modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'       => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'  => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'   => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'       => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'   => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect'
  49                           => $this->make_hook('webredir',  AUTH_MDP),
  50             'prefs/skin'  => $this->make_hook('skin',      AUTH_COOKIE),
  51
  52             // password related thingies
  53             'password'      => $this->make_hook('password',  AUTH_MDP),
  54             'tmpPWD'        => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  55             'password/smtp' => $this->make_hook('smtppass',  AUTH_MDP),
  56             'recovery'      => $this->make_hook('recovery',  AUTH_PUBLIC),
  57             'exit'          => $this->make_hook('exit', AUTH_PUBLIC),
  58             'review'        => $this->make_hook('review', AUTH_PUBLIC),
  59             'deconnexion.php' => $this->make_hook('exit', AUTH_PUBLIC),
  60         );
  61     }
  62
  63     function handler_index(&$page)
  64     {
  65         if (S::logged()) {
  66             pl_redirect('events');
  67         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  68             pl_redirect('review');
  69         }
  70     }
  71
  72     function handler_cacert(&$page)
  73     {
  74         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  75         header("Pragma:");
  76         header("Set-Cookie:");
  77         header("Cache-Control:");
  78         header("Expires:");
  79         header("Content-Type: application/x-x509-ca-cert");
  80         header("Content-Length: ".strlen($data));
  81         echo $data;
  82         exit;
  83     }
  84
  85     function handler_changelog(&$page)
  86     {
  87         $page->changeTpl('platal/changeLog.tpl');
  88
  89         $clog = pl_entities(file_get_contents(dirname(__FILE__).'/../ChangeLog'));
  90         $clog = preg_replace('/=+\s*/', '</pre><hr /><pre>', $clog);
  91         // url catch only (not all wiki syntax)
  92         $clog = preg_replace(array(
  93             '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  94             '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  95             '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  96           array(
  97             '<a href="\\0">\\0</a>',
  98             '\\1<a href="http://www.\\2">www.\\2</a>',
  99             '<a href="mailto:\\0">\\0</a>'),
 100           $clog);
 101         $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 102         $clog = preg_replace('!vim:.*$!', '', $clog);
 103         $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 104         $page->assign('ChangeLog', $clog);
 105     }
 106
 107     function __set_rss_state($state)
 108     {
 109         if ($state) {
 110             $_SESSION['core_rss_hash'] = rand_url_id(16);
 111             XDB::execute('UPDATE  auth_user_quick
 112                                    SET  core_rss_hash={?} WHERE user_id={?}',
 113                                    S::v('core_rss_hash'), S::v('uid'));
 114         } else {
 115             XDB::execute('UPDATE  auth_user_quick
 116                                    SET  core_rss_hash="" WHERE user_id={?}',
 117                                    S::v('uid'));
 118             S::kill('core_rss_hash');
 119         }
 120     }
 121
 122     function handler_prefs(&$page)
 123     {
 124         $page->changeTpl('platal/preferences.tpl');
 125         $page->setTitle('Mes préférences');
 126
 127         if (Post::has('mail_fmt')) {
 128             $fmt = Post::v('mail_fmt');
 129             if ($fmt != 'texte') $fmt = 'html';
 130             XDB::execute("UPDATE auth_user_quick
 131                                        SET core_mail_fmt = '$fmt'
 132                                      WHERE user_id = {?}",
 133                                      S::v('uid'));
 134             $_SESSION['mail_fmt'] = $fmt;
 135         }
 136
 137         if (Post::has('rss')) {
 138             $this->__set_rss_state(Post::b('rss'));
 139         }
 140
 141         # FIXME: this code is not multi-domain compatible. We should decide how
 142         # carva will extend to users not in the main domain.
 143         $res = XDB::query("SELECT  alias
 144                              FROM  aliases
 145                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 146                           S::user()->id());
 147         $page->assign('bestalias', $res->fetchOneCell());
 148     }
 149
 150     function handler_webredir(&$page)
 151     {
 152         $page->changeTpl('platal/webredirect.tpl');
 153
 154         $page->setTitle('Redirection de page WEB');
 155
 156         $log =& S::v('log');
 157         $url = Env::v('url');
 158
 159         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 160             XDB::execute('UPDATE auth_user_quick
 161                                        SET redirecturl = {?} WHERE user_id = {?}',
 162                                    $url, S::v('uid'));
 163             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 164             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 165         } elseif (Env::v('submit') == "Supprimer") {
 166             XDB::execute("UPDATE auth_user_quick
 167                                        SET redirecturl = ''
 168                                      WHERE user_id = {?}",
 169                                    S::v('uid'));
 170             S::logger()->log("carva_del", $url);
 171             Post::kill('url');
 172             $page->trigSuccess('Redirection supprimée');
 173         }
 174
 175         $res = XDB::query('SELECT redirecturl
 176                                        FROM auth_user_quick
 177                                       WHERE user_id = {?}',
 178                                     S::v('uid'));
 179         $page->assign('carva', $res->fetchOneCell());
 180
 181         # FIXME: this code is not multi-domain compatible. We should decide how
 182         # carva will extend to users not in the main domain.
 183         $res = XDB::query("SELECT  alias
 184                              FROM  aliases
 185                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 186                           S::user()->id());
 187         $page->assign('bestalias', $res->fetchOneCell());
 188     }
 189
 190     function handler_prefs_rss(&$page)
 191     {
 192         $page->changeTpl('platal/filrss.tpl');
 193
 194         $page->assign('goback', Env::v('referer', 'login'));
 195
 196         if (Env::v('act_rss') == 'Activer') {
 197             $this->__set_rss_state(true);
 198             $page->trigSuccess("Ton Fil RSS est activé.");
 199         }
 200     }
 201
 202     function handler_password(&$page)
 203     {
 204         global $globals;
 205
 206         if (Post::has('response2'))  {
 207             require_once 'secure_hash.inc.php';
 208             S::assert_xsrf_token();
 209
 210             $_SESSION['password'] = $password = Post::v('response2');
 211
 212             XDB::execute('UPDATE  auth_user_md5
 213                              SET  password={?}
 214                            WHERE  user_id={?}', $password,
 215                            S::v('uid'));
 216
 217             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 218             // updates the Google Apps password as well.
 219             if ($globals->mailstorage->googleapps_domain) {
 220                 require_once 'googleapps.inc.php';
 221                 $account = new GoogleAppsAccount(S::user());
 222                 if ($account->active() && $account->sync_password) {
 223                     $account->set_password($password);
 224                 }
 225             }
 226
 227             $log =& S::v('log');
 228             S::logger()->log('passwd', '');
 229
 230             if (Cookie::v('ORGaccess')) {
 231                 setcookie('ORGaccess', hash_encrypt($password), (time()+25920000), '/', '' ,0);
 232             }
 233
 234             $page->changeTpl('platal/motdepasse.success.tpl');
 235             $page->run();
 236         }
 237
 238         $page->changeTpl('platal/motdepasse.tpl');
 239         $page->addJsLink('motdepasse.js');
 240         $page->setTitle('Mon mot de passe');
 241     }
 242
 243     function handler_smtppass(&$page)
 244     {
 245         $page->changeTpl('platal/acces_smtp.tpl');
 246         $page->setTitle('Acces SMTP/NNTP');
 247
 248         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 249         $wp->buildCache();
 250         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 251         $wp->buildCache();
 252
 253         $uid  = S::v('uid');
 254         $pass = Env::v('smtppass1');
 255         $log  = S::v('log');
 256
 257         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 258         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 259         {
 260             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 261                                      WHERE user_id = {?}', $pass, $uid);
 262             $page->trigSuccess('Mot de passe enregistré');
 263             S::logger()->log("passwd_ssl");
 264         } elseif (Env::v('op') == "Supprimer") {
 265             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 266                                      WHERE user_id = {?}', $uid);
 267             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 268             S::logger()->log("passwd_del");
 269         }
 270
 271         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 272                                        FROM auth_user_md5
 273                                       WHERE user_id = {?}", $uid);
 274         $page->assign('actif', $res->fetchOneCell());
 275     }
 276
 277     function handler_recovery(&$page)
 278     {
 279         global $globals;
 280
 281         $page->changeTpl('platal/recovery.tpl');
 282
 283         if (!Env::has('login') || !Env::has('birth')) {
 284             return;
 285         }
 286
 287         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 288             $page->trigError('Date de naissance incorrecte ou incohérente');
 289             return;
 290         }
 291
 292         $birth   = sprintf('%s-%s-%s',
 293                            substr(Env::v('birth'), 4, 4),
 294                            substr(Env::v('birth'), 2, 2),
 295                            substr(Env::v('birth'), 0, 2));
 296
 297         $mailorg = strtok(Env::v('login'), '@');
 298
 299         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 300         // avec celle fournie ici en espérant que c'est la bonne
 301
 302         $res = XDB::query(
 303                 "SELECT  user_id, naissance
 304                    FROM  auth_user_md5 AS u
 305              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 306                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 307         list($uid, $naissance) = $res->fetchOneRow();
 308
 309         if ($naissance == $birth) {
 310             $res = XDB::query("SELECT  COUNT(*)
 311                                  FROM  emails
 312                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 313             $count = intval($res->fetchOneCell());
 314             if ($count == 0) {
 315                 $page->assign('no_addr', true);
 316                 return;
 317             }
 318
 319             $page->assign('ok', true);
 320
 321             $url   = rand_url_id();
 322             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 323                                VALUES  ({?},{?},NOW())', $url, $uid);
 324             $res   = XDB::query('SELECT  email
 325                                    FROM  emails
 326                                   WHERE  uid = {?} AND email = {?}',
 327                                 $uid, Post::v('email'));
 328             if ($res->numRows()) {
 329                 $mails = $res->fetchOneCell();
 330             } else {
 331                 $res   = XDB::query('SELECT  email
 332                                        FROM  emails
 333                                       WHERE  uid = {?} AND NOT FIND_IN_SET("filter", flags)', $uid);
 334                 $mails = implode(', ', $res->fetchColumn());
 335             }
 336             $mymail = new PlMailer();
 337             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 338             $mymail->addTo($mails);
 339             $mymail->setSubject('Ton certificat d\'authentification');
 340             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 341 {$globals->baseurl}/tmpPWD/$url
 342
 343 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 344
 345 --
 346 Polytechnique.org
 347 \"Le portail des élèves & anciens élèves de l'Ecole polytechnique\"
 348
 349 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 350 Adresse de secours : " . Post::v('email') : ""));
 351             $mymail->send();
 352
 353             // on cree un objet logger et on log l'evenement
 354             $logger = $_SESSION['log'] = new PlLogger($uid);
 355             S::logger()->log('recovery', $mails);
 356         } else {
 357             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 358                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 359         }
 360     }
 361
 362     function handler_tmpPWD(&$page, $certif = null)
 363     {
 364         global $globals;
 365         XDB::execute('DELETE FROM perte_pass
 366                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 367
 368         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 369         $ligne = $res->fetchOneAssoc();
 370         if (!$ligne) {
 371             $page->changeTpl('platal/index.tpl');
 372             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 373         }
 374
 375         $uid = $ligne["uid"];
 376         if (Post::has('response2')) {
 377             $password = Post::v('response2');
 378             XDB::query('UPDATE  auth_user_md5 SET password={?}
 379                                    WHERE  user_id={?} AND perms IN("admin","user")',
 380                                  $password, $uid);
 381             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 382
 383             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 384             // updates the Google Apps password as well.
 385             if ($globals->mailstorage->googleapps_domain) {
 386                 require_once 'googleapps.inc.php';
 387                 $account = new GoogleAppsAccount(User::getSilent($uid));
 388                 if ($account->active() && $account->sync_password) {
 389                     $account->set_password($password);
 390                 }
 391             }
 392
 393             $logger = new PlLogger($uid);
 394             S::logger()->log("passwd","");
 395             $page->changeTpl('platal/tmpPWD.success.tpl');
 396         } else {
 397             $page->changeTpl('platal/motdepasse.tpl');
 398             $page->addJsLink('motdepasse.js');
 399         }
 400     }
 401
 402     function handler_skin(&$page)
 403     {
 404         global $globals;
 405
 406         $page->changeTpl('platal/skins.tpl');
 407         $page->setTitle('Skins');
 408
 409         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 410             XDB::execute('UPDATE auth_user_quick
 411                              SET skin={?} WHERE user_id={?}',
 412                          Env::i('newskin'), S::v('uid'));
 413             S::kill('skin');
 414             Platal::session()->setSkin();
 415         }
 416
 417         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 418         $page->assign('skin_id', $res->fetchOneCell());
 419
 420         $sql = "SELECT s.*,auteur,count(*) AS nb
 421                   FROM skins AS s
 422              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 423                  WHERE skin_tpl != '' AND ext != ''
 424               GROUP BY id ORDER BY s.date DESC";
 425         $page->assign('skins', XDB::iterator($sql));
 426     }
 427
 428     function handler_exit(&$page, $level = null)
 429     {
 430         if (S::has('suid')) {
 431             $suid = S::v('suid');
 432             $log  = S::v('log');
 433             S::logger()->log("suid_stop", S::user()->login() . " by " . $suid['hruid']);
 434             Platal::session()->stopSUID();
 435             pl_redirect('admin/user/' . S::user()->login());
 436         }
 437
 438         if ($level == 'forget' || $level == 'forgetall') {
 439             setcookie('ORGaccess', '', time() - 3600, '/', '', 0);
 440             Cookie::kill('ORGaccess');
 441             if (isset($_SESSION['log']))
 442                 S::logger()->log("cookie_off");
 443         }
 444
 445         if ($level == 'forgetuid' || $level == 'forgetall') {
 446             setcookie('ORGuid', '', time() - 3600, '/', '', 0);
 447             Cookie::kill('ORGuid');
 448             setcookie('ORGdomain', '', time() - 3600, '/', '', 0);
 449             Cookie::kill('ORGdomain');
 450         }
 451
 452         if (isset($_SESSION['log'])) {
 453             $ref = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
 454             S::logger()->log('deconnexion',$ref);
 455         }
 456         Platal::session()->destroy();
 457
 458         if (Get::has('redirect')) {
 459             http_redirect(rawurldecode(Get::v('redirect')));
 460         } else {
 461             $page->changeTpl('platal/exit.tpl');
 462         }
 463     }
 464
 465     function handler_review(&$page, $action = null, $mode = null)
 466     {
 467         $this->load('review.inc.php');
 468         $dom = 'Review';
 469         if (@$GLOBALS['IS_XNET_SITE']) {
 470             $dom .= 'Xnet';
 471         }
 472         $wp = new PlWikiPage($dom . '.Admin');
 473         $conf = explode('%0a', $wp->getField('text'));
 474         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 475         foreach ($conf as $line) {
 476             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 477             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 478         }
 479         $wiz->apply($page, 'review', $action, $mode);
 480     }
 481 }
 482
 483 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 484 ?>