modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2010 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  57             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  58             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  59         );
  60     }
  61
  62     function handler_index(&$page)
  63     {
  64         // Include X-XRDS-Location response-header for Yadis discovery
  65         global $globals;
  66         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  67
  68         // Redirect to the suitable page
  69         if (S::logged()) {
  70             pl_redirect('events');
  71         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  72             pl_redirect('review');
  73         }
  74     }
  75
  76     function handler_cacert(&$page)
  77     {
  78         pl_cached_content_headers("application/x-x509-ca-cert");
  79         readfile("/etc/ssl/xorgCA/cacert.pem");
  80         exit;
  81     }
  82
  83     function handler_changelog(&$page)
  84     {
  85         $page->changeTpl('platal/changeLog.tpl');
  86
  87         $clog = pl_entities(file_get_contents(dirname(__FILE__).'/../ChangeLog'));
  88         $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  89         // url catch only (not all wiki syntax)
  90         $clog = preg_replace(array(
  91             '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  92             '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  93             '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  94           array(
  95             '<a href="\\0">\\0</a>',
  96             '\\1<a href="http://www.\\2">www.\\2</a>',
  97             '<a href="mailto:\\0">\\0</a>'),
  98           $clog);
  99         $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 100         $clog = preg_replace('!vim:.*$!', '', $clog);
 101         $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 102         $page->assign('ChangeLog', $clog);
 103     }
 104
 105     function __set_rss_state($state)
 106     {
 107         if ($state) {
 108             $_SESSION['core_rss_hash'] = rand_url_id(16);
 109             XDB::execute('UPDATE  auth_user_quick
 110                                    SET  core_rss_hash={?} WHERE user_id={?}',
 111                                    S::v('core_rss_hash'), S::v('uid'));
 112         } else {
 113             XDB::execute('UPDATE  auth_user_quick
 114                                    SET  core_rss_hash="" WHERE user_id={?}',
 115                                    S::v('uid'));
 116             S::kill('core_rss_hash');
 117         }
 118     }
 119
 120     function handler_prefs(&$page)
 121     {
 122         $page->changeTpl('platal/preferences.tpl');
 123         $page->setTitle('Mes préférences');
 124
 125         if (Post::has('mail_fmt')) {
 126             $fmt = Post::v('mail_fmt');
 127             if ($fmt != 'texte') $fmt = 'html';
 128             XDB::execute("UPDATE auth_user_quick
 129                                        SET core_mail_fmt = '$fmt'
 130                                      WHERE user_id = {?}",
 131                                      S::v('uid'));
 132             $_SESSION['mail_fmt'] = $fmt;
 133         }
 134
 135         if (Post::has('rss')) {
 136             $this->__set_rss_state(Post::b('rss'));
 137         }
 138
 139         # FIXME: this code is not multi-domain compatible. We should decide how
 140         # carva will extend to users not in the main domain.
 141         $res = XDB::query("SELECT  alias
 142                              FROM  aliases
 143                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 144                           S::user()->id());
 145         $page->assign('bestalias', $res->fetchOneCell());
 146     }
 147
 148     function handler_webredir(&$page)
 149     {
 150         $page->changeTpl('platal/webredirect.tpl');
 151
 152         $page->setTitle('Redirection de page WEB');
 153
 154         $log =& S::v('log');
 155         $url = Env::v('url');
 156
 157         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 158             XDB::execute('UPDATE auth_user_quick
 159                                        SET redirecturl = {?} WHERE user_id = {?}',
 160                                    $url, S::v('uid'));
 161             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 162             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 163         } elseif (Env::v('submit') == "Supprimer") {
 164             XDB::execute("UPDATE auth_user_quick
 165                                        SET redirecturl = ''
 166                                      WHERE user_id = {?}",
 167                                    S::v('uid'));
 168             S::logger()->log("carva_del", $url);
 169             Post::kill('url');
 170             $page->trigSuccess('Redirection supprimée');
 171         }
 172
 173         $res = XDB::query('SELECT redirecturl
 174                                        FROM auth_user_quick
 175                                       WHERE user_id = {?}',
 176                                     S::v('uid'));
 177         $page->assign('carva', $res->fetchOneCell());
 178
 179         # FIXME: this code is not multi-domain compatible. We should decide how
 180         # carva will extend to users not in the main domain.
 181         $res = XDB::query("SELECT  alias
 182                              FROM  aliases
 183                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 184                           S::user()->id());
 185         $page->assign('bestalias', $res->fetchOneCell());
 186     }
 187
 188     function handler_prefs_rss(&$page)
 189     {
 190         $page->changeTpl('platal/filrss.tpl');
 191
 192         $page->assign('goback', Env::v('referer', 'login'));
 193
 194         if (Env::v('act_rss') == 'Activer') {
 195             $this->__set_rss_state(true);
 196             $page->trigSuccess("Ton Fil RSS est activé.");
 197         }
 198     }
 199
 200     function handler_password(&$page)
 201     {
 202         global $globals;
 203
 204         if (Post::has('response2'))  {
 205             require_once 'secure_hash.inc.php';
 206             S::assert_xsrf_token();
 207
 208             $_SESSION['password'] = $password = Post::v('response2');
 209
 210             XDB::execute('UPDATE  auth_user_md5
 211                              SET  password={?}
 212                            WHERE  user_id={?}', $password,
 213                            S::v('uid'));
 214
 215             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 216             // updates the Google Apps password as well.
 217             if ($globals->mailstorage->googleapps_domain) {
 218                 require_once 'googleapps.inc.php';
 219                 $account = new GoogleAppsAccount(S::user());
 220                 if ($account->active() && $account->sync_password) {
 221                     $account->set_password($password);
 222                 }
 223             }
 224
 225             S::logger()->log('passwd');
 226             Platal::session()->setAccessCookie(true);
 227
 228             $page->changeTpl('platal/motdepasse.success.tpl');
 229             $page->run();
 230         }
 231
 232         $page->changeTpl('platal/motdepasse.tpl');
 233         $page->addJsLink('motdepasse.js');
 234         $page->setTitle('Mon mot de passe');
 235     }
 236
 237     function handler_smtppass(&$page)
 238     {
 239         $page->changeTpl('platal/acces_smtp.tpl');
 240         $page->setTitle('Acces SMTP/NNTP');
 241
 242         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 243         $wp->buildCache();
 244         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 245         $wp->buildCache();
 246
 247         $uid  = S::v('uid');
 248         $pass = Env::v('smtppass1');
 249         $log  = S::v('log');
 250
 251         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 252         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 253         {
 254             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 255                                      WHERE user_id = {?}', $pass, $uid);
 256             $page->trigSuccess('Mot de passe enregistré');
 257             S::logger()->log("passwd_ssl");
 258         } elseif (Env::v('op') == "Supprimer") {
 259             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 260                                      WHERE user_id = {?}', $uid);
 261             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 262             S::logger()->log("passwd_del");
 263         }
 264
 265         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 266                                        FROM auth_user_md5
 267                                       WHERE user_id = {?}", $uid);
 268         $page->assign('actif', $res->fetchOneCell());
 269     }
 270
 271     function handler_recovery(&$page)
 272     {
 273         global $globals;
 274
 275         $page->changeTpl('platal/recovery.tpl');
 276
 277         if (!Env::has('login') || !Env::has('birth')) {
 278             return;
 279         }
 280
 281         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 282             $page->trigError('Date de naissance incorrecte ou incohérente');
 283             return;
 284         }
 285
 286         $birth   = sprintf('%s-%s-%s',
 287                            substr(Env::v('birth'), 4, 4),
 288                            substr(Env::v('birth'), 2, 2),
 289                            substr(Env::v('birth'), 0, 2));
 290
 291         $mailorg = strtok(Env::v('login'), '@');
 292
 293         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 294         // avec celle fournie ici en espérant que c'est la bonne
 295
 296         $res = XDB::query(
 297                 "SELECT  user_id, naissance
 298                    FROM  auth_user_md5 AS u
 299              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 300                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 301         list($uid, $naissance) = $res->fetchOneRow();
 302
 303         if ($naissance == $birth) {
 304             $res = XDB::query("SELECT  COUNT(*)
 305                                  FROM  emails
 306                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 307             $count = intval($res->fetchOneCell());
 308             if ($count == 0) {
 309                 $page->assign('no_addr', true);
 310                 return;
 311             }
 312
 313             $page->assign('ok', true);
 314
 315             $url   = rand_url_id();
 316             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 317                                VALUES  ({?},{?},NOW())', $url, $uid);
 318             $res   = XDB::query('SELECT  email
 319                                    FROM  emails
 320                                   WHERE  uid = {?} AND email = {?}',
 321                                 $uid, Post::v('email'));
 322             if ($res->numRows()) {
 323                 $mails = $res->fetchOneCell();
 324             } else {
 325                 $user  = User::getSilent($uid);
 326                 $mails = $user->bestEmail();
 327                 $res   = XDB::query("SELECT  email
 328                                        FROM  emails
 329                                       WHERE  uid = {?} AND NOT FIND_IN_SET('filter', flags)
 330                                              AND NOT FIND_IN_SET('active', flags)",
 331                                     $uid);
 332                 if ($res->numRows() > 0) {
 333                     $mails .= ', ' . implode(', ', $res->fetchColumn());
 334                 }
 335             }
 336             $mymail = new PlMailer();
 337             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 338             $mymail->addTo($mails);
 339             $mymail->setSubject('Ton certificat d\'authentification');
 340             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 341 {$globals->baseurl}/tmpPWD/$url
 342
 343 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 344
 345 --
 346 Polytechnique.org
 347 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 348
 349 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 350 Adresse de secours : " . Post::v('email') : ""));
 351             $mymail->send();
 352
 353             // on cree un objet logger et on log l'evenement
 354             S::logger($uid)->log('recovery', $mails);
 355         } else {
 356             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 357                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 358         }
 359     }
 360
 361     function handler_tmpPWD(&$page, $certif = null)
 362     {
 363         global $globals;
 364         XDB::execute('DELETE FROM perte_pass
 365                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 366
 367         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 368         $ligne = $res->fetchOneAssoc();
 369         if (!$ligne) {
 370             $page->changeTpl('platal/index.tpl');
 371             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 372         }
 373
 374         $uid = $ligne["uid"];
 375         if (Post::has('response2')) {
 376             $password = Post::v('response2');
 377             XDB::query('UPDATE  auth_user_md5 SET password={?}
 378                                    WHERE  user_id={?} AND perms IN("admin","user")',
 379                                  $password, $uid);
 380             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 381
 382             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 383             // updates the Google Apps password as well.
 384             if ($globals->mailstorage->googleapps_domain) {
 385                 require_once 'googleapps.inc.php';
 386                 $account = new GoogleAppsAccount(User::getSilent($uid));
 387                 if ($account->active() && $account->sync_password) {
 388                     $account->set_password($password);
 389                 }
 390             }
 391
 392             S::logger($uid)->log("passwd", "");
 393             $page->changeTpl('platal/tmpPWD.success.tpl');
 394         } else {
 395             $page->changeTpl('platal/motdepasse.tpl');
 396             $page->addJsLink('motdepasse.js');
 397         }
 398     }
 399
 400     function handler_skin(&$page)
 401     {
 402         global $globals;
 403
 404         $page->changeTpl('platal/skins.tpl');
 405         $page->setTitle('Skins');
 406
 407         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 408             XDB::execute('UPDATE auth_user_quick
 409                              SET skin={?} WHERE user_id={?}',
 410                          Env::i('newskin'), S::v('uid'));
 411             S::kill('skin');
 412             Platal::session()->setSkin();
 413         }
 414
 415         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 416         $page->assign('skin_id', $res->fetchOneCell());
 417
 418         $sql = "SELECT s.*,auteur,count(*) AS nb
 419                   FROM skins AS s
 420              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 421                  WHERE skin_tpl != '' AND ext != ''
 422               GROUP BY id ORDER BY s.date DESC";
 423         $page->assign('skins', XDB::iterator($sql));
 424     }
 425
 426     function handler_exit(&$page, $level = null)
 427     {
 428         if (S::has('suid')) {
 429             $suid = S::v('suid');
 430             $log  = S::v('log');
 431             S::logger()->log("suid_stop", S::user()->login() . " by " . $suid['hruid']);
 432             Platal::session()->stopSUID();
 433             pl_redirect('admin/user/' . S::user()->login());
 434         }
 435
 436         if ($level == 'forget' || $level == 'forgetall') {
 437             Platal::session()->killAccessCookie();
 438         }
 439
 440         if ($level == 'forgetuid' || $level == 'forgetall') {
 441             Platal::session()->killLoginFormCookies();
 442         }
 443
 444         if (S::logged()) {
 445             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 446             Platal::session()->destroy();
 447         }
 448
 449         if (Get::has('redirect')) {
 450             http_redirect(rawurldecode(Get::v('redirect')));
 451         } else {
 452             $page->changeTpl('platal/exit.tpl');
 453         }
 454     }
 455
 456     function handler_review(&$page, $action = null, $mode = null)
 457     {
 458         // Include X-XRDS-Location response-header for Yadis discovery
 459         global $globals;
 460         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 461
 462         $this->load('review.inc.php');
 463         $dom = 'Review';
 464         if (@$GLOBALS['IS_XNET_SITE']) {
 465             $dom .= 'Xnet';
 466         }
 467         $wp = new PlWikiPage($dom . '.Admin');
 468         $conf = explode('%0a', $wp->getField('text'));
 469         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 470         foreach ($conf as $line) {
 471             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 472             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 473         }
 474         $wiz->apply($page, 'review', $action, $mode);
 475     }
 476 }
 477
 478 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 479 ?>