modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2011 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = preg_split('/,/', $list, -1, PREG_SPLIT_NO_EMPTY);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE, 'user,groups'),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE, 'user'),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP,    'mail'),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE, 'user'),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP,    'user,groups'),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP,    'mail'),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'recovery/ext'      => $this->make_hook('recovery_ext', AUTH_PUBLIC),
  57             'register/ext'      => $this->make_hook('register_ext', AUTH_PUBLIC),
  58             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  59             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  60             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  61         );
  62     }
  63
  64     function handler_index($page)
  65     {
  66         // Include X-XRDS-Location response-header for Yadis discovery
  67         global $globals;
  68         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  69
  70         // Redirect to the suitable page
  71         if (S::logged()) {
  72             pl_redirect('events');
  73         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  74             $this->handler_review($page);
  75         }
  76     }
  77
  78     function handler_cacert($page)
  79     {
  80         pl_cached_content_headers("application/x-x509-ca-cert");
  81         readfile("/etc/ssl/xorgCA/cacert.pem");
  82         exit;
  83     }
  84
  85     function handler_changelog($page, $core = null)
  86     {
  87         $page->changeTpl('platal/changeLog.tpl');
  88
  89         function formatChangeLog($file) {
  90             $clog = pl_entities(file_get_contents($file));
  91             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  92             // url catch only (not all wiki syntax)
  93             $clog = preg_replace(array(
  94                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  95                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  96                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  97               array(
  98                 '<a href="\\0">\\0</a>',
  99                 '\\1<a href="http://www.\\2">www.\\2</a>',
 100                 '<a href="mailto:\\0">\\0</a>'),
 101               $clog);
 102             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 103             $clog = preg_replace('!vim:.*$!', '', $clog);
 104             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 105         }
 106         if ($core != 'core') {
 107             $page->assign('core', false);
 108             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 109         } else {
 110             $page->assign('core', true);
 111             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 112         }
 113     }
 114
 115     function __set_rss_state($state)
 116     {
 117         if ($state) {
 118             if (!S::user()->token) {
 119                 S::user()->token = rand_url_id(16);
 120                 S::set('token', S::user()->token);
 121                 XDB::execute('UPDATE  accounts
 122                                  SET  token = {?}
 123                                WHERE  uid = {?}', S::user()->token, S::i('uid'));
 124             }
 125         } else {
 126             S::kill('token');
 127             S::user()->token = null;
 128             XDB::execute('UPDATE  accounts
 129                              SET  token = NULL
 130                            WHERE  uid = {?}', S::i('uid'));
 131         }
 132     }
 133
 134     function handler_prefs($page)
 135     {
 136         $page->changeTpl('platal/preferences.tpl');
 137         $page->setTitle('Mes préférences');
 138
 139         if (Post::has('email_format')) {
 140             S::assert_xsrf_token();
 141             $fmt = Post::s('email_format');
 142             S::user()->setEmailFormat($fmt);
 143         }
 144
 145         if (Post::has('rss')) {
 146             S::assert_xsrf_token();
 147             $this->__set_rss_state(Post::s('rss') == 'on');
 148         }
 149     }
 150
 151     function handler_webredir($page)
 152     {
 153         $page->changeTpl('platal/webredirect.tpl');
 154         $page->setTitle('Redirection de page WEB');
 155
 156         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 157             if (Env::blank('url')) {
 158                 $page->trigError('URL invalide');
 159             } else {
 160                 $url = Env::t('url');
 161                 XDB::execute('INSERT INTO  carvas (uid, url)
 162                                    VALUES  ({?}, {?})
 163                   ON DUPLICATE KEY UPDATE  url = VALUES(url)',
 164                              S::i('uid'), $url);
 165                 S::logger()->log('carva_add', 'http://' . $url);
 166                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 167             }
 168         } elseif (Env::v('submit') == 'Supprimer') {
 169             XDB::execute('DELETE FROM carvas
 170                                 WHERE uid = {?}', S::i('uid'));
 171             Post::kill('url');
 172             S::logger()->log('carva_del');
 173             $page->trigSuccess('Redirection supprimée');
 174         }
 175
 176         $url = XDB::fetchOneCell('SELECT  url
 177                                     FROM  carvas
 178                                    WHERE  uid = {?}', S::i('uid'));
 179         $page->assign('carva', $url);
 180
 181         # FIXME: this code is not multi-domain compatible. We should decide how
 182         # carva will extend to users not in the main domain.
 183         $best = XDB::fetchOneCell('SELECT  email
 184                                      FROM  email_source_account
 185                                     WHERE  uid = {?} AND FIND_IN_SET(\'bestalias\', flags)',
 186                                   S::user()->id());
 187         $page->assign('bestalias', $best);
 188     }
 189
 190     function handler_prefs_rss($page)
 191     {
 192         $page->changeTpl('platal/filrss.tpl');
 193
 194         $page->assign('goback', Env::v('referer', 'login'));
 195
 196         if (Env::v('act_rss') == 'Activer') {
 197             $this->__set_rss_state(true);
 198             $page->trigSuccess("Ton Fil RSS est activé.");
 199         }
 200     }
 201
 202     function handler_password($page)
 203     {
 204         global $globals;
 205
 206         if (Post::has('pwhash') && Post::t('pwhash'))  {
 207             S::assert_xsrf_token();
 208
 209             S::set('password', $password = Post::t('pwhash'));
 210             XDB::execute('UPDATE  accounts
 211                              SET  password = {?}
 212                            WHERE  uid={?}', $password,
 213                          S::i('uid'));
 214
 215             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 216             // updates the Google Apps password as well.
 217             if ($globals->mailstorage->googleapps_domain) {
 218                 require_once 'googleapps.inc.php';
 219                 $account = new GoogleAppsAccount(S::user());
 220                 if ($account->active() && $account->sync_password) {
 221                     $account->set_password($password);
 222                 }
 223             }
 224
 225             S::logger()->log('passwd');
 226             Platal::session()->setAccessCookie(true);
 227
 228             $page->changeTpl('platal/password.success.tpl');
 229             $page->run();
 230         }
 231
 232         $page->changeTpl('platal/password.tpl');
 233         $page->setTitle('Mon mot de passe');
 234         $page->assign('do_auth', 0);
 235     }
 236
 237     function handler_smtppass($page)
 238     {
 239         $page->changeTpl('platal/acces_smtp.tpl');
 240         $page->setTitle('Acces SMTP/NNTP');
 241
 242         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 243         $wp->buildCache();
 244         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 245         $wp->buildCache();
 246
 247         $uid  = S::i('uid');
 248         $pass = Env::v('smtppass1');
 249
 250         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 251             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 252             XDB::execute('UPDATE  accounts
 253                              SET  weak_password = {?}
 254                            WHERE  uid = {?}', $pass, $uid);
 255             $page->trigSuccess('Mot de passe enregistré');
 256             S::logger()->log("passwd_ssl");
 257         } elseif (Env::v('op') == "Supprimer") {
 258             XDB::execute('UPDATE  accounts
 259                              SET  weak_password = NULL
 260                            WHERE  uid = {?}', $uid);
 261             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 262             S::logger()->log("passwd_del");
 263         }
 264
 265         $res = XDB::query("SELECT  weak_password IS NOT NULL
 266                              FROM  accounts
 267                             WHERE  uid = {?}", $uid);
 268         $page->assign('actif', $res->fetchOneCell());
 269     }
 270
 271     function handler_recovery($page)
 272     {
 273         global $globals;
 274
 275         $page->changeTpl('platal/recovery.tpl');
 276
 277         if (!Env::has('login') || !Env::has('birth')) {
 278             return;
 279         }
 280
 281         if (!preg_match('/^[0-3][0-9][0-1][0-9][1][9]([0-9]{2})$/', Env::v('birth'))) {
 282             $page->trigError('Date de naissance incorrecte ou incohérente');
 283             return;
 284         }
 285
 286         $birth   = sprintf('%s-%s-%s',
 287                            substr(Env::v('birth'), 4, 4),
 288                            substr(Env::v('birth'), 2, 2),
 289                            substr(Env::v('birth'), 0, 2));
 290
 291         $mailorg = strtok(Env::v('login'), '@');
 292
 293         $profile = Profile::get(Env::t('login'));
 294         if (is_null($profile) || $profile->birthdate != $birth) {
 295             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 296                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 297             return;
 298         }
 299
 300         $user = $profile->owner();
 301         if ($user->state != 'active') {
 302             $page->trigError('Ton compte n\'est pas activé.');
 303             return;
 304         }
 305
 306         if ($user->lost) {
 307             $page->assign('no_addr', true);
 308             return;
 309         }
 310
 311         $page->assign('ok', true);
 312
 313         $url = rand_url_id();
 314         XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
 315                            VALUES  ({?},{?},NOW())', $url, $user->id());
 316         $to = XDB::fetchOneCell('SELECT  redirect
 317                                    FROM  email_redirect_account
 318                                   WHERE  uid = {?} AND redirect = {?}',
 319                                 $user->id(), Post::t('email'));
 320         if (is_null($to)) {
 321             $emails = XDB::fetchColumn('SELECT  redirect
 322                                           FROM  email_redirect_account
 323                                          WHERE  uid = {?} AND flags = \'inactive\' AND type = \'smtp\'',
 324                                        $user->id());
 325             $inactives_to = implode(', ', $emails);
 326         }
 327         $mymail = new PlMailer();
 328         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 329         if (is_null($to)) {
 330             $mymail->addTo($user);
 331             $mymail->addTo($inactives_to);
 332         } else {
 333             $mymail->addTo($to);
 334         }
 335         $mymail->setSubject("Ton certificat d'authentification");
 336         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 337 {$globals->baseurl}/tmpPWD/$url
 338
 339 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 340
 341 --
 342 Polytechnique.org
 343 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 344
 345 Email envoyé à ".Env::v('login') . (is_null($to) ? '' : '
 346 Adresse de secours : ' . $to));
 347         $mymail->send();
 348
 349         S::logger($user->id())->log('recovery', is_null($to) ? $inactives_to . ', ' . $user->bestEmail() : $to);
 350     }
 351
 352     function handler_recovery_ext($page)
 353     {
 354         $page->changeTpl('xnet/recovery.tpl');
 355
 356         if (!Post::has('login')) {
 357             return;
 358         }
 359
 360         $user = User::getSilent(Post::t('login'));
 361         if (is_null($user)) {
 362             $page->trigError('Le compte n\'existe pas.');
 363             return;
 364         }
 365         if ($user->state != 'active') {
 366             $page->trigError('Ton compte n\'est pas activé.');
 367             return;
 368         }
 369
 370         $page->assign('ok', true);
 371
 372         $hash = rand_url_id();
 373         XDB::execute('INSERT INTO  account_lost_passwords (uid, created, certificat)
 374                            VALUES  ({?}, NOW(), {?})',
 375                      $user->id(), $hash);
 376
 377         $mymail = new PlMailer();
 378         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . Platal::globals()->mail->domain . '>');
 379         $mymail->addTo($user);
 380         $mymail->setSubject("Votre certificat d'authentification");
 381         $mymail->setTxtBody("Visitez la page suivante qui expire dans six heures :
 382 https://www.polytechnique.org/tmpPWD/$hash
 383
 384 Si en cliquant dessus vous n'y arrivez pas, copiez intégralement l'adresse dans la barre de votre navigateur. Si vous n'avez pas utilisé ce lien dans six heures, vous pouvez tout simplement recommencer cette procédure.
 385
 386 --
 387 Polytechnique.org
 388 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 389
 390 Email envoyé à " . Post::t('login'));
 391         $mymail->send();
 392
 393         S::logger($user->id())->log('recovery', $user->bestEmail());
 394     }
 395
 396     function handler_tmpPWD($page, $certif = null)
 397     {
 398         global $globals;
 399         XDB::execute('DELETE FROM  account_lost_passwords
 400                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 401
 402         $res = XDB::query('SELECT  uid
 403                              FROM  account_lost_passwords WHERE certificat={?}', $certif);
 404         $ligne = $res->fetchOneAssoc();
 405         if (!$ligne) {
 406             $page->changeTpl('platal/index.tpl');
 407             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 408         }
 409
 410         $uid = $ligne["uid"];
 411         if (Post::has('pwhash') && Post::t('pwhash')) {
 412             $password = Post::t('pwhash');
 413             XDB::query('UPDATE  accounts
 414                            SET  password={?}
 415                          WHERE  uid = {?} AND state = \'active\'',
 416                        $password, $uid);
 417             XDB::query('DELETE FROM  account_lost_passwords
 418                               WHERE  certificat={?}', $certif);
 419
 420             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 421             // updates the Google Apps password as well.
 422             if ($globals->mailstorage->googleapps_domain) {
 423                 require_once 'googleapps.inc.php';
 424                 $account = new GoogleAppsAccount(User::getSilent($uid));
 425                 if ($account->active() && $account->sync_password) {
 426                     $account->set_password($password);
 427                 }
 428             }
 429
 430             S::logger($uid)->log("passwd", "");
 431
 432             // Try to start a session (so the user don't have to log in); we will use
 433             // the password available in Post:: to authenticate the user.
 434             Platal::session()->start(AUTH_MDP);
 435
 436             $page->changeTpl('platal/tmpPWD.success.tpl');
 437         } else {
 438             $hruid = XDB::fetchOneCell('SELECT  hruid
 439                                           FROM  accounts
 440                                          WHERE  uid = {?}',
 441                                        $uid);
 442             $page->changeTpl('platal/password.tpl');
 443             $page->assign('hruid', $hruid);
 444             $page->assign('do_auth', 1);
 445         }
 446     }
 447
 448     function handler_register_ext($page, $hash = null)
 449     {
 450         XDB::execute('DELETE FROM  register_pending_xnet
 451                             WHERE  DATE_SUB(NOW(), INTERVAL 1 MONTH) > date');
 452         $res = XDB::fetchOneAssoc('SELECT  uid, hruid
 453                                      FROM  register_pending_xnet
 454                                     WHERE  hash = {?}',
 455                                   $hash);
 456
 457         if (is_null($hash) || is_null($res)) {
 458             $page->trigErrorRedirect('Cette adresse n\'existe pas ou n\'existe plus sur le serveur.', '');
 459         }
 460
 461         if (Post::has('pwhash') && Post::t('pwhash')) {
 462             XDB::query('UPDATE  accounts
 463                            SET  password = {?}, state = \'active\', registration_date = NOW()
 464                          WHERE  uid = {?} AND state = \'pending\' AND type = \'xnet\'',
 465                        Post::t('pwhash'), $res['uid']);
 466             XDB::query('DELETE FROM  register_pending_xnet
 467                               WHERE  uid = {?}',
 468                        $res['uid']);
 469
 470             S::logger($res['uid'])->log('passwd', '');
 471
 472             // Try to start a session (so the user don't have to log in); we will use
 473             // the password available in Post:: to authenticate the user.
 474             Post::kill('wait');
 475             Platal::session()->startAvailableAuth();
 476
 477             $page->changeTpl('xnet/register.success.tpl');
 478             $page->assign('email', $res['email']);
 479         } else {
 480             $page->changeTpl('platal/password.tpl');
 481             $page->assign('xnet', true);
 482             $page->assign('hruid', $res['hruid']);
 483             $page->assign('do_auth', 1);
 484         }
 485     }
 486
 487     function handler_skin($page)
 488     {
 489         global $globals;
 490
 491         $page->changeTpl('platal/skins.tpl');
 492         $page->setTitle('Skins');
 493
 494         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 495             XDB::execute('UPDATE  accounts
 496                              SET  skin = {?}
 497                            WHERE  uid = {?}',
 498                          Env::i('newskin'), S::i('uid'));
 499             S::kill('skin');
 500             Platal::session()->setSkin();
 501         }
 502
 503         $res = XDB::query('SELECT  id
 504                              FROM  skins
 505                             WHERE  skin_tpl = {?}', S::v('skin'));
 506         $page->assign('skin_id', $res->fetchOneCell());
 507
 508         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 509                   FROM  skins AS s
 510              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 511                  WHERE  skin_tpl != \'\' AND ext != \'\'
 512               GROUP BY  id ORDER BY s.date DESC';
 513         $page->assign('skins', XDB::iterator($sql));
 514     }
 515
 516     function handler_exit($page, $level = null)
 517     {
 518         if (S::suid()) {
 519             $old = S::user()->login();
 520             S::logger()->log('suid_stop', $old . " by " . S::suid('hruid'));
 521             Platal::session()->stopSUID();
 522             $target = S::s('suid_startpage');
 523             S::kill('suid_startpage');
 524             if (!empty($target)) {
 525                 http_redirect($target);
 526             }
 527             pl_redirect('admin/user/' . $old);
 528         }
 529
 530         if ($level == 'forget' || $level == 'forgetall') {
 531             Platal::session()->killAccessCookie();
 532         }
 533
 534         if ($level == 'forgetuid' || $level == 'forgetall') {
 535             Platal::session()->killLoginFormCookies();
 536         }
 537
 538         if (S::logged()) {
 539             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 540             Platal::session()->destroy();
 541         }
 542
 543         if (Get::has('redirect')) {
 544             http_redirect(rawurldecode(Get::v('redirect')));
 545         } else {
 546             $page->changeTpl('platal/exit.tpl');
 547         }
 548     }
 549
 550     function handler_review($page, $action = null, $mode = null)
 551     {
 552         // Include X-XRDS-Location response-header for Yadis discovery
 553         global $globals;
 554         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 555
 556         $this->load('review.inc.php');
 557         $dom = 'Review';
 558         if (@$GLOBALS['IS_XNET_SITE']) {
 559             $dom .= 'Xnet';
 560         }
 561         $wp = new PlWikiPage($dom . '.Admin');
 562         $conf = explode('%0a', $wp->getField('text'));
 563         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 564         foreach ($conf as $line) {
 565             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 566             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 567         }
 568         $wiz->apply($page, 'review', $action, $mode);
 569     }
 570 }
 571
 572 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 573 ?>