modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2010 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP, 'mail'),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP, 'mail'),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  57             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  58             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  59         );
  60     }
  61
  62     function handler_index(&$page)
  63     {
  64         // Include X-XRDS-Location response-header for Yadis discovery
  65         global $globals;
  66         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  67
  68         // Redirect to the suitable page
  69         if (S::logged()) {
  70             pl_redirect('events');
  71         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  72             $this->handler_review($page);
  73         }
  74     }
  75
  76     function handler_cacert(&$page)
  77     {
  78         pl_cached_content_headers("application/x-x509-ca-cert");
  79         readfile("/etc/ssl/xorgCA/cacert.pem");
  80         exit;
  81     }
  82
  83     function handler_changelog(&$page, $core = null)
  84     {
  85         $page->changeTpl('platal/changeLog.tpl');
  86
  87         function formatChangeLog($file) {
  88             $clog = pl_entities(file_get_contents($file));
  89             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  90             // url catch only (not all wiki syntax)
  91             $clog = preg_replace(array(
  92                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  93                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  94                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  95               array(
  96                 '<a href="\\0">\\0</a>',
  97                 '\\1<a href="http://www.\\2">www.\\2</a>',
  98                 '<a href="mailto:\\0">\\0</a>'),
  99               $clog);
 100             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 101             $clog = preg_replace('!vim:.*$!', '', $clog);
 102             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 103         }
 104         if ($core != 'core') {
 105             $page->assign('core', false);
 106             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 107         } else {
 108             $page->assign('core', true);
 109             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 110         }
 111     }
 112
 113     function __set_rss_state($state)
 114     {
 115         if ($state) {
 116             if (!S::user()->token) {
 117                 S::user()->token = rand_url_id(16);
 118                 S::set('token', S::user()->token);
 119                 XDB::execute('UPDATE  accounts
 120                                  SET  token = {?}
 121                                WHERE  uid = {?}', S::user()->token, S::i('uid'));
 122             }
 123         } else {
 124             S::kill('token');
 125             S::user()->token = null;
 126             XDB::execute('UPDATE  accounts
 127                              SET  token = NULL
 128                            WHERE  uid = {?}', S::i('uid'));
 129         }
 130     }
 131
 132     function handler_prefs(&$page)
 133     {
 134         $page->changeTpl('platal/preferences.tpl');
 135         $page->setTitle('Mes préférences');
 136
 137         if (Post::has('email_format')) {
 138             S::assert_xsrf_token();
 139             $fmt = Post::s('email_format');
 140             S::user()->setEmailFormat($fmt);
 141         }
 142
 143         if (Post::has('rss')) {
 144             S::assert_xsrf_token();
 145             $this->__set_rss_state(Post::s('rss') == 'on');
 146         }
 147     }
 148
 149     function handler_webredir(&$page)
 150     {
 151         $page->changeTpl('platal/webredirect.tpl');
 152         $page->setTitle('Redirection de page WEB');
 153
 154         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 155             if (Env::blank('url')) {
 156                 $page->trigError('URL invalide');
 157             } else {
 158                 $url = Env::t('url');
 159                 XDB::execute('REPLACE INTO  carvas (uid, url)
 160                                     VALUES  ({?}, {?})',
 161                              S::i('uid'), $url);
 162                 S::logger()->log('carva_add', 'http://' . $url);
 163                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 164             }
 165         } elseif (Env::v('submit') == 'Supprimer') {
 166             XDB::execute('DELETE FROM carvas
 167                                 WHERE uid = {?}', S::i('uid'));
 168             Post::kill('url');
 169             S::logger()->log('carva_del');
 170             $page->trigSuccess('Redirection supprimée');
 171         }
 172
 173         $url = XDB::fetchOneCell('SELECT  url
 174                                     FROM  carvas
 175                                    WHERE  uid = {?}', S::i('uid'));
 176         $page->assign('carva', $url);
 177
 178         # FIXME: this code is not multi-domain compatible. We should decide how
 179         # carva will extend to users not in the main domain.
 180         $res = XDB::query("SELECT  alias
 181                              FROM  aliases
 182                             WHERE  uid = {?} AND FIND_IN_SET('bestalias', flags)",
 183                           S::user()->id());
 184         $page->assign('bestalias', $res->fetchOneCell());
 185     }
 186
 187     function handler_prefs_rss(&$page)
 188     {
 189         $page->changeTpl('platal/filrss.tpl');
 190
 191         $page->assign('goback', Env::v('referer', 'login'));
 192
 193         if (Env::v('act_rss') == 'Activer') {
 194             $this->__set_rss_state(true);
 195             $page->trigSuccess("Ton Fil RSS est activé.");
 196         }
 197     }
 198
 199     function handler_password(&$page)
 200     {
 201         global $globals;
 202
 203         if (Post::has('pwhash') && Post::t('pwhash'))  {
 204             S::assert_xsrf_token();
 205
 206             S::set('password', $password = Post::t('pwhash'));
 207             XDB::execute('UPDATE  accounts
 208                              SET  password = {?}
 209                            WHERE  uid={?}', $password,
 210                          S::i('uid'));
 211
 212             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 213             // updates the Google Apps password as well.
 214             if ($globals->mailstorage->googleapps_domain) {
 215                 require_once 'googleapps.inc.php';
 216                 $account = new GoogleAppsAccount(S::user());
 217                 if ($account->active() && $account->sync_password) {
 218                     $account->set_password($password);
 219                 }
 220             }
 221
 222             S::logger()->log('passwd');
 223             Platal::session()->setAccessCookie(true);
 224
 225             $page->changeTpl('platal/password.success.tpl');
 226             $page->run();
 227         }
 228
 229         $page->changeTpl('platal/password.tpl');
 230         $page->addJsLink('password.js');
 231         $page->setTitle('Mon mot de passe');
 232     }
 233
 234     function handler_smtppass(&$page)
 235     {
 236         $page->changeTpl('platal/acces_smtp.tpl');
 237         $page->setTitle('Acces SMTP/NNTP');
 238
 239         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 240         $wp->buildCache();
 241         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 242         $wp->buildCache();
 243
 244         $uid  = S::i('uid');
 245         $pass = Env::v('smtppass1');
 246
 247         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 248             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 249             XDB::execute('UPDATE  accounts
 250                              SET  weak_password = {?}
 251                            WHERE  uid = {?}', $pass, $uid);
 252             $page->trigSuccess('Mot de passe enregistré');
 253             S::logger()->log("passwd_ssl");
 254         } elseif (Env::v('op') == "Supprimer") {
 255             XDB::execute('UPDATE  accounts
 256                              SET  weak_password = NULL
 257                            WHERE  uid = {?}', $uid);
 258             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 259             S::logger()->log("passwd_del");
 260         }
 261
 262         $res = XDB::query("SELECT  weak_password IS NOT NULL
 263                              FROM  accounts
 264                             WHERE  uid = {?}", $uid);
 265         $page->assign('actif', $res->fetchOneCell());
 266     }
 267
 268     function handler_recovery(&$page)
 269     {
 270         global $globals;
 271
 272         $page->changeTpl('platal/recovery.tpl');
 273
 274         if (!Env::has('login') || !Env::has('birth')) {
 275             return;
 276         }
 277
 278         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 279             $page->trigError('Date de naissance incorrecte ou incohérente');
 280             return;
 281         }
 282
 283         $birth   = sprintf('%s-%s-%s',
 284                            substr(Env::v('birth'), 4, 4),
 285                            substr(Env::v('birth'), 2, 2),
 286                            substr(Env::v('birth'), 0, 2));
 287
 288         $mailorg = strtok(Env::v('login'), '@');
 289
 290         $profile = Profile::get(Env::t('login'));
 291         if (is_null($profile) || $profile->birthdate != $birth) {
 292             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 293                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 294             return;
 295         }
 296
 297         $user = $profile->owner();
 298         if ($user->state != 'active') {
 299             $page->trigError('Ton compte n\'est pas activé.');
 300             return;
 301         }
 302
 303         $res = XDB::query("SELECT  COUNT(*)
 304                              FROM  emails
 305                             WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $user->id());
 306         $count = intval($res->fetchOneCell());
 307         if ($count == 0) {
 308             $page->assign('no_addr', true);
 309             return;
 310         }
 311
 312         $page->assign('ok', true);
 313
 314         $url   = rand_url_id();
 315         XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
 316                            VALUES  ({?},{?},NOW())', $url, $user->id());
 317         $res   = XDB::query('SELECT  email
 318                                FROM  emails
 319                               WHERE  uid = {?} AND email = {?}',
 320                             $user->id(), Post::v('email'));
 321         if ($res->numRows()) {
 322             $mails = $res->fetchOneCell();
 323         } else {
 324             $res   = XDB::query("SELECT  email
 325                                    FROM  emails
 326                                   WHERE  uid = {?} AND NOT FIND_IN_SET('filter', flags)", $user->id());
 327             $mails = implode(', ', $res->fetchColumn());
 328         }
 329         $mymail = new PlMailer();
 330         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 331         $mymail->addTo($mails);
 332         $mymail->setSubject("Ton certificat d'authentification");
 333         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 334 {$globals->baseurl}/tmpPWD/$url
 335
 336 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 337
 338 --
 339 Polytechnique.org
 340 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 341
 342 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 343 Adresse de secours : " . Post::v('email') : ""));
 344         $mymail->send();
 345
 346         // on cree un objet logger et on log l'evenement
 347         S::logger($user->id())->log('recovery', $mails);
 348     }
 349
 350     function handler_tmpPWD(&$page, $certif = null)
 351     {
 352         global $globals;
 353         // XXX: recovery requires data from the profile
 354         XDB::execute('DELETE FROM  account_lost_passwords
 355                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 356
 357         $res = XDB::query('SELECT  uid
 358                              FROM  account_lost_passwords WHERE certificat={?}', $certif);
 359         $ligne = $res->fetchOneAssoc();
 360         if (!$ligne) {
 361             $page->changeTpl('platal/index.tpl');
 362             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 363         }
 364
 365         $uid = $ligne["uid"];
 366         if (Post::has('pwhash') && Post::t('pwhash')) {
 367             $password = Post::t('pwhash');
 368             XDB::query('UPDATE  accounts
 369                            SET  password={?}
 370                          WHERE  uid = {?} AND state = \'active\'',
 371                        $password, $uid);
 372             XDB::query('DELETE FROM  account_lost_passwords
 373                               WHERE  certificat={?}', $certif);
 374
 375             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 376             // updates the Google Apps password as well.
 377             if ($globals->mailstorage->googleapps_domain) {
 378                 require_once 'googleapps.inc.php';
 379                 $account = new GoogleAppsAccount(User::getSilent($uid));
 380                 if ($account->active() && $account->sync_password) {
 381                     $account->set_password($password);
 382                 }
 383             }
 384
 385             S::logger($uid)->log("passwd", "");
 386             $page->changeTpl('platal/tmpPWD.success.tpl');
 387         } else {
 388             $page->changeTpl('platal/password.tpl');
 389             $page->addJsLink('password.js');
 390         }
 391     }
 392
 393     function handler_skin(&$page)
 394     {
 395         global $globals;
 396
 397         $page->changeTpl('platal/skins.tpl');
 398         $page->setTitle('Skins');
 399
 400         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 401             XDB::execute('UPDATE  accounts
 402                              SET  skin = {?}
 403                            WHERE  uid = {?}',
 404                          Env::i('newskin'), S::i('uid'));
 405             S::kill('skin');
 406             Platal::session()->setSkin();
 407         }
 408
 409         $res = XDB::query('SELECT  id
 410                              FROM  skins
 411                             WHERE  skin_tpl = {?}', S::v('skin'));
 412         $page->assign('skin_id', $res->fetchOneCell());
 413
 414         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 415                   FROM  skins AS s
 416              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 417                  WHERE  skin_tpl != \'\' AND ext != \'\'
 418               GROUP BY  id ORDER BY s.date DESC';
 419         $page->assign('skins', XDB::iterator($sql));
 420     }
 421
 422     function handler_exit(&$page, $level = null)
 423     {
 424         if (S::suid()) {
 425             $old = S::user()->login();
 426             S::logger()->log('suid_stop', $old . " by " . S::suid('hruid'));
 427             Platal::session()->stopSUID();
 428             $target = S::s('suid_startpage');
 429             S::kill('suid_startpage');
 430             if (!empty($target)) {
 431                 http_redirect($target);
 432             }
 433             pl_redirect('admin/user/' . $old);
 434         }
 435
 436         if ($level == 'forget' || $level == 'forgetall') {
 437             Platal::session()->killAccessCookie();
 438         }
 439
 440         if ($level == 'forgetuid' || $level == 'forgetall') {
 441             Platal::session()->killLoginFormCookies();
 442         }
 443
 444         if (S::logged()) {
 445             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 446             Platal::session()->destroy();
 447         }
 448
 449         if (Get::has('redirect')) {
 450             http_redirect(rawurldecode(Get::v('redirect')));
 451         } else {
 452             $page->changeTpl('platal/exit.tpl');
 453         }
 454     }
 455
 456     function handler_review(&$page, $action = null, $mode = null)
 457     {
 458         // Include X-XRDS-Location response-header for Yadis discovery
 459         global $globals;
 460         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 461
 462         $this->load('review.inc.php');
 463         $dom = 'Review';
 464         if (@$GLOBALS['IS_XNET_SITE']) {
 465             $dom .= 'Xnet';
 466         }
 467         $wp = new PlWikiPage($dom . '.Admin');
 468         $conf = explode('%0a', $wp->getField('text'));
 469         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 470         foreach ($conf as $line) {
 471             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 472             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 473         }
 474         $wiz->apply($page, 'review', $action, $mode);
 475     }
 476 }
 477
 478 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 479 ?>