modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'       => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'  => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'   => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'       => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'   => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect'
  49                           => $this->make_hook('webredir',  AUTH_MDP),
  50             'prefs/skin'  => $this->make_hook('skin',      AUTH_COOKIE),
  51
  52             // password related thingies
  53             'password'      => $this->make_hook('password',  AUTH_MDP),
  54             'tmpPWD'        => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  55             'password/smtp' => $this->make_hook('smtppass',  AUTH_MDP),
  56             'recovery'      => $this->make_hook('recovery',  AUTH_PUBLIC),
  57             'exit'          => $this->make_hook('exit', AUTH_PUBLIC),
  58             'review'        => $this->make_hook('review', AUTH_PUBLIC),
  59             'deconnexion.php' => $this->make_hook('exit', AUTH_PUBLIC),
  60         );
  61     }
  62
  63     function handler_index(&$page)
  64     {
  65         // Include X-XRDS-Location response-header for Yadis discovery
  66         global $globals;
  67         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
  68
  69         // Redirect to the suitable page
  70         if (S::logged()) {
  71             pl_redirect('events');
  72         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  73             $this->handler_review($page);
  74         }
  75     }
  76
  77     function handler_cacert(&$page)
  78     {
  79         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  80         header("Pragma:");
  81         header("Set-Cookie:");
  82         header("Cache-Control:");
  83         header("Expires:");
  84         header("Content-Type: application/x-x509-ca-cert");
  85         header("Content-Length: ".strlen($data));
  86         echo $data;
  87         exit;
  88     }
  89
  90     function handler_changelog(&$page, $core = null)
  91     {
  92         $page->changeTpl('platal/changeLog.tpl');
  93
  94         function formatChangeLog($file) {
  95             $clog = pl_entities(file_get_contents($file));
  96             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  97             // url catch only (not all wiki syntax)
  98             $clog = preg_replace(array(
  99                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
 100                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
 101                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
 102               array(
 103                 '<a href="\\0">\\0</a>',
 104                 '\\1<a href="http://www.\\2">www.\\2</a>',
 105                 '<a href="mailto:\\0">\\0</a>'),
 106               $clog);
 107             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 108             $clog = preg_replace('!vim:.*$!', '', $clog);
 109             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 110         }
 111         if ($core != 'core') {
 112             $page->assign('core', false);
 113             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 114         } else {
 115             $page->assign('core', true);
 116             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 117         }
 118     }
 119
 120     function __set_rss_state($state)
 121     {
 122         if ($state) {
 123             $_SESSION['core_rss_hash'] = rand_url_id(16);
 124             XDB::execute('UPDATE  auth_user_quick
 125                                    SET  core_rss_hash={?} WHERE user_id={?}',
 126                                    S::v('core_rss_hash'), S::v('uid'));
 127         } else {
 128             XDB::execute('UPDATE  auth_user_quick
 129                                    SET  core_rss_hash="" WHERE user_id={?}',
 130                                    S::v('uid'));
 131             S::kill('core_rss_hash');
 132         }
 133     }
 134
 135     function handler_prefs(&$page)
 136     {
 137         $page->changeTpl('platal/preferences.tpl');
 138         $page->setTitle('Mes préférences');
 139
 140         if (Post::has('mail_fmt')) {
 141             $fmt = Post::v('mail_fmt');
 142             if ($fmt != 'texte') $fmt = 'html';
 143             XDB::execute("UPDATE auth_user_quick
 144                                        SET core_mail_fmt = '$fmt'
 145                                      WHERE user_id = {?}",
 146                                      S::v('uid'));
 147             $_SESSION['mail_fmt'] = $fmt;
 148         }
 149
 150         if (Post::has('rss')) {
 151             $this->__set_rss_state(Post::b('rss'));
 152         }
 153
 154         # FIXME: this code is not multi-domain compatible. We should decide how
 155         # carva will extend to users not in the main domain.
 156         $res = XDB::query("SELECT  alias
 157                              FROM  aliases
 158                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 159                           S::user()->id());
 160         $page->assign('bestalias', $res->fetchOneCell());
 161     }
 162
 163     function handler_webredir(&$page)
 164     {
 165         $page->changeTpl('platal/webredirect.tpl');
 166
 167         $page->setTitle('Redirection de page WEB');
 168
 169         $log =& S::v('log');
 170         $url = Env::v('url');
 171
 172         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 173             XDB::execute('UPDATE auth_user_quick
 174                                        SET redirecturl = {?} WHERE user_id = {?}',
 175                                    $url, S::v('uid'));
 176             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 177             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 178         } elseif (Env::v('submit') == "Supprimer") {
 179             XDB::execute("UPDATE auth_user_quick
 180                                        SET redirecturl = ''
 181                                      WHERE user_id = {?}",
 182                                    S::v('uid'));
 183             S::logger()->log("carva_del", $url);
 184             Post::kill('url');
 185             $page->trigSuccess('Redirection supprimée');
 186         }
 187
 188         $res = XDB::query('SELECT redirecturl
 189                                        FROM auth_user_quick
 190                                       WHERE user_id = {?}',
 191                                     S::v('uid'));
 192         $page->assign('carva', $res->fetchOneCell());
 193
 194         # FIXME: this code is not multi-domain compatible. We should decide how
 195         # carva will extend to users not in the main domain.
 196         $res = XDB::query("SELECT  alias
 197                              FROM  aliases
 198                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 199                           S::user()->id());
 200         $page->assign('bestalias', $res->fetchOneCell());
 201     }
 202
 203     function handler_prefs_rss(&$page)
 204     {
 205         $page->changeTpl('platal/filrss.tpl');
 206
 207         $page->assign('goback', Env::v('referer', 'login'));
 208
 209         if (Env::v('act_rss') == 'Activer') {
 210             $this->__set_rss_state(true);
 211             $page->trigSuccess("Ton Fil RSS est activé.");
 212         }
 213     }
 214
 215     function handler_password(&$page)
 216     {
 217         global $globals;
 218
 219         if (Post::has('response2'))  {
 220             S::assert_xsrf_token();
 221
 222             $_SESSION['password'] = $password = Post::v('response2');
 223
 224             XDB::execute('UPDATE  auth_user_md5
 225                              SET  password={?}
 226                            WHERE  user_id={?}', $password,
 227                            S::v('uid'));
 228
 229             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 230             // updates the Google Apps password as well.
 231             if ($globals->mailstorage->googleapps_domain) {
 232                 require_once 'googleapps.inc.php';
 233                 $account = new GoogleAppsAccount(S::user());
 234                 if ($account->active() && $account->sync_password) {
 235                     $account->set_password($password);
 236                 }
 237             }
 238
 239             S::logger()->log('passwd');
 240             Platal::session()->setAccessCookie(true);
 241
 242             $page->changeTpl('platal/motdepasse.success.tpl');
 243             $page->run();
 244         }
 245
 246         $page->changeTpl('platal/motdepasse.tpl');
 247         $page->addJsLink('motdepasse.js');
 248         $page->setTitle('Mon mot de passe');
 249     }
 250
 251     function handler_smtppass(&$page)
 252     {
 253         $page->changeTpl('platal/acces_smtp.tpl');
 254         $page->setTitle('Acces SMTP/NNTP');
 255
 256         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 257         $wp->buildCache();
 258         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 259         $wp->buildCache();
 260
 261         $uid  = S::v('uid');
 262         $pass = Env::v('smtppass1');
 263         $log  = S::v('log');
 264
 265         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 266         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 267         {
 268             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 269                                      WHERE user_id = {?}', $pass, $uid);
 270             $page->trigSuccess('Mot de passe enregistré');
 271             S::logger()->log("passwd_ssl");
 272         } elseif (Env::v('op') == "Supprimer") {
 273             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 274                                      WHERE user_id = {?}', $uid);
 275             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 276             S::logger()->log("passwd_del");
 277         }
 278
 279         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 280                                        FROM auth_user_md5
 281                                       WHERE user_id = {?}", $uid);
 282         $page->assign('actif', $res->fetchOneCell());
 283     }
 284
 285     function handler_recovery(&$page)
 286     {
 287         global $globals;
 288
 289         $page->changeTpl('platal/recovery.tpl');
 290
 291         if (!Env::has('login') || !Env::has('birth')) {
 292             return;
 293         }
 294
 295         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 296             $page->trigError('Date de naissance incorrecte ou incohérente');
 297             return;
 298         }
 299
 300         $birth   = sprintf('%s-%s-%s',
 301                            substr(Env::v('birth'), 4, 4),
 302                            substr(Env::v('birth'), 2, 2),
 303                            substr(Env::v('birth'), 0, 2));
 304
 305         $mailorg = strtok(Env::v('login'), '@');
 306
 307         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 308         // avec celle fournie ici en espérant que c'est la bonne
 309
 310         $res = XDB::query(
 311                 "SELECT  user_id, naissance
 312                    FROM  auth_user_md5 AS u
 313              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 314                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 315         list($uid, $naissance) = $res->fetchOneRow();
 316
 317         if ($naissance == $birth) {
 318             $res = XDB::query("SELECT  COUNT(*)
 319                                  FROM  emails
 320                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 321             $count = intval($res->fetchOneCell());
 322             if ($count == 0) {
 323                 $page->assign('no_addr', true);
 324                 return;
 325             }
 326
 327             $page->assign('ok', true);
 328
 329             $url   = rand_url_id();
 330             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 331                                VALUES  ({?},{?},NOW())', $url, $uid);
 332             $res   = XDB::query('SELECT  email
 333                                    FROM  emails
 334                                   WHERE  uid = {?} AND email = {?}',
 335                                 $uid, Post::v('email'));
 336             if ($res->numRows()) {
 337                 $mails = $res->fetchOneCell();
 338             } else {
 339                 $res   = XDB::query('SELECT  email
 340                                        FROM  emails
 341                                       WHERE  uid = {?} AND NOT FIND_IN_SET("filter", flags)', $uid);
 342                 $mails = implode(', ', $res->fetchColumn());
 343             }
 344             $mymail = new PlMailer();
 345             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 346             $mymail->addTo($mails);
 347             $mymail->setSubject('Ton certificat d\'authentification');
 348             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 349 {$globals->baseurl}/tmpPWD/$url
 350
 351 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 352
 353 --
 354 Polytechnique.org
 355 \"Le portail des élèves & anciens élèves de l'Ecole polytechnique\"
 356
 357 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 358 Adresse de secours : " . Post::v('email') : ""));
 359             $mymail->send();
 360
 361             // on cree un objet logger et on log l'evenement
 362             S::logger(uid)->log('recovery', $mails);
 363         } else {
 364             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 365                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 366         }
 367     }
 368
 369     function handler_tmpPWD(&$page, $certif = null)
 370     {
 371         global $globals;
 372         XDB::execute('DELETE FROM perte_pass
 373                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 374
 375         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 376         $ligne = $res->fetchOneAssoc();
 377         if (!$ligne) {
 378             $page->changeTpl('platal/index.tpl');
 379             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 380         }
 381
 382         $uid = $ligne["uid"];
 383         if (Post::has('response2')) {
 384             $password = Post::v('response2');
 385             XDB::query('UPDATE  auth_user_md5 SET password={?}
 386                                    WHERE  user_id={?} AND perms IN("admin","user")',
 387                                  $password, $uid);
 388             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 389
 390             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 391             // updates the Google Apps password as well.
 392             if ($globals->mailstorage->googleapps_domain) {
 393                 require_once 'googleapps.inc.php';
 394                 $account = new GoogleAppsAccount(User::getSilent($uid));
 395                 if ($account->active() && $account->sync_password) {
 396                     $account->set_password($password);
 397                 }
 398             }
 399
 400             S::logger($uid)->log("passwd", "");
 401             $page->changeTpl('platal/tmpPWD.success.tpl');
 402         } else {
 403             $page->changeTpl('platal/motdepasse.tpl');
 404             $page->addJsLink('motdepasse.js');
 405         }
 406     }
 407
 408     function handler_skin(&$page)
 409     {
 410         global $globals;
 411
 412         $page->changeTpl('platal/skins.tpl');
 413         $page->setTitle('Skins');
 414
 415         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 416             XDB::execute('UPDATE auth_user_quick
 417                              SET skin={?} WHERE user_id={?}',
 418                          Env::i('newskin'), S::v('uid'));
 419             S::kill('skin');
 420             Platal::session()->setSkin();
 421         }
 422
 423         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 424         $page->assign('skin_id', $res->fetchOneCell());
 425
 426         $sql = "SELECT s.*,auteur,count(*) AS nb
 427                   FROM skins AS s
 428              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 429                  WHERE skin_tpl != '' AND ext != ''
 430               GROUP BY id ORDER BY s.date DESC";
 431         $page->assign('skins', XDB::iterator($sql));
 432     }
 433
 434     function handler_exit(&$page, $level = null)
 435     {
 436         if (S::suid()) {
 437             S::logger()->log('suid_stop', S::user()->login() . " by " . S::suid('hruid'));
 438             Platal::session()->stopSUID();
 439             pl_redirect('admin/user/' . S::user()->login());
 440         }
 441
 442         if ($level == 'forget' || $level == 'forgetall') {
 443             Platal::session()->killAccessCookie();
 444         }
 445
 446         if ($level == 'forgetuid' || $level == 'forgetall') {
 447             Platal::session()->killLoginFormCookies();
 448         }
 449
 450         S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 451         Platal::session()->destroy();
 452
 453         if (Get::has('redirect')) {
 454             http_redirect(rawurldecode(Get::v('redirect')));
 455         } else {
 456             $page->changeTpl('platal/exit.tpl');
 457         }
 458     }
 459
 460     function handler_review(&$page, $action = null, $mode = null)
 461     {
 462         // Include X-XRDS-Location response-header for Yadis discovery
 463         global $globals;
 464         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
 465
 466         $this->load('review.inc.php');
 467         $dom = 'Review';
 468         if (@$GLOBALS['IS_XNET_SITE']) {
 469             $dom .= 'Xnet';
 470         }
 471         $wp = new PlWikiPage($dom . '.Admin');
 472         $conf = explode('%0a', $wp->getField('text'));
 473         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 474         foreach ($conf as $line) {
 475             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 476             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 477         }
 478         $wiz->apply($page, 'review', $action, $mode);
 479     }
 480 }
 481
 482 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 483 ?>