2 /***************************************************************************
3 * Copyright (C) 2003-2008 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
22 function bugize($list)
24 $list = split(',', $list);
27 foreach ($list as $bug) {
28 $clean = str_replace('#', '', $bug);
29 $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
32 return join(',', $ans);
36 class PlatalModule
extends PLModule
41 'index' => $this->make_hook('index', AUTH_PUBLIC
),
42 'cacert.pem' => $this->make_hook('cacert', AUTH_PUBLIC
),
43 'changelog' => $this->make_hook('changelog', AUTH_PUBLIC
),
45 // Preferences thingies
46 'prefs' => $this->make_hook('prefs', AUTH_COOKIE
),
47 'prefs/rss' => $this->make_hook('prefs_rss', AUTH_COOKIE
),
49 => $this->make_hook('webredir', AUTH_MDP
),
50 'prefs/skin' => $this->make_hook('skin', AUTH_COOKIE
),
52 // password related thingies
53 'password' => $this->make_hook('password', AUTH_MDP
),
54 'tmpPWD' => $this->make_hook('tmpPWD', AUTH_PUBLIC
),
55 'password/smtp' => $this->make_hook('smtppass', AUTH_MDP
),
56 'recovery' => $this->make_hook('recovery', AUTH_PUBLIC
),
57 'exit' => $this->make_hook('exit', AUTH_PUBLIC
),
58 'review' => $this->make_hook('review', AUTH_PUBLIC
),
59 'deconnexion.php' => $this->make_hook('exit', AUTH_PUBLIC
),
63 function handler_index(&$page)
66 pl_redirect('events');
67 } else if (!@$GLOBALS['IS_XNET_SITE']) {
68 pl_redirect('review');
72 function handler_cacert(&$page)
74 $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
76 header("Set-Cookie:");
77 header("Cache-Control:");
79 header("Content-Type: application/x-x509-ca-cert");
80 header("Content-Length: ".strlen($data));
85 function handler_changelog(&$page)
87 $page->changeTpl('platal/changeLog.tpl');
89 $clog = pl_entities(file_get_contents(dirname(__FILE__
).'/../ChangeLog'));
90 $clog = preg_replace('/=+\s*/', '</pre><hr /><pre>', $clog);
91 // url catch only (not all wiki syntax)
92 $clog = preg_replace(array(
93 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
94 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
95 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
97 '<a href="\\0">\\0</a>',
98 '\\1<a href="http://www.\\2">www.\\2</a>',
99 '<a href="mailto:\\0">\\0</a>'),
101 $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
102 $clog = preg_replace('!vim:.*$!', '', $clog);
103 $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
104 $page->assign('ChangeLog', $clog);
107 function __set_rss_state($state)
110 $_SESSION['core_rss_hash'] = rand_url_id(16);
111 XDB
::execute('UPDATE auth_user_quick
112 SET core_rss_hash={?} WHERE user_id={?}',
113 S
::v('core_rss_hash'), S
::v('uid'));
115 XDB
::execute('UPDATE auth_user_quick
116 SET core_rss_hash="" WHERE user_id={?}',
118 S
::kill('core_rss_hash');
122 function handler_prefs(&$page)
124 $page->changeTpl('platal/preferences.tpl');
125 $page->assign('xorg_title','Polytechnique.org - Mes préférences');
127 if (Post
::has('mail_fmt')) {
128 $fmt = Post
::v('mail_fmt');
129 if ($fmt != 'texte') $fmt = 'html';
130 XDB
::execute("UPDATE auth_user_quick
131 SET core_mail_fmt = '$fmt'
132 WHERE user_id = {?}",
134 $_SESSION['mail_fmt'] = $fmt;
137 if (Post
::has('rss')) {
138 $this->__set_rss_state(Post
::b('rss'));
142 function handler_webredir(&$page)
144 $page->changeTpl('platal/webredirect.tpl');
146 $page->assign('xorg_title','Polytechnique.org - Redirection de page WEB');
149 $url = Env
::v('url');
151 if (Env
::v('submit') == 'Valider' and Env
::has('url')) {
152 XDB
::execute('UPDATE auth_user_quick
153 SET redirecturl = {?} WHERE user_id = {?}',
155 $log->log('carva_add', 'http://'.Env
::v('url'));
156 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
157 } elseif (Env
::v('submit') == "Supprimer") {
158 XDB
::execute("UPDATE auth_user_quick
160 WHERE user_id = {?}",
162 $log->log("carva_del", $url);
164 $page->trigSuccess('Redirection supprimée');
167 $res = XDB
::query('SELECT redirecturl
169 WHERE user_id = {?}',
171 $page->assign('carva', $res->fetchOneCell());
174 function handler_prefs_rss(&$page)
176 $page->changeTpl('platal/filrss.tpl');
178 $page->assign('goback', Env
::v('referer', 'login'));
180 if (Env
::v('act_rss') == 'Activer') {
181 $this->__set_rss_state(true
);
182 $page->trigSuccess("Ton Fil RSS est activé.");
186 function handler_password(&$page)
190 if (Post
::has('response2')) {
191 require_once 'secure_hash.inc.php';
192 S
::assert_xsrf_token();
194 $_SESSION['password'] = $password = Post
::v('response2');
196 XDB
::execute('UPDATE auth_user_md5
198 WHERE user_id={?}', $password,
201 // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
202 // updates the Google Apps password as well.
203 if ($globals->mailstorage
->googleapps_domain
) {
204 require_once 'googleapps.inc.php';
205 $account = new GoogleAppsAccount(S
::v('uid'), S
::v('forlife'));
206 if ($account->active() && $account->sync_password
) {
207 $account->set_password($password);
212 $log->log('passwd', '');
214 if (Cookie
::v('ORGaccess')) {
215 setcookie('ORGaccess', hash_encrypt($password), (time()+
25920000), '/', '' ,0);
218 $page->changeTpl('platal/motdepasse.success.tpl');
222 $page->changeTpl('platal/motdepasse.tpl');
223 $page->addJsLink('motdepasse.js');
224 $page->assign('xorg_title','Polytechnique.org - Mon mot de passe');
227 function handler_smtppass(&$page)
229 $page->changeTpl('platal/acces_smtp.tpl');
230 $page->assign('xorg_title','Polytechnique.org - Acces SMTP/NNTP');
232 require_once 'wiki.inc.php';
233 wiki_require_page('Xorg.SMTPSécurisé');
234 wiki_require_page('Xorg.NNTPSécurisé');
237 $pass = Env
::v('smtppass1');
240 if (Env
::v('op') == "Valider" && strlen($pass) >= 6
241 && Env
::v('smtppass1') == Env
::v('smtppass2'))
243 XDB
::execute('UPDATE auth_user_md5 SET smtppass = {?}
244 WHERE user_id = {?}', $pass, $uid);
245 $page->trigSuccess('Mot de passe enregistré');
246 $log->log("passwd_ssl");
247 } elseif (Env
::v('op') == "Supprimer") {
248 XDB
::execute('UPDATE auth_user_md5 SET smtppass = ""
249 WHERE user_id = {?}', $uid);
250 $page->trigSuccess('Compte SMTP et NNTP supprimé');
251 $log->log("passwd_del");
254 $res = XDB
::query("SELECT IF(smtppass != '', 'actif', '')
256 WHERE user_id = {?}", $uid);
257 $page->assign('actif', $res->fetchOneCell());
260 function handler_recovery(&$page)
264 $page->changeTpl('platal/recovery.tpl');
266 if (!Env
::has('login') ||
!Env
::has('birth')) {
270 if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env
::v('birth'))) {
271 $page->trigError('Date de naissance incorrecte ou incohérente');
275 $birth = sprintf('%s-%s-%s',
276 substr(Env
::v('birth'), 4, 4),
277 substr(Env
::v('birth'), 2, 2),
278 substr(Env
::v('birth'), 0, 2));
280 $mailorg = strtok(Env
::v('login'), '@');
282 // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
283 // avec celle fournie ici en espérant que c'est la bonne
286 "SELECT user_id, naissance
287 FROM auth_user_md5 AS u
288 INNER JOIN aliases AS a ON (u.user_id=a.id AND type != 'homonyme')
289 WHERE a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
290 list($uid, $naissance) = $res->fetchOneRow();
292 if ($naissance == $birth) {
293 $res = XDB
::query("SELECT COUNT(*)
295 WHERE uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
296 $count = intval($res->fetchOneCell());
298 $page->assign('no_addr', true
);
302 $page->assign('ok', true
);
304 $url = rand_url_id();
305 XDB
::execute('INSERT INTO perte_pass (certificat,uid,created)
306 VALUES ({?},{?},NOW())', $url, $uid);
307 $res = XDB
::query('SELECT email
309 WHERE uid = {?} AND email = {?}',
310 $uid, Post
::v('email'));
311 if ($res->numRows()) {
312 $mails = $res->fetchOneCell();
314 $res = XDB
::query('SELECT email
316 WHERE uid = {?} AND NOT FIND_IN_SET("filter", flags)', $uid);
317 $mails = implode(', ', $res->fetchColumn());
319 $mymail = new PlMailer();
320 $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail
->domain
. '>');
321 $mymail->addTo($mails);
322 $mymail->setSubject('Ton certificat d\'authentification');
323 $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
324 {$globals->baseurl}/tmpPWD/$url
326 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
330 \"Le portail des élèves & anciens élèves de l'Ecole polytechnique\"
332 Mail envoyé à ".Env
::v('login') . (Post
::has('email') ?
"
333 Adresse de secours : " . Post
::v('email') : ""));
336 // on cree un objet logger et on log l'evenement
337 $logger = $_SESSION['log'] = new CoreLogger($uid);
338 $logger->log('recovery', $mails);
340 $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
341 'Si tu as un homonyme, utilise prenom.nom.promo comme login');
345 function handler_tmpPWD(&$page, $certif = null
)
348 XDB
::execute('DELETE FROM perte_pass
349 WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
351 $res = XDB
::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
352 $ligne = $res->fetchOneAssoc();
354 $page->changeTpl('platal/index.tpl');
355 $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
358 $uid = $ligne["uid"];
359 if (Post
::has('response2')) {
360 $password = Post
::v('response2');
361 XDB
::query('UPDATE auth_user_md5 SET password={?}
362 WHERE user_id={?} AND perms IN("admin","user")',
364 XDB
::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
366 // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
367 // updates the Google Apps password as well.
368 if ($globals->mailstorage
->googleapps_domain
) {
369 require_once 'googleapps.inc.php';
370 $account = new GoogleAppsAccount($uid);
371 if ($account->active() && $account->sync_password
) {
372 $account->set_password($password);
376 $logger = new CoreLogger($uid);
377 $logger->log("passwd","");
378 $page->changeTpl('platal/tmpPWD.success.tpl');
380 $page->changeTpl('platal/motdepasse.tpl');
381 $page->addJsLink('motdepasse.js');
385 function handler_skin(&$page)
389 $page->changeTpl('platal/skins.tpl');
390 $page->assign('xorg_title','Polytechnique.org - Skins');
392 if (Env
::has('newskin')) { // formulaire soumis, traitons les données envoyées
393 XDB
::execute('UPDATE auth_user_quick
394 SET skin={?} WHERE user_id={?}',
395 Env
::i('newskin'), S
::v('uid'));
400 $res = XDB
::query('SELECT id FROM skins WHERE skin_tpl={?}', S
::v('skin'));
401 $page->assign('skin_id', $res->fetchOneCell());
403 $sql = "SELECT s.*,auteur,count(*) AS nb
405 LEFT JOIN auth_user_quick AS a ON s.id=a.skin
406 WHERE skin_tpl != '' AND ext != ''
407 GROUP BY id ORDER BY s.date DESC";
408 $page->assign('skins', XDB
::iterator($sql));
411 function handler_exit(&$page, $level = null
)
413 if (S
::has('suid')) {
414 $a4l = S
::v('forlife');
415 $suid = S
::v('suid');
417 $log->log("suid_stop", S
::v('forlife') . " by " . $suid['forlife']);
420 pl_redirect('admin/user/' . $a4l);
423 if ($level == 'forget' ||
$level == 'forgetall') {
424 setcookie('ORGaccess', '', time() - 3600, '/', '', 0);
425 Cookie
::kill('ORGaccess');
426 if (isset($_SESSION['log']))
427 $_SESSION['log']->log("cookie_off");
430 if ($level == 'forgetuid' ||
$level == 'forgetall') {
431 setcookie('ORGuid', '', time() - 3600, '/', '', 0);
432 Cookie
::kill('ORGuid');
433 setcookie('ORGdomain', '', time() - 3600, '/', '', 0);
434 Cookie
::kill('ORGdomain');
437 if (isset($_SESSION['log'])) {
438 $ref = isset($_SERVER['HTTP_REFERER']) ?
$_SERVER['HTTP_REFERER'] : '';
439 $_SESSION['log']->log('deconnexion',$ref);
442 XorgSession
::destroy();
444 if (Get
::has('redirect')) {
445 http_redirect(rawurldecode(Get
::v('redirect')));
447 $page->changeTpl('platal/exit.tpl');
451 function handler_review(&$page, $action = null
, $mode = null
)
453 require_once 'wiki.inc.php';
454 require_once dirname(__FILE__
) . '/platal/review.inc.php';
455 $dir = wiki_work_dir();
457 if (@$GLOBALS['IS_XNET_SITE']) {
461 $page->kill("Impossible de trouver le wiki");
463 if (!file_exists($dir . '/' . $dom . '.Admin')) {
464 $page->kill("Impossible de trouver la page d'administration");
466 $conf = preg_grep('/^text=/', explode("\n", file_get_contents($dir . '/' . $dom . '.Admin')));
467 $conf = preg_split('/(text\=|\%0a)/', array_shift($conf), -1, PREG_SPLIT_NO_EMPTY
);
468 $wiz = new PlWizard('Tour d\'horizon', 'core/plwizard.tpl', true
);
469 foreach ($conf as $line) {
470 $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY
);
471 $wiz->addPage('ReviewPage', $list[0], $list[1]);
473 $wiz->apply($page, 'review', $action, $mode);
477 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: