modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'       => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'  => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'   => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'       => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'   => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect'
  49                           => $this->make_hook('webredir',  AUTH_MDP),
  50             'prefs/skin'  => $this->make_hook('skin',      AUTH_COOKIE),
  51
  52             // password related thingies
  53             'password'      => $this->make_hook('password',  AUTH_MDP),
  54             'tmpPWD'        => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  55             'password/smtp' => $this->make_hook('smtppass',  AUTH_MDP),
  56             'recovery'      => $this->make_hook('recovery',  AUTH_PUBLIC),
  57             'exit'          => $this->make_hook('exit', AUTH_PUBLIC),
  58             'review'        => $this->make_hook('review', AUTH_PUBLIC),
  59             'deconnexion.php' => $this->make_hook('exit', AUTH_PUBLIC),
  60         );
  61     }
  62
  63     function handler_index(&$page)
  64     {
  65         // Include X-XRDS-Location response-header for Yadis discovery
  66         global $globals;
  67         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
  68
  69         // Redirect to the suitable page
  70         if (S::logged()) {
  71             pl_redirect('events');
  72         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  73             pl_redirect('review');
  74         }
  75     }
  76
  77     function handler_cacert(&$page)
  78     {
  79         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  80         header("Pragma:");
  81         header("Set-Cookie:");
  82         header("Cache-Control:");
  83         header("Expires:");
  84         header("Content-Type: application/x-x509-ca-cert");
  85         header("Content-Length: ".strlen($data));
  86         echo $data;
  87         exit;
  88     }
  89
  90     function handler_changelog(&$page)
  91     {
  92         $page->changeTpl('platal/changeLog.tpl');
  93
  94         $clog = pl_entities(file_get_contents(dirname(__FILE__).'/../ChangeLog'));
  95         $clog = preg_replace('/=+\s*/', '</pre><hr /><pre>', $clog);
  96         // url catch only (not all wiki syntax)
  97         $clog = preg_replace(array(
  98             '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  99             '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
 100             '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
 101           array(
 102             '<a href="\\0">\\0</a>',
 103             '\\1<a href="http://www.\\2">www.\\2</a>',
 104             '<a href="mailto:\\0">\\0</a>'),
 105           $clog);
 106         $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 107         $clog = preg_replace('!vim:.*$!', '', $clog);
 108         $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 109         $page->assign('ChangeLog', $clog);
 110     }
 111
 112     function __set_rss_state($state)
 113     {
 114         if ($state) {
 115             $_SESSION['core_rss_hash'] = rand_url_id(16);
 116             XDB::execute('UPDATE  auth_user_quick
 117                                    SET  core_rss_hash={?} WHERE user_id={?}',
 118                                    S::v('core_rss_hash'), S::v('uid'));
 119         } else {
 120             XDB::execute('UPDATE  auth_user_quick
 121                                    SET  core_rss_hash="" WHERE user_id={?}',
 122                                    S::v('uid'));
 123             S::kill('core_rss_hash');
 124         }
 125     }
 126
 127     function handler_prefs(&$page)
 128     {
 129         $page->changeTpl('platal/preferences.tpl');
 130         $page->setTitle('Mes préférences');
 131
 132         if (Post::has('mail_fmt')) {
 133             $fmt = Post::v('mail_fmt');
 134             if ($fmt != 'texte') $fmt = 'html';
 135             XDB::execute("UPDATE auth_user_quick
 136                                        SET core_mail_fmt = '$fmt'
 137                                      WHERE user_id = {?}",
 138                                      S::v('uid'));
 139             $_SESSION['mail_fmt'] = $fmt;
 140         }
 141
 142         if (Post::has('rss')) {
 143             $this->__set_rss_state(Post::b('rss'));
 144         }
 145
 146         # FIXME: this code is not multi-domain compatible. We should decide how
 147         # carva will extend to users not in the main domain.
 148         $res = XDB::query("SELECT  alias
 149                              FROM  aliases
 150                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 151                           S::user()->id());
 152         $page->assign('bestalias', $res->fetchOneCell());
 153     }
 154
 155     function handler_webredir(&$page)
 156     {
 157         $page->changeTpl('platal/webredirect.tpl');
 158
 159         $page->setTitle('Redirection de page WEB');
 160
 161         $log =& S::v('log');
 162         $url = Env::v('url');
 163
 164         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 165             XDB::execute('UPDATE auth_user_quick
 166                                        SET redirecturl = {?} WHERE user_id = {?}',
 167                                    $url, S::v('uid'));
 168             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 169             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 170         } elseif (Env::v('submit') == "Supprimer") {
 171             XDB::execute("UPDATE auth_user_quick
 172                                        SET redirecturl = ''
 173                                      WHERE user_id = {?}",
 174                                    S::v('uid'));
 175             S::logger()->log("carva_del", $url);
 176             Post::kill('url');
 177             $page->trigSuccess('Redirection supprimée');
 178         }
 179
 180         $res = XDB::query('SELECT redirecturl
 181                                        FROM auth_user_quick
 182                                       WHERE user_id = {?}',
 183                                     S::v('uid'));
 184         $page->assign('carva', $res->fetchOneCell());
 185
 186         # FIXME: this code is not multi-domain compatible. We should decide how
 187         # carva will extend to users not in the main domain.
 188         $res = XDB::query("SELECT  alias
 189                              FROM  aliases
 190                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 191                           S::user()->id());
 192         $page->assign('bestalias', $res->fetchOneCell());
 193     }
 194
 195     function handler_prefs_rss(&$page)
 196     {
 197         $page->changeTpl('platal/filrss.tpl');
 198
 199         $page->assign('goback', Env::v('referer', 'login'));
 200
 201         if (Env::v('act_rss') == 'Activer') {
 202             $this->__set_rss_state(true);
 203             $page->trigSuccess("Ton Fil RSS est activé.");
 204         }
 205     }
 206
 207     function handler_password(&$page)
 208     {
 209         global $globals;
 210
 211         if (Post::has('response2'))  {
 212             require_once 'secure_hash.inc.php';
 213             S::assert_xsrf_token();
 214
 215             $_SESSION['password'] = $password = Post::v('response2');
 216
 217             XDB::execute('UPDATE  auth_user_md5
 218                              SET  password={?}
 219                            WHERE  user_id={?}', $password,
 220                            S::v('uid'));
 221
 222             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 223             // updates the Google Apps password as well.
 224             if ($globals->mailstorage->googleapps_domain) {
 225                 require_once 'googleapps.inc.php';
 226                 $account = new GoogleAppsAccount(S::user());
 227                 if ($account->active() && $account->sync_password) {
 228                     $account->set_password($password);
 229                 }
 230             }
 231
 232             $log =& S::v('log');
 233             S::logger()->log('passwd', '');
 234
 235             if (Cookie::v('ORGaccess')) {
 236                 setcookie('ORGaccess', hash_encrypt($password), (time()+25920000), '/', '' ,0);
 237             }
 238
 239             $page->changeTpl('platal/motdepasse.success.tpl');
 240             $page->run();
 241         }
 242
 243         $page->changeTpl('platal/motdepasse.tpl');
 244         $page->addJsLink('motdepasse.js');
 245         $page->setTitle('Mon mot de passe');
 246     }
 247
 248     function handler_smtppass(&$page)
 249     {
 250         $page->changeTpl('platal/acces_smtp.tpl');
 251         $page->setTitle('Acces SMTP/NNTP');
 252
 253         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 254         $wp->buildCache();
 255         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 256         $wp->buildCache();
 257
 258         $uid  = S::v('uid');
 259         $pass = Env::v('smtppass1');
 260         $log  = S::v('log');
 261
 262         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 263         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 264         {
 265             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 266                                      WHERE user_id = {?}', $pass, $uid);
 267             $page->trigSuccess('Mot de passe enregistré');
 268             S::logger()->log("passwd_ssl");
 269         } elseif (Env::v('op') == "Supprimer") {
 270             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 271                                      WHERE user_id = {?}', $uid);
 272             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 273             S::logger()->log("passwd_del");
 274         }
 275
 276         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 277                                        FROM auth_user_md5
 278                                       WHERE user_id = {?}", $uid);
 279         $page->assign('actif', $res->fetchOneCell());
 280     }
 281
 282     function handler_recovery(&$page)
 283     {
 284         global $globals;
 285
 286         $page->changeTpl('platal/recovery.tpl');
 287
 288         if (!Env::has('login') || !Env::has('birth')) {
 289             return;
 290         }
 291
 292         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 293             $page->trigError('Date de naissance incorrecte ou incohérente');
 294             return;
 295         }
 296
 297         $birth   = sprintf('%s-%s-%s',
 298                            substr(Env::v('birth'), 4, 4),
 299                            substr(Env::v('birth'), 2, 2),
 300                            substr(Env::v('birth'), 0, 2));
 301
 302         $mailorg = strtok(Env::v('login'), '@');
 303
 304         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 305         // avec celle fournie ici en espérant que c'est la bonne
 306
 307         $res = XDB::query(
 308                 "SELECT  user_id, naissance
 309                    FROM  auth_user_md5 AS u
 310              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 311                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 312         list($uid, $naissance) = $res->fetchOneRow();
 313
 314         if ($naissance == $birth) {
 315             $res = XDB::query("SELECT  COUNT(*)
 316                                  FROM  emails
 317                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 318             $count = intval($res->fetchOneCell());
 319             if ($count == 0) {
 320                 $page->assign('no_addr', true);
 321                 return;
 322             }
 323
 324             $page->assign('ok', true);
 325
 326             $url   = rand_url_id();
 327             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 328                                VALUES  ({?},{?},NOW())', $url, $uid);
 329             $res   = XDB::query('SELECT  email
 330                                    FROM  emails
 331                                   WHERE  uid = {?} AND email = {?}',
 332                                 $uid, Post::v('email'));
 333             if ($res->numRows()) {
 334                 $mails = $res->fetchOneCell();
 335             } else {
 336                 $res   = XDB::query('SELECT  email
 337                                        FROM  emails
 338                                       WHERE  uid = {?} AND NOT FIND_IN_SET("filter", flags)', $uid);
 339                 $mails = implode(', ', $res->fetchColumn());
 340             }
 341             $mymail = new PlMailer();
 342             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 343             $mymail->addTo($mails);
 344             $mymail->setSubject('Ton certificat d\'authentification');
 345             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 346 {$globals->baseurl}/tmpPWD/$url
 347
 348 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 349
 350 --
 351 Polytechnique.org
 352 \"Le portail des élèves & anciens élèves de l'Ecole polytechnique\"
 353
 354 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 355 Adresse de secours : " . Post::v('email') : ""));
 356             $mymail->send();
 357
 358             // on cree un objet logger et on log l'evenement
 359             $logger = $_SESSION['log'] = new PlLogger($uid);
 360             S::logger()->log('recovery', $mails);
 361         } else {
 362             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 363                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 364         }
 365     }
 366
 367     function handler_tmpPWD(&$page, $certif = null)
 368     {
 369         global $globals;
 370         XDB::execute('DELETE FROM perte_pass
 371                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 372
 373         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 374         $ligne = $res->fetchOneAssoc();
 375         if (!$ligne) {
 376             $page->changeTpl('platal/index.tpl');
 377             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 378         }
 379
 380         $uid = $ligne["uid"];
 381         if (Post::has('response2')) {
 382             $password = Post::v('response2');
 383             XDB::query('UPDATE  auth_user_md5 SET password={?}
 384                                    WHERE  user_id={?} AND perms IN("admin","user")',
 385                                  $password, $uid);
 386             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 387
 388             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 389             // updates the Google Apps password as well.
 390             if ($globals->mailstorage->googleapps_domain) {
 391                 require_once 'googleapps.inc.php';
 392                 $account = new GoogleAppsAccount(User::getSilent($uid));
 393                 if ($account->active() && $account->sync_password) {
 394                     $account->set_password($password);
 395                 }
 396             }
 397
 398             $logger = new PlLogger($uid);
 399             S::logger()->log("passwd","");
 400             $page->changeTpl('platal/tmpPWD.success.tpl');
 401         } else {
 402             $page->changeTpl('platal/motdepasse.tpl');
 403             $page->addJsLink('motdepasse.js');
 404         }
 405     }
 406
 407     function handler_skin(&$page)
 408     {
 409         global $globals;
 410
 411         $page->changeTpl('platal/skins.tpl');
 412         $page->setTitle('Skins');
 413
 414         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 415             XDB::execute('UPDATE auth_user_quick
 416                              SET skin={?} WHERE user_id={?}',
 417                          Env::i('newskin'), S::v('uid'));
 418             S::kill('skin');
 419             Platal::session()->setSkin();
 420         }
 421
 422         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 423         $page->assign('skin_id', $res->fetchOneCell());
 424
 425         $sql = "SELECT s.*,auteur,count(*) AS nb
 426                   FROM skins AS s
 427              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 428                  WHERE skin_tpl != '' AND ext != ''
 429               GROUP BY id ORDER BY s.date DESC";
 430         $page->assign('skins', XDB::iterator($sql));
 431     }
 432
 433     function handler_exit(&$page, $level = null)
 434     {
 435         if (S::has('suid')) {
 436             $suid = S::v('suid');
 437             $log  = S::v('log');
 438             S::logger()->log("suid_stop", S::user()->login() . " by " . $suid['hruid']);
 439             Platal::session()->stopSUID();
 440             pl_redirect('admin/user/' . S::user()->login());
 441         }
 442
 443         if ($level == 'forget' || $level == 'forgetall') {
 444             setcookie('ORGaccess', '', time() - 3600, '/', '', 0);
 445             Cookie::kill('ORGaccess');
 446             if (isset($_SESSION['log']))
 447                 S::logger()->log("cookie_off");
 448         }
 449
 450         if ($level == 'forgetuid' || $level == 'forgetall') {
 451             setcookie('ORGuid', '', time() - 3600, '/', '', 0);
 452             Cookie::kill('ORGuid');
 453             setcookie('ORGdomain', '', time() - 3600, '/', '', 0);
 454             Cookie::kill('ORGdomain');
 455         }
 456
 457         if (isset($_SESSION['log'])) {
 458             $ref = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
 459             S::logger()->log('deconnexion',$ref);
 460         }
 461         Platal::session()->destroy();
 462
 463         if (Get::has('redirect')) {
 464             http_redirect(rawurldecode(Get::v('redirect')));
 465         } else {
 466             $page->changeTpl('platal/exit.tpl');
 467         }
 468     }
 469
 470     function handler_review(&$page, $action = null, $mode = null)
 471     {
 472         // Include X-XRDS-Location response-header for Yadis discovery
 473         global $globals;
 474         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
 475
 476         $this->load('review.inc.php');
 477         $dom = 'Review';
 478         if (@$GLOBALS['IS_XNET_SITE']) {
 479             $dom .= 'Xnet';
 480         }
 481         $wp = new PlWikiPage($dom . '.Admin');
 482         $conf = explode('%0a', $wp->getField('text'));
 483         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 484         foreach ($conf as $line) {
 485             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 486             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 487         }
 488         $wiz->apply($page, 'review', $action, $mode);
 489     }
 490 }
 491
 492 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 493 ?>