modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2011 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = preg_split('/,/', $list, -1, PREG_SPLIT_NO_EMPTY);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE, 'user,groups'),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE, 'user'),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP,    'mail'),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE, 'user'),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP,    'user,groups'),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP,    'mail'),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'recovery/ext'      => $this->make_hook('recovery_ext', AUTH_PUBLIC),
  57             'register/ext'      => $this->make_hook('register_ext', AUTH_PUBLIC),
  58             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  59             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  60             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  61         );
  62     }
  63
  64     function handler_index($page)
  65     {
  66         // Include X-XRDS-Location response-header for Yadis discovery
  67         global $globals;
  68         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  69
  70         // Redirect to the suitable page
  71         if (S::logged()) {
  72             pl_redirect('events');
  73         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  74             $this->handler_review($page);
  75         }
  76     }
  77
  78     function handler_cacert($page)
  79     {
  80         pl_cached_content_headers("application/x-x509-ca-cert");
  81         readfile("/etc/ssl/xorgCA/cacert.pem");
  82         exit;
  83     }
  84
  85     function handler_changelog($page, $core = null)
  86     {
  87         $page->changeTpl('platal/changeLog.tpl');
  88
  89         function formatChangeLog($file) {
  90             $clog = pl_entities(file_get_contents($file));
  91             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  92             // url catch only (not all wiki syntax)
  93             $clog = preg_replace(array(
  94                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  95                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  96                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  97               array(
  98                 '<a href="\\0">\\0</a>',
  99                 '\\1<a href="http://www.\\2">www.\\2</a>',
 100                 '<a href="mailto:\\0">\\0</a>'),
 101               $clog);
 102             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 103             $clog = preg_replace('!vim:.*$!', '', $clog);
 104             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 105         }
 106         if ($core != 'core') {
 107             $page->assign('core', false);
 108             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 109         } else {
 110             $page->assign('core', true);
 111             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 112         }
 113     }
 114
 115     function __set_rss_state($state)
 116     {
 117         if ($state) {
 118             if (!S::user()->token) {
 119                 S::user()->token = rand_url_id(16);
 120                 S::set('token', S::user()->token);
 121                 XDB::execute('UPDATE  accounts
 122                                  SET  token = {?}
 123                                WHERE  uid = {?}', S::user()->token, S::i('uid'));
 124             }
 125         } else {
 126             S::kill('token');
 127             S::user()->token = null;
 128             XDB::execute('UPDATE  accounts
 129                              SET  token = NULL
 130                            WHERE  uid = {?}', S::i('uid'));
 131         }
 132     }
 133
 134     function handler_prefs($page)
 135     {
 136         $page->changeTpl('platal/preferences.tpl');
 137         $page->setTitle('Mes préférences');
 138
 139         if (Post::has('email_format')) {
 140             S::assert_xsrf_token();
 141             $fmt = Post::s('email_format');
 142             S::user()->setEmailFormat($fmt);
 143         }
 144
 145         if (Post::has('rss')) {
 146             S::assert_xsrf_token();
 147             $this->__set_rss_state(Post::s('rss') == 'on');
 148         }
 149     }
 150
 151     function handler_webredir($page)
 152     {
 153         $page->changeTpl('platal/webredirect.tpl');
 154         $page->setTitle('Redirection de page WEB');
 155
 156         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 157             if (Env::blank('url')) {
 158                 $page->trigError('URL invalide');
 159             } else {
 160                 $url = Env::t('url');
 161                 XDB::execute('INSERT INTO  carvas (uid, url)
 162                                    VALUES  ({?}, {?})
 163                   ON DUPLICATE KEY UPDATE  url = VALUES(url)',
 164                              S::i('uid'), $url);
 165                 S::logger()->log('carva_add', 'http://' . $url);
 166                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 167             }
 168         } elseif (Env::v('submit') == 'Supprimer') {
 169             XDB::execute('DELETE FROM carvas
 170                                 WHERE uid = {?}', S::i('uid'));
 171             Post::kill('url');
 172             S::logger()->log('carva_del');
 173             $page->trigSuccess('Redirection supprimée');
 174         }
 175
 176         $url = XDB::fetchOneCell('SELECT  url
 177                                     FROM  carvas
 178                                    WHERE  uid = {?}', S::i('uid'));
 179         $page->assign('carva', $url);
 180
 181         # FIXME: this code is not multi-domain compatible. We should decide how
 182         # carva will extend to users not in the main domain.
 183         $best = XDB::fetchOneCell('SELECT  email
 184                                      FROM  email_source_account
 185                                     WHERE  uid = {?} AND FIND_IN_SET(\'bestalias\', flags)',
 186                                   S::user()->id());
 187         $page->assign('bestalias', $best);
 188     }
 189
 190     function handler_prefs_rss($page)
 191     {
 192         $page->changeTpl('platal/filrss.tpl');
 193
 194         $page->assign('goback', Env::v('referer', 'login'));
 195
 196         if (Env::v('act_rss') == 'Activer') {
 197             $this->__set_rss_state(true);
 198             $page->trigSuccess("Ton Fil RSS est activé.");
 199         }
 200     }
 201
 202     function handler_password($page)
 203     {
 204         global $globals;
 205
 206         if (Post::has('pwhash') && Post::t('pwhash'))  {
 207             S::assert_xsrf_token();
 208
 209             S::set('password', $password = Post::t('pwhash'));
 210             XDB::execute('UPDATE  accounts
 211                              SET  password = {?}
 212                            WHERE  uid={?}', $password,
 213                          S::i('uid'));
 214
 215             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 216             // updates the Google Apps password as well.
 217             if ($globals->mailstorage->googleapps_domain) {
 218                 require_once 'googleapps.inc.php';
 219                 $account = new GoogleAppsAccount(S::user());
 220                 if ($account->active() && $account->sync_password) {
 221                     $account->set_password($password);
 222                 }
 223             }
 224
 225             S::logger()->log('passwd');
 226             Platal::session()->setAccessCookie(true);
 227
 228             $page->changeTpl('platal/password.success.tpl');
 229             $page->run();
 230         }
 231
 232         $page->changeTpl('platal/password.tpl');
 233         $page->setTitle('Mon mot de passe');
 234         $page->assign('do_auth', 0);
 235     }
 236
 237     function handler_smtppass($page)
 238     {
 239         $page->changeTpl('platal/acces_smtp.tpl');
 240         $page->setTitle('Acces SMTP/NNTP');
 241
 242         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 243         $wp->buildCache();
 244         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 245         $wp->buildCache();
 246
 247         $uid  = S::i('uid');
 248         $pass = Env::v('smtppass1');
 249
 250         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 251             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 252             XDB::execute('UPDATE  accounts
 253                              SET  weak_password = {?}
 254                            WHERE  uid = {?}', $pass, $uid);
 255             $page->trigSuccess('Mot de passe enregistré');
 256             S::logger()->log("passwd_ssl");
 257         } elseif (Env::v('op') == "Supprimer") {
 258             XDB::execute('UPDATE  accounts
 259                              SET  weak_password = NULL
 260                            WHERE  uid = {?}', $uid);
 261             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 262             S::logger()->log("passwd_del");
 263         }
 264
 265         $res = XDB::query("SELECT  weak_password IS NOT NULL
 266                              FROM  accounts
 267                             WHERE  uid = {?}", $uid);
 268         $page->assign('actif', $res->fetchOneCell());
 269     }
 270
 271     function handler_recovery($page)
 272     {
 273         global $globals;
 274
 275         $page->changeTpl('platal/recovery.tpl');
 276
 277         if (!Env::has('login') || !Env::has('birth')) {
 278             return;
 279         }
 280
 281         if (!preg_match('/^[0-3][0-9][0-1][0-9][1][9]([0-9]{2})$/', Env::v('birth'))) {
 282             $page->trigError('Date de naissance incorrecte ou incohérente');
 283             return;
 284         }
 285
 286         $birth   = sprintf('%s-%s-%s',
 287                            substr(Env::v('birth'), 4, 4),
 288                            substr(Env::v('birth'), 2, 2),
 289                            substr(Env::v('birth'), 0, 2));
 290
 291         $mailorg = strtok(Env::v('login'), '@');
 292
 293         $profile = Profile::get(Env::t('login'));
 294         if (is_null($profile) || $profile->birthdate != $birth) {
 295             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 296                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 297             return;
 298         }
 299
 300         $user = $profile->owner();
 301         if ($user->state != 'active') {
 302             $page->trigError('Ton compte n\'est pas activé.');
 303             return;
 304         }
 305
 306         if ($user->lost) {
 307             $page->assign('no_addr', true);
 308             return;
 309         }
 310
 311         $page->assign('ok', true);
 312
 313         $url = rand_url_id();
 314         XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
 315                            VALUES  ({?},{?},NOW())', $url, $user->id());
 316         $to = XDB::fetchOneCell('SELECT  redirect
 317                                    FROM  email_redirect_account
 318                                   WHERE  uid = {?} AND redirect = {?}',
 319                                 $user->id(), Post::t('email'));
 320         if (is_null($to)) {
 321             $emails = XDB::fetchColumn('SELECT  redirect
 322                                           FROM  email_redirect_account
 323                                          WHERE  uid = {?} AND flags = \'inactive\' AND type = \'smtp\'',
 324                                        $user->id());
 325             $inactives_to = implode(', ', $emails);
 326         }
 327         $mymail = new PlMailer();
 328         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 329         if (is_null($to)) {
 330             $mymail->addTo($user);
 331             $mymail->addTo($inactives_to);
 332         } else {
 333             $mymail->addTo($to);
 334         }
 335         $mymail->setSubject("Ton certificat d'authentification");
 336         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 337 {$globals->baseurl}/tmpPWD/$url
 338
 339 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 340
 341 --
 342 Polytechnique.org
 343 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 344
 345 Email envoyé à ".Env::v('login') . (is_null($to) ? '' : '
 346 Adresse de secours : ' . $to));
 347         $mymail->send();
 348
 349         S::logger($user->id())->log('recovery', is_null($to) ? $inactives_to . ', ' . $user->bestEmail() : $to);
 350     }
 351
 352     function handler_recovery_ext($page)
 353     {
 354         $page->changeTpl('xnet/recovery.tpl');
 355
 356         if (!Post::has('login')) {
 357             return;
 358         }
 359
 360         $user = User::getSilent(Post::t('login'));
 361         if (is_null($user)) {
 362             $page->trigError('Le compte n\'existe pas.');
 363             return;
 364         }
 365         if ($user->state != 'active') {
 366             $page->trigError('Ton compte n\'est pas activé.');
 367             return;
 368         }
 369
 370         $page->assign('ok', true);
 371
 372         $hash = rand_url_id();
 373         XDB::execute('INSERT INTO  account_lost_passwords (uid, created, certificat)
 374                            VALUES  ({?}, NOW(), {?})',
 375                      $user->id(), $hash);
 376
 377         $mymail = new PlMailer('platal/password_recovery_xnet.mail.tpl');
 378         $mymail->addTo($user);
 379         $mymail->assign('hash', $hash);
 380         $mymail->assign('email', Post::t('login'));
 381         $mymail->send();
 382
 383         S::logger($user->id())->log('recovery', $user->bestEmail());
 384     }
 385
 386     function handler_tmpPWD($page, $certif = null)
 387     {
 388         global $globals;
 389         XDB::execute('DELETE FROM  account_lost_passwords
 390                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 391
 392         $res = XDB::query('SELECT  uid
 393                              FROM  account_lost_passwords WHERE certificat={?}', $certif);
 394         $ligne = $res->fetchOneAssoc();
 395         if (!$ligne) {
 396             $page->changeTpl('platal/index.tpl');
 397             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 398         }
 399
 400         $uid = $ligne["uid"];
 401         if (Post::has('pwhash') && Post::t('pwhash')) {
 402             $password = Post::t('pwhash');
 403             XDB::query('UPDATE  accounts
 404                            SET  password={?}
 405                          WHERE  uid = {?} AND state = \'active\'',
 406                        $password, $uid);
 407             XDB::query('DELETE FROM  account_lost_passwords
 408                               WHERE  certificat={?}', $certif);
 409
 410             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 411             // updates the Google Apps password as well.
 412             if ($globals->mailstorage->googleapps_domain) {
 413                 require_once 'googleapps.inc.php';
 414                 $account = new GoogleAppsAccount(User::getSilent($uid));
 415                 if ($account->active() && $account->sync_password) {
 416                     $account->set_password($password);
 417                 }
 418             }
 419
 420             S::logger($uid)->log("passwd", "");
 421
 422             // Try to start a session (so the user don't have to log in); we will use
 423             // the password available in Post:: to authenticate the user.
 424             Platal::session()->start(AUTH_MDP);
 425
 426             $page->changeTpl('platal/tmpPWD.success.tpl');
 427         } else {
 428             $hruid = XDB::fetchOneCell('SELECT  hruid
 429                                           FROM  accounts
 430                                          WHERE  uid = {?}',
 431                                        $uid);
 432             $page->changeTpl('platal/password.tpl');
 433             $page->assign('hruid', $hruid);
 434             $page->assign('do_auth', 1);
 435         }
 436     }
 437
 438     function handler_register_ext($page, $hash = null)
 439     {
 440         XDB::execute('DELETE FROM  register_pending_xnet
 441                             WHERE  DATE_SUB(NOW(), INTERVAL 1 MONTH) > date');
 442         $res = XDB::fetchOneAssoc('SELECT  uid, hruid, email
 443                                      FROM  register_pending_xnet
 444                                     WHERE  hash = {?}',
 445                                   $hash);
 446
 447         if (is_null($hash) || is_null($res)) {
 448             $page->trigErrorRedirect('Cette adresse n\'existe pas ou n\'existe plus sur le serveur.', '');
 449         }
 450
 451         if (Post::has('pwhash') && Post::t('pwhash')) {
 452             XDB::startTransaction();
 453             XDB::query('UPDATE  accounts
 454                            SET  password = {?}, state = \'active\', registration_date = NOW()
 455                          WHERE  uid = {?} AND state = \'pending\' AND type = \'xnet\'',
 456                        Post::t('pwhash'), $res['uid']);
 457             XDB::query('DELETE FROM  register_pending_xnet
 458                               WHERE  uid = {?}',
 459                               $res['uid']);
 460             XDB::commit();
 461
 462             S::logger($res['uid'])->log('passwd', '');
 463
 464             // Try to start a session (so the user don't have to log in); we will use
 465             // the password available in Post:: to authenticate the user.
 466             Post::kill('wait');
 467             Platal::session()->startAvailableAuth();
 468
 469             $page->changeTpl('xnet/register.success.tpl');
 470             $page->assign('email', $res['email']);
 471         } else {
 472             $page->changeTpl('platal/password.tpl');
 473             $page->assign('xnet', true);
 474             $page->assign('hruid', $res['hruid']);
 475             $page->assign('do_auth', 1);
 476         }
 477     }
 478
 479     function handler_skin($page)
 480     {
 481         global $globals;
 482
 483         $page->changeTpl('platal/skins.tpl');
 484         $page->setTitle('Skins');
 485
 486         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 487             XDB::execute('UPDATE  accounts
 488                              SET  skin = {?}
 489                            WHERE  uid = {?}',
 490                          Env::i('newskin'), S::i('uid'));
 491             S::kill('skin');
 492             Platal::session()->setSkin();
 493         }
 494
 495         $res = XDB::query('SELECT  id
 496                              FROM  skins
 497                             WHERE  skin_tpl = {?}', S::v('skin'));
 498         $page->assign('skin_id', $res->fetchOneCell());
 499
 500         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 501                   FROM  skins AS s
 502              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 503                  WHERE  skin_tpl != \'\' AND ext != \'\'
 504               GROUP BY  id ORDER BY s.date DESC';
 505         $page->assign('skins', XDB::iterator($sql));
 506     }
 507
 508     function handler_exit($page, $level = null)
 509     {
 510         if (S::suid()) {
 511             $old = S::user()->login();
 512             S::logger()->log('suid_stop', $old . " by " . S::suid('hruid'));
 513             Platal::session()->stopSUID();
 514             $target = S::s('suid_startpage');
 515             S::kill('suid_startpage');
 516             if (!empty($target)) {
 517                 http_redirect($target);
 518             }
 519             pl_redirect('admin/user/' . $old);
 520         }
 521
 522         if ($level == 'forget' || $level == 'forgetall') {
 523             Platal::session()->killAccessCookie();
 524         }
 525
 526         if ($level == 'forgetuid' || $level == 'forgetall') {
 527             Platal::session()->killLoginFormCookies();
 528         }
 529
 530         if (S::logged()) {
 531             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 532             Platal::session()->destroy();
 533         }
 534
 535         if (Get::has('redirect')) {
 536             http_redirect(rawurldecode(Get::v('redirect')));
 537         } else {
 538             $page->changeTpl('platal/exit.tpl');
 539         }
 540     }
 541
 542     function handler_review($page, $action = null, $mode = null)
 543     {
 544         // Include X-XRDS-Location response-header for Yadis discovery
 545         global $globals;
 546         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 547
 548         $this->load('review.inc.php');
 549         $dom = 'Review';
 550         if (@$GLOBALS['IS_XNET_SITE']) {
 551             $dom .= 'Xnet';
 552         }
 553         $wp = new PlWikiPage($dom . '.Admin');
 554         $conf = explode('%0a', $wp->getField('text'));
 555         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 556         foreach ($conf as $line) {
 557             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 558             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 559         }
 560         $wiz->apply($page, 'review', $action, $mode);
 561     }
 562 }
 563
 564 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 565 ?>