign('skin_id', $res->fetchOneCell());
 423
 424         $sql = "SELECT s.*,auteur,count(*) AS nb
 425                   FROM skins AS s
 426              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 427                  WHERE skin_tpl != '' AND ext != ''
 428               GROUP BY id ORDER BY s.date DESC";
 429         $page->assign('skins', XDB::iterator($sql));
 430     }
 431
 432     function handler_exit(&$page, $level = null)
 433     {
 434         if (S::has('suid')) {
 435             $suid = S::v('suid');
 436             $log  = S::v('log');
 437             S::logger()->log("suid_stop", S::user()->login() . " by " . $suid['hruid']);
 438             Platal::session()->stopSUID();
 439             pl_redirect('admin/user/' . S::user()->login());
 440         }
 441
 442         if ($level == 'forget' || $level == 'forgetall') {
 443             Platal::session()->killAccessCookie();
 444         }
 445
 446         if ($level == 'forgetuid' || $level == 'forgetall') {
 447             Platal::session()->killLoginFormCookies();
 448         }
 449
 450         if (S::logged()) {
 451             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 452             Platal::session()->destroy();
 453         }
 454
 455         if (Get::has('redirect')) {
 456             http_redirect(rawurldecode(Get::v('redirect')));
 457         } else {
 458             $page->changeTpl('platal/exit.tpl');
 459         }
 460     }
 461
 462     function handler_review(&$page, $action = null, $mode = null)
 463     {
 464         // Include X-XRDS-Location response-header for Yadis discovery
 465         global $globals;
 466         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 467
 468         $this->load('review.inc.php');
 469         $dom = 'Review';
 470         if (@$GLOBALS['IS_XNET_SITE']) {
 471             $dom .= 'Xnet';
 472         }
 473         $wp = new PlWikiPage($dom . '.Admin');
 474         $conf = explode('%0a', $wp->getField('text'));
 475         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 476         foreach ($conf as $line) {
 477             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 478             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 479         }
 480         $wiz->apply($page, 'review', $action, $mode);
 481     }
 482 }
 483
 484 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 485 ?>