modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2009 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  57             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  58             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  59         );
  60     }
  61
  62     function handler_index(&$page)
  63     {
  64         // Include X-XRDS-Location response-header for Yadis discovery
  65         global $globals;
  66         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  67
  68         // Redirect to the suitable page
  69         if (S::logged()) {
  70             pl_redirect('events');
  71         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  72             $this->handler_review($page);
  73         }
  74     }
  75
  76     function handler_cacert(&$page)
  77     {
  78         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  79         header("Pragma:");
  80         header("Set-Cookie:");
  81         header("Cache-Control:");
  82         header("Expires:");
  83         header("Content-Type: application/x-x509-ca-cert");
  84         header("Content-Length: ".strlen($data));
  85         echo $data;
  86         exit;
  87     }
  88
  89     function handler_changelog(&$page, $core = null)
  90     {
  91         $page->changeTpl('platal/changeLog.tpl');
  92
  93         function formatChangeLog($file) {
  94             $clog = pl_entities(file_get_contents($file));
  95             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  96             // url catch only (not all wiki syntax)
  97             $clog = preg_replace(array(
  98                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  99                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
 100                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
 101               array(
 102                 '<a href="\\0">\\0</a>',
 103                 '\\1<a href="http://www.\\2">www.\\2</a>',
 104                 '<a href="mailto:\\0">\\0</a>'),
 105               $clog);
 106             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 107             $clog = preg_replace('!vim:.*$!', '', $clog);
 108             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 109         }
 110         if ($core != 'core') {
 111             $page->assign('core', false);
 112             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 113         } else {
 114             $page->assign('core', true);
 115             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 116         }
 117     }
 118
 119     function __set_rss_state($state)
 120     {
 121         if ($state) {
 122             S::set('token', rand_url_id(16));
 123             XDB::execute('UPDATE  accounts
 124                              SET  token = {?}
 125                            WHERE  uid = {?}', S::s('token'), S::i('uid'));
 126         } else {
 127             S::kill('token');
 128             XDB::execute('UPDATE  accounts
 129                              SET  token = NULL
 130                            WHERE  uid = {?}', S::i('uid'));
 131         }
 132     }
 133
 134     function handler_prefs(&$page)
 135     {
 136         $page->changeTpl('platal/preferences.tpl');
 137         $page->setTitle('Mes préférences');
 138
 139         if (Post::has('email_format')) {
 140             $fmt = Post::s('email_format');
 141             XDB::execute("UPDATE accounts
 142                              SET email_format = {?}
 143                            WHERE uid = {?}",
 144                          $fmt, S::v('uid'));
 145             S::set('email_format', $fmt);
 146         }
 147
 148         if (Post::has('rss')) {
 149             $this->__set_rss_state(Post::b('rss'));
 150         }
 151
 152         # FIXME: this code is not multi-domain compatible. We should decide how
 153         # carva will extend to users not in the main domain.
 154         $res = XDB::query("SELECT  alias
 155                              FROM  aliases
 156                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 157                           S::user()->id());
 158         $page->assign('bestalias', $res->fetchOneCell());
 159     }
 160
 161     function handler_webredir(&$page)
 162     {
 163         $page->changeTpl('platal/webredirect.tpl');
 164         $page->setTitle('Redirection de page WEB');
 165
 166         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 167             if (Env::blank('url')) {
 168                 $page->trigError('URL invalide');
 169             } else {
 170                 $url = Env::t('url');
 171                 XDB::execute('REPLACE INTO  carvas (uid, url)
 172                                     VALUES  ({?}, {?})',
 173                              S::i('uid'), $url);
 174                 S::logger()->log('carva_add', 'http://' . $url);
 175                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 176             }
 177         } elseif (Env::v('submit') == 'Supprimer') {
 178             XDB::execute('DELETE FROM carvas
 179                                 WHERE uid = {?}', S::i('uid'));
 180             Post::kill('url');
 181             S::logger()->log('carva_del');
 182             $page->trigSuccess('Redirection supprimée');
 183         }
 184
 185         $url = XDB::fetchOneCell('SELECT  url
 186                                     FROM  carvas
 187                                    WHERE  uid = {?}', S::i('uid'));
 188         $page->assign('carva', $url);
 189
 190         # FIXME: this code is not multi-domain compatible. We should decide how
 191         # carva will extend to users not in the main domain.
 192         $res = XDB::query("SELECT  alias
 193                              FROM  aliases
 194                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 195                           S::user()->id());
 196         $page->assign('bestalias', $res->fetchOneCell());
 197     }
 198
 199     function handler_prefs_rss(&$page)
 200     {
 201         $page->changeTpl('platal/filrss.tpl');
 202
 203         $page->assign('goback', Env::v('referer', 'login'));
 204
 205         if (Env::v('act_rss') == 'Activer') {
 206             $this->__set_rss_state(true);
 207             $page->trigSuccess("Ton Fil RSS est activé.");
 208         }
 209     }
 210
 211     function handler_password(&$page)
 212     {
 213         global $globals;
 214
 215         if (Post::has('response2'))  {
 216             S::assert_xsrf_token();
 217
 218             S::set('password', $password = Post::v('response2'));
 219             XDB::execute('UPDATE  accounts
 220                              SET  password = {?}
 221                            WHERE  uid={?}', $password,
 222                          S::i('uid'));
 223
 224             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 225             // updates the Google Apps password as well.
 226             if ($globals->mailstorage->googleapps_domain) {
 227                 require_once 'googleapps.inc.php';
 228                 $account = new GoogleAppsAccount(S::user());
 229                 if ($account->active() && $account->sync_password) {
 230                     $account->set_password($password);
 231                 }
 232             }
 233
 234             S::logger()->log('passwd');
 235             Platal::session()->setAccessCookie(true);
 236
 237             $page->changeTpl('platal/motdepasse.success.tpl');
 238             $page->run();
 239         }
 240
 241         $page->changeTpl('platal/motdepasse.tpl');
 242         $page->addJsLink('motdepasse.js');
 243         $page->setTitle('Mon mot de passe');
 244     }
 245
 246     function handler_smtppass(&$page)
 247     {
 248         $page->changeTpl('platal/acces_smtp.tpl');
 249         $page->setTitle('Acces SMTP/NNTP');
 250
 251         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 252         $wp->buildCache();
 253         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 254         $wp->buildCache();
 255
 256         $uid  = S::i('uid');
 257         $pass = Env::v('smtppass1');
 258
 259         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 260             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 261             XDB::execute('UPDATE  accounts
 262                              SET  weak_password = {?}
 263                            WHERE  uid = {?}', $pass, $uid);
 264             $page->trigSuccess('Mot de passe enregistré');
 265             S::logger()->log("passwd_ssl");
 266         } elseif (Env::v('op') == "Supprimer") {
 267             XDB::execute('UPDATE  accounts
 268                              SET  weak_password = NULL
 269                            WHERE  uid = {?}', $uid);
 270             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 271             S::logger()->log("passwd_del");
 272         }
 273
 274         $res = XDB::query("SELECT  weak_password IS NOT NULL
 275                              FROM  accounts
 276                             WHERE  uid = {?}", $uid);
 277         $page->assign('actif', $res->fetchOneCell());
 278     }
 279
 280     function handler_recovery(&$page)
 281     {
 282         global $globals;
 283
 284         $page->changeTpl('platal/recovery.tpl');
 285
 286         if (!Env::has('login') || !Env::has('birth')) {
 287             return;
 288         }
 289
 290         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 291             $page->trigError('Date de naissance incorrecte ou incohérente');
 292             return;
 293         }
 294
 295         $birth   = sprintf('%s-%s-%s',
 296                            substr(Env::v('birth'), 4, 4),
 297                            substr(Env::v('birth'), 2, 2),
 298                            substr(Env::v('birth'), 0, 2));
 299
 300         $mailorg = strtok(Env::v('login'), '@');
 301
 302         $profile = Profile::get(Env::t('login'));
 303         if (is_null($profile) || $profile->birthdate != $birth) {
 304             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 305                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 306             return;
 307         }
 308
 309         $user = $profile->owner();
 310         if ($user->state != 'active') {
 311             $page->trigError('Ton compte n\'est pas activé.');
 312             return;
 313         }
 314
 315         $res = XDB::query("SELECT  COUNT(*)
 316                              FROM  emails
 317                             WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $user->id());
 318         $count = intval($res->fetchOneCell());
 319         if ($count == 0) {
 320             $page->assign('no_addr', true);
 321             return;
 322         }
 323
 324         $page->assign('ok', true);
 325
 326         $url   = rand_url_id();
 327         XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 328                            VALUES  ({?},{?},NOW())', $url, $user->id());
 329         $res   = XDB::query('SELECT  email
 330                                FROM  emails
 331                               WHERE  uid = {?} AND email = {?}',
 332                             $user->id(), Post::v('email'));
 333         if ($res->numRows()) {
 334             $mails = $res->fetchOneCell();
 335         } else {
 336             $res   = XDB::query("SELECT  email
 337                                    FROM  emails
 338                                   WHERE  uid = {?} AND NOT FIND_IN_SET('filter', flags)", $user->id());
 339             $mails = implode(', ', $res->fetchColumn());
 340         }
 341         $mymail = new PlMailer();
 342         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 343         $mymail->addTo($mails);
 344         $mymail->setSubject("Ton certificat d'authentification");
 345         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 346 {$globals->baseurl}/tmpPWD/$url
 347
 348 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 349
 350 --
 351 Polytechnique.org
 352 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 353
 354 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 355 Adresse de secours : " . Post::v('email') : ""));
 356         $mymail->send();
 357
 358         // on cree un objet logger et on log l'evenement
 359         S::logger($user->id())->log('recovery', $mails);
 360     }
 361
 362     function handler_tmpPWD(&$page, $certif = null)
 363     {
 364         global $globals;
 365         // XXX: recovery requires data from the profile
 366         XDB::execute('DELETE FROM  perte_pass
 367                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 368
 369         $res = XDB::query('SELECT  uid
 370                              FROM  perte_pass WHERE certificat={?}', $certif);
 371         $ligne = $res->fetchOneAssoc();
 372         if (!$ligne) {
 373             $page->changeTpl('platal/index.tpl');
 374             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 375         }
 376
 377         $uid = $ligne["uid"];
 378         if (Post::has('response2')) {
 379             $password = Post::v('response2');
 380             XDB::query('UPDATE  accounts
 381                            SET  password={?}
 382                          WHERE  uid = {?} AND state = \'active\'',
 383                        $password, $uid);
 384             XDB::query('DELETE FROM  perte_pass
 385                               WHERE  certificat={?}', $certif);
 386
 387             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 388             // updates the Google Apps password as well.
 389             if ($globals->mailstorage->googleapps_domain) {
 390                 require_once 'googleapps.inc.php';
 391                 $account = new GoogleAppsAccount(User::getSilent($uid));
 392                 if ($account->active() && $account->sync_password) {
 393                     $account->set_password($password);
 394                 }
 395             }
 396
 397             S::logger($uid)->log("passwd", "");
 398             $page->changeTpl('platal/tmpPWD.success.tpl');
 399         } else {
 400             $page->changeTpl('platal/motdepasse.tpl');
 401             $page->addJsLink('motdepasse.js');
 402         }
 403     }
 404
 405     function handler_skin(&$page)
 406     {
 407         global $globals;
 408
 409         $page->changeTpl('platal/skins.tpl');
 410         $page->setTitle('Skins');
 411
 412         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 413             XDB::execute('UPDATE  accounts
 414                              SET  skin = {?}
 415                            WHERE  uid = {?}',
 416                          Env::i('newskin'), S::i('uid'));
 417             S::kill('skin');
 418             Platal::session()->setSkin();
 419         }
 420
 421         $res = XDB::query('SELECT  id
 422                              FROM  skins
 423                             WHERE  skin_tpl = {?}', S::v('skin'));
 424         $page->assign('skin_id', $res->fetchOneCell());
 425
 426         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 427                   FROM  skins AS s
 428              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 429                  WHERE  skin_tpl != \'\' AND ext != \'\'
 430               GROUP BY  id ORDER BY s.date DESC';
 431         $page->assign('skins', XDB::iterator($sql));
 432     }
 433
 434     function handler_exit(&$page, $level = null)
 435     {
 436         if (S::suid()) {
 437             S::logger()->log('suid_stop', S::user()->login() . " by " . S::suid('hruid'));
 438             Platal::session()->stopSUID();
 439             pl_redirect('admin/user/' . S::user()->login());
 440         }
 441
 442         if ($level == 'forget' || $level == 'forgetall') {
 443             Platal::session()->killAccessCookie();
 444         }
 445
 446         if ($level == 'forgetuid' || $level == 'forgetall') {
 447             Platal::session()->killLoginFormCookies();
 448         }
 449
 450         if (S::logged()) {
 451             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 452             Platal::session()->destroy();
 453         }
 454
 455         if (Get::has('redirect')) {
 456             http_redirect(rawurldecode(Get::v('redirect')));
 457         } else {
 458             $page->changeTpl('platal/exit.tpl');
 459         }
 460     }
 461
 462     function handler_review(&$page, $action = null, $mode = null)
 463     {
 464         // Include X-XRDS-Location response-header for Yadis discovery
 465         global $globals;
 466         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 467
 468         $this->load('review.inc.php');
 469         $dom = 'Review';
 470         if (@$GLOBALS['IS_XNET_SITE']) {
 471             $dom .= 'Xnet';
 472         }
 473         $wp = new PlWikiPage($dom . '.Admin');
 474         $conf = explode('%0a', $wp->getField('text'));
 475         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 476         foreach ($conf as $line) {
 477             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 478             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 479         }
 480         $wiz->apply($page, 'review', $action, $mode);
 481     }
 482 }
 483
 484 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 485 ?>