modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2010 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  57             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  58             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  59         );
  60     }
  61
  62     function handler_index(&$page)
  63     {
  64         // Include X-XRDS-Location response-header for Yadis discovery
  65         global $globals;
  66         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  67
  68         // Redirect to the suitable page
  69         if (S::logged()) {
  70             pl_redirect('events');
  71         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  72             $this->handler_review($page);
  73         }
  74     }
  75
  76     function handler_cacert(&$page)
  77     {
  78         pl_cached_content_headers("application/x-x509-ca-cert");
  79         readfile("/etc/ssl/xorgCA/cacert.pem");
  80         exit;
  81     }
  82
  83     function handler_changelog(&$page, $core = null)
  84     {
  85         $page->changeTpl('platal/changeLog.tpl');
  86
  87         function formatChangeLog($file) {
  88             $clog = pl_entities(file_get_contents($file));
  89             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  90             // url catch only (not all wiki syntax)
  91             $clog = preg_replace(array(
  92                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  93                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  94                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  95               array(
  96                 '<a href="\\0">\\0</a>',
  97                 '\\1<a href="http://www.\\2">www.\\2</a>',
  98                 '<a href="mailto:\\0">\\0</a>'),
  99               $clog);
 100             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 101             $clog = preg_replace('!vim:.*$!', '', $clog);
 102             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 103         }
 104         if ($core != 'core') {
 105             $page->assign('core', false);
 106             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 107         } else {
 108             $page->assign('core', true);
 109             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 110         }
 111     }
 112
 113     function __set_rss_state($state)
 114     {
 115         if ($state) {
 116             S::set('token', rand_url_id(16));
 117             XDB::execute('UPDATE  accounts
 118                              SET  token = {?}
 119                            WHERE  uid = {?}', S::s('token'), S::i('uid'));
 120         } else {
 121             S::kill('token');
 122             XDB::execute('UPDATE  accounts
 123                              SET  token = NULL
 124                            WHERE  uid = {?}', S::i('uid'));
 125         }
 126     }
 127
 128     function handler_prefs(&$page)
 129     {
 130         $page->changeTpl('platal/preferences.tpl');
 131         $page->setTitle('Mes préférences');
 132
 133         if (Post::has('email_format')) {
 134             $fmt = Post::s('email_format');
 135             S::user()->setEmailFormat($fmt);
 136             S::set('email_format', $fmt);
 137         }
 138
 139         if (Post::has('rss')) {
 140             $this->__set_rss_state(Post::b('rss'));
 141         }
 142
 143         # FIXME: this code is not multi-domain compatible. We should decide how
 144         # carva will extend to users not in the main domain.
 145         $res = XDB::query("SELECT  alias
 146                              FROM  aliases
 147                             WHERE  uid = {?} AND FIND_IN_SET('bestalias', flags)",
 148                           S::user()->id());
 149         $page->assign('bestalias', $res->fetchOneCell());
 150     }
 151
 152     function handler_webredir(&$page)
 153     {
 154         $page->changeTpl('platal/webredirect.tpl');
 155         $page->setTitle('Redirection de page WEB');
 156
 157         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 158             if (Env::blank('url')) {
 159                 $page->trigError('URL invalide');
 160             } else {
 161                 $url = Env::t('url');
 162                 XDB::execute('REPLACE INTO  carvas (uid, url)
 163                                     VALUES  ({?}, {?})',
 164                              S::i('uid'), $url);
 165                 S::logger()->log('carva_add', 'http://' . $url);
 166                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 167             }
 168         } elseif (Env::v('submit') == 'Supprimer') {
 169             XDB::execute('DELETE FROM carvas
 170                                 WHERE uid = {?}', S::i('uid'));
 171             Post::kill('url');
 172             S::logger()->log('carva_del');
 173             $page->trigSuccess('Redirection supprimée');
 174         }
 175
 176         $url = XDB::fetchOneCell('SELECT  url
 177                                     FROM  carvas
 178                                    WHERE  uid = {?}', S::i('uid'));
 179         $page->assign('carva', $url);
 180
 181         # FIXME: this code is not multi-domain compatible. We should decide how
 182         # carva will extend to users not in the main domain.
 183         $res = XDB::query("SELECT  alias
 184                              FROM  aliases
 185                             WHERE  uid = {?} AND FIND_IN_SET('bestalias', flags)",
 186                           S::user()->id());
 187         $page->assign('bestalias', $res->fetchOneCell());
 188     }
 189
 190     function handler_prefs_rss(&$page)
 191     {
 192         $page->changeTpl('platal/filrss.tpl');
 193
 194         $page->assign('goback', Env::v('referer', 'login'));
 195
 196         if (Env::v('act_rss') == 'Activer') {
 197             $this->__set_rss_state(true);
 198             $page->trigSuccess("Ton Fil RSS est activé.");
 199         }
 200     }
 201
 202     function handler_password(&$page)
 203     {
 204         global $globals;
 205
 206         if (Post::has('response2'))  {
 207             S::assert_xsrf_token();
 208
 209             S::set('password', $password = Post::v('response2'));
 210             XDB::execute('UPDATE  accounts
 211                              SET  password = {?}
 212                            WHERE  uid={?}', $password,
 213                          S::i('uid'));
 214
 215             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 216             // updates the Google Apps password as well.
 217             if ($globals->mailstorage->googleapps_domain) {
 218                 require_once 'googleapps.inc.php';
 219                 $account = new GoogleAppsAccount(S::user());
 220                 if ($account->active() && $account->sync_password) {
 221                     $account->set_password($password);
 222                 }
 223             }
 224
 225             S::logger()->log('passwd');
 226             Platal::session()->setAccessCookie(true);
 227
 228             $page->changeTpl('platal/motdepasse.success.tpl');
 229             $page->run();
 230         }
 231
 232         $page->changeTpl('platal/motdepasse.tpl');
 233         $page->addJsLink('motdepasse.js');
 234         $page->setTitle('Mon mot de passe');
 235     }
 236
 237     function handler_smtppass(&$page)
 238     {
 239         $page->changeTpl('platal/acces_smtp.tpl');
 240         $page->setTitle('Acces SMTP/NNTP');
 241
 242         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 243         $wp->buildCache();
 244         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 245         $wp->buildCache();
 246
 247         $uid  = S::i('uid');
 248         $pass = Env::v('smtppass1');
 249
 250         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 251             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 252             XDB::execute('UPDATE  accounts
 253                              SET  weak_password = {?}
 254                            WHERE  uid = {?}', $pass, $uid);
 255             $page->trigSuccess('Mot de passe enregistré');
 256             S::logger()->log("passwd_ssl");
 257         } elseif (Env::v('op') == "Supprimer") {
 258             XDB::execute('UPDATE  accounts
 259                              SET  weak_password = NULL
 260                            WHERE  uid = {?}', $uid);
 261             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 262             S::logger()->log("passwd_del");
 263         }
 264
 265         $res = XDB::query("SELECT  weak_password IS NOT NULL
 266                              FROM  accounts
 267                             WHERE  uid = {?}", $uid);
 268         $page->assign('actif', $res->fetchOneCell());
 269     }
 270
 271     function handler_recovery(&$page)
 272     {
 273         global $globals;
 274
 275         $page->changeTpl('platal/recovery.tpl');
 276
 277         if (!Env::has('login') || !Env::has('birth')) {
 278             return;
 279         }
 280
 281         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 282             $page->trigError('Date de naissance incorrecte ou incohérente');
 283             return;
 284         }
 285
 286         $birth   = sprintf('%s-%s-%s',
 287                            substr(Env::v('birth'), 4, 4),
 288                            substr(Env::v('birth'), 2, 2),
 289                            substr(Env::v('birth'), 0, 2));
 290
 291         $mailorg = strtok(Env::v('login'), '@');
 292
 293         $profile = Profile::get(Env::t('login'));
 294         if (is_null($profile) || $profile->birthdate != $birth) {
 295             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 296                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 297             return;
 298         }
 299
 300         $user = $profile->owner();
 301         if ($user->state != 'active') {
 302             $page->trigError('Ton compte n\'est pas activé.');
 303             return;
 304         }
 305
 306         $res = XDB::query("SELECT  COUNT(*)
 307                              FROM  emails
 308                             WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $user->id());
 309         $count = intval($res->fetchOneCell());
 310         if ($count == 0) {
 311             $page->assign('no_addr', true);
 312             return;
 313         }
 314
 315         $page->assign('ok', true);
 316
 317         $url   = rand_url_id();
 318         XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
 319                            VALUES  ({?},{?},NOW())', $url, $user->id());
 320         $res   = XDB::query('SELECT  email
 321                                FROM  emails
 322                               WHERE  uid = {?} AND email = {?}',
 323                             $user->id(), Post::v('email'));
 324         if ($res->numRows()) {
 325             $mails = $res->fetchOneCell();
 326         } else {
 327             $res   = XDB::query("SELECT  email
 328                                    FROM  emails
 329                                   WHERE  uid = {?} AND NOT FIND_IN_SET('filter', flags)", $user->id());
 330             $mails = implode(', ', $res->fetchColumn());
 331         }
 332         $mymail = new PlMailer();
 333         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 334         $mymail->addTo($mails);
 335         $mymail->setSubject("Ton certificat d'authentification");
 336         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 337 {$globals->baseurl}/tmpPWD/$url
 338
 339 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 340
 341 --
 342 Polytechnique.org
 343 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 344
 345 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 346 Adresse de secours : " . Post::v('email') : ""));
 347         $mymail->send();
 348
 349         // on cree un objet logger et on log l'evenement
 350         S::logger($user->id())->log('recovery', $mails);
 351     }
 352
 353     function handler_tmpPWD(&$page, $certif = null)
 354     {
 355         global $globals;
 356         // XXX: recovery requires data from the profile
 357         XDB::execute('DELETE FROM  account_lost_passwords
 358                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 359
 360         $res = XDB::query('SELECT  uid
 361                              FROM  account_lost_passwords WHERE certificat={?}', $certif);
 362         $ligne = $res->fetchOneAssoc();
 363         if (!$ligne) {
 364             $page->changeTpl('platal/index.tpl');
 365             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 366         }
 367
 368         $uid = $ligne["uid"];
 369         if (Post::has('response2')) {
 370             $password = Post::v('response2');
 371             XDB::query('UPDATE  accounts
 372                            SET  password={?}
 373                          WHERE  uid = {?} AND state = \'active\'',
 374                        $password, $uid);
 375             XDB::query('DELETE FROM  account_lost_passwords
 376                               WHERE  certificat={?}', $certif);
 377
 378             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 379             // updates the Google Apps password as well.
 380             if ($globals->mailstorage->googleapps_domain) {
 381                 require_once 'googleapps.inc.php';
 382                 $account = new GoogleAppsAccount(User::getSilent($uid));
 383                 if ($account->active() && $account->sync_password) {
 384                     $account->set_password($password);
 385                 }
 386             }
 387
 388             S::logger($uid)->log("passwd", "");
 389             $page->changeTpl('platal/tmpPWD.success.tpl');
 390         } else {
 391             $page->changeTpl('platal/motdepasse.tpl');
 392             $page->addJsLink('motdepasse.js');
 393         }
 394     }
 395
 396     function handler_skin(&$page)
 397     {
 398         global $globals;
 399
 400         $page->changeTpl('platal/skins.tpl');
 401         $page->setTitle('Skins');
 402
 403         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 404             XDB::execute('UPDATE  accounts
 405                              SET  skin = {?}
 406                            WHERE  uid = {?}',
 407                          Env::i('newskin'), S::i('uid'));
 408             S::kill('skin');
 409             Platal::session()->setSkin();
 410         }
 411
 412         $res = XDB::query('SELECT  id
 413                              FROM  skins
 414                             WHERE  skin_tpl = {?}', S::v('skin'));
 415         $page->assign('skin_id', $res->fetchOneCell());
 416
 417         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 418                   FROM  skins AS s
 419              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 420                  WHERE  skin_tpl != \'\' AND ext != \'\'
 421               GROUP BY  id ORDER BY s.date DESC';
 422         $page->assign('skins', XDB::iterator($sql));
 423     }
 424
 425     function handler_exit(&$page, $level = null)
 426     {
 427         if (S::suid()) {
 428             S::logger()->log('suid_stop', S::user()->login() . " by " . S::suid('hruid'));
 429             Platal::session()->stopSUID();
 430             pl_redirect('admin/user/' . S::user()->login());
 431         }
 432
 433         if ($level == 'forget' || $level == 'forgetall') {
 434             Platal::session()->killAccessCookie();
 435         }
 436
 437         if ($level == 'forgetuid' || $level == 'forgetall') {
 438             Platal::session()->killLoginFormCookies();
 439         }
 440
 441         if (S::logged()) {
 442             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 443             Platal::session()->destroy();
 444         }
 445
 446         if (Get::has('redirect')) {
 447             http_redirect(rawurldecode(Get::v('redirect')));
 448         } else {
 449             $page->changeTpl('platal/exit.tpl');
 450         }
 451     }
 452
 453     function handler_review(&$page, $action = null, $mode = null)
 454     {
 455         // Include X-XRDS-Location response-header for Yadis discovery
 456         global $globals;
 457         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 458
 459         $this->load('review.inc.php');
 460         $dom = 'Review';
 461         if (@$GLOBALS['IS_XNET_SITE']) {
 462             $dom .= 'Xnet';
 463         }
 464         $wp = new PlWikiPage($dom . '.Admin');
 465         $conf = explode('%0a', $wp->getField('text'));
 466         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 467         foreach ($conf as $line) {
 468             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 469             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 470         }
 471         $wiz->apply($page, 'review', $action, $mode);
 472     }
 473 }
 474
 475 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 476 ?>