modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2011 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = preg_split('/,/', $list, -1, PREG_SPLIT_NO_EMPTY);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'             => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'        => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'         => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'             => $this->make_hook('prefs',     AUTH_COOKIE, 'user,groups'),
  47             'prefs/rss'         => $this->make_hook('prefs_rss', AUTH_COOKIE, 'user'),
  48             'prefs/webredirect' => $this->make_hook('webredir',  AUTH_MDP,    'mail'),
  49             'prefs/skin'        => $this->make_hook('skin',      AUTH_COOKIE, 'user'),
  50
  51             // password related thingies
  52             'password'          => $this->make_hook('password',  AUTH_MDP,    'user,groups'),
  53             'tmpPWD'            => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  54             'password/smtp'     => $this->make_hook('smtppass',  AUTH_MDP,    'mail'),
  55             'recovery'          => $this->make_hook('recovery',  AUTH_PUBLIC),
  56             'recovery/ext'      => $this->make_hook('recovery_ext', AUTH_PUBLIC),
  57             'register/ext'      => $this->make_hook('register_ext', AUTH_PUBLIC),
  58             'exit'              => $this->make_hook('exit',      AUTH_PUBLIC),
  59             'review'            => $this->make_hook('review',    AUTH_PUBLIC),
  60             'deconnexion.php'   => $this->make_hook('exit',      AUTH_PUBLIC),
  61         );
  62     }
  63
  64     function handler_index($page)
  65     {
  66         // Include X-XRDS-Location response-header for Yadis discovery
  67         global $globals;
  68         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
  69
  70         // Redirect to the suitable page
  71         if (S::logged()) {
  72             pl_redirect('events');
  73         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  74             $this->handler_review($page);
  75         }
  76     }
  77
  78     function handler_cacert($page)
  79     {
  80         pl_cached_content_headers("application/x-x509-ca-cert");
  81         readfile("/etc/ssl/xorgCA/cacert.pem");
  82         exit;
  83     }
  84
  85     function handler_changelog($page, $core = null)
  86     {
  87         $page->changeTpl('platal/changeLog.tpl');
  88
  89         function formatChangeLog($file) {
  90             $clog = pl_entities(file_get_contents($file));
  91             $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  92             // url catch only (not all wiki syntax)
  93             $clog = preg_replace(array(
  94                 '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  95                 '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
  96                 '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
  97               array(
  98                 '<a href="\\0">\\0</a>',
  99                 '\\1<a href="http://www.\\2">www.\\2</a>',
 100                 '<a href="mailto:\\0">\\0</a>'),
 101               $clog);
 102             $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 103             $clog = preg_replace('!vim:.*$!', '', $clog);
 104             return preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 105         }
 106         if ($core != 'core') {
 107             $page->assign('core', false);
 108             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../ChangeLog'));
 109         } else {
 110             $page->assign('core', true);
 111             $page->assign('ChangeLog', formatChangeLog(dirname(__FILE__).'/../core/ChangeLog'));
 112         }
 113     }
 114
 115     function __set_rss_state($state)
 116     {
 117         if ($state) {
 118             if (!S::user()->token) {
 119                 S::user()->token = rand_url_id(16);
 120                 S::set('token', S::user()->token);
 121                 XDB::execute('UPDATE  accounts
 122                                  SET  token = {?}
 123                                WHERE  uid = {?}', S::user()->token, S::i('uid'));
 124             }
 125         } else {
 126             S::kill('token');
 127             S::user()->token = null;
 128             XDB::execute('UPDATE  accounts
 129                              SET  token = NULL
 130                            WHERE  uid = {?}', S::i('uid'));
 131         }
 132     }
 133
 134     function handler_prefs($page)
 135     {
 136         $page->changeTpl('platal/preferences.tpl');
 137         $page->setTitle('Mes préférences');
 138
 139         if (Post::has('email_format')) {
 140             S::assert_xsrf_token();
 141             $fmt = Post::s('email_format');
 142             S::user()->setEmailFormat($fmt);
 143         }
 144
 145         if (Post::has('rss')) {
 146             S::assert_xsrf_token();
 147             $this->__set_rss_state(Post::s('rss') == 'on');
 148         }
 149     }
 150
 151     function handler_webredir($page)
 152     {
 153         $page->changeTpl('platal/webredirect.tpl');
 154         $page->setTitle('Redirection de page WEB');
 155
 156         if (Env::v('submit') == 'Valider' && !Env::blank('url')) {
 157             if (Env::blank('url')) {
 158                 $page->trigError('URL invalide');
 159             } else {
 160                 $url = Env::t('url');
 161                 XDB::execute('INSERT INTO  carvas (uid, url)
 162                                    VALUES  ({?}, {?})
 163                   ON DUPLICATE KEY UPDATE  url = VALUES(url)',
 164                              S::i('uid'), $url);
 165                 S::logger()->log('carva_add', 'http://' . $url);
 166                 $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 167             }
 168         } elseif (Env::v('submit') == 'Supprimer') {
 169             XDB::execute('DELETE FROM carvas
 170                                 WHERE uid = {?}', S::i('uid'));
 171             Post::kill('url');
 172             S::logger()->log('carva_del');
 173             $page->trigSuccess('Redirection supprimée');
 174         }
 175
 176         $url = XDB::fetchOneCell('SELECT  url
 177                                     FROM  carvas
 178                                    WHERE  uid = {?}', S::i('uid'));
 179         $page->assign('carva', $url);
 180
 181         # FIXME: this code is not multi-domain compatible. We should decide how
 182         # carva will extend to users not in the main domain.
 183         $best = XDB::fetchOneCell('SELECT  email
 184                                      FROM  email_source_account
 185                                     WHERE  uid = {?} AND FIND_IN_SET(\'bestalias\', flags)',
 186                                   S::user()->id());
 187         $page->assign('bestalias', $best);
 188     }
 189
 190     function handler_prefs_rss($page)
 191     {
 192         $page->changeTpl('platal/filrss.tpl');
 193
 194         $page->assign('goback', Env::v('referer', 'login'));
 195
 196         if (Env::v('act_rss') == 'Activer') {
 197             $this->__set_rss_state(true);
 198             $page->trigSuccess("Ton Fil RSS est activé.");
 199         }
 200     }
 201
 202     function handler_password($page)
 203     {
 204         global $globals;
 205
 206         if (Post::has('pwhash') && Post::t('pwhash'))  {
 207             S::assert_xsrf_token();
 208
 209             S::set('password', $password = Post::t('pwhash'));
 210             XDB::execute('UPDATE  accounts
 211                              SET  password = {?}
 212                            WHERE  uid={?}', $password,
 213                          S::i('uid'));
 214
 215             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 216             // updates the Google Apps password as well.
 217             if ($globals->mailstorage->googleapps_domain) {
 218                 require_once 'googleapps.inc.php';
 219                 $account = new GoogleAppsAccount(S::user());
 220                 if ($account->active() && $account->sync_password) {
 221                     $account->set_password($password);
 222                 }
 223             }
 224
 225             S::logger()->log('passwd');
 226             Platal::session()->setAccessCookie(true);
 227
 228             $page->changeTpl('platal/password.success.tpl');
 229             $page->run();
 230         }
 231
 232         $page->changeTpl('platal/password.tpl');
 233         $page->setTitle('Mon mot de passe');
 234         $page->assign('do_auth', 0);
 235     }
 236
 237     function handler_smtppass($page)
 238     {
 239         $page->changeTpl('platal/acces_smtp.tpl');
 240         $page->setTitle('Acces SMTP/NNTP');
 241
 242         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 243         $wp->buildCache();
 244         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 245         $wp->buildCache();
 246
 247         $uid  = S::i('uid');
 248         $pass = Env::v('smtppass1');
 249
 250         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 251             &&  Env::v('smtppass1') == Env::v('smtppass2')) {
 252             XDB::execute('UPDATE  accounts
 253                              SET  weak_password = {?}
 254                            WHERE  uid = {?}', $pass, $uid);
 255             $page->trigSuccess('Mot de passe enregistré');
 256             S::logger()->log("passwd_ssl");
 257         } elseif (Env::v('op') == "Supprimer") {
 258             XDB::execute('UPDATE  accounts
 259                              SET  weak_password = NULL
 260                            WHERE  uid = {?}', $uid);
 261             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 262             S::logger()->log("passwd_del");
 263         }
 264
 265         $res = XDB::query("SELECT  weak_password IS NOT NULL
 266                              FROM  accounts
 267                             WHERE  uid = {?}", $uid);
 268         $page->assign('actif', $res->fetchOneCell());
 269     }
 270
 271     function handler_recovery($page)
 272     {
 273         global $globals;
 274
 275         $page->changeTpl('platal/recovery.tpl');
 276
 277         if (!Env::has('login') || !Env::has('birth')) {
 278             return;
 279         }
 280
 281         if (!preg_match('/^[0-3][0-9][0-1][0-9][1][9]([0-9]{2})$/', Env::v('birth'))) {
 282             $page->trigError('Date de naissance incorrecte ou incohérente');
 283             return;
 284         }
 285
 286         $birth   = sprintf('%s-%s-%s',
 287                            substr(Env::v('birth'), 4, 4),
 288                            substr(Env::v('birth'), 2, 2),
 289                            substr(Env::v('birth'), 0, 2));
 290
 291         $mailorg = strtok(Env::v('login'), '@');
 292
 293         $profile = Profile::get(Env::t('login'));
 294         if (is_null($profile) || $profile->birthdate != $birth) {
 295             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 296                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 297             return;
 298         }
 299
 300         $user = $profile->owner();
 301         if ($user->state != 'active') {
 302             $page->trigError('Ton compte n\'est pas activé.');
 303             return;
 304         }
 305
 306         if ($user->lost) {
 307             $page->assign('no_addr', true);
 308             return;
 309         }
 310
 311         $page->assign('ok', true);
 312
 313         $url = rand_url_id();
 314         XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
 315                            VALUES  ({?},{?},NOW())', $url, $user->id());
 316         $to = XDB::fetchOneCell('SELECT  redirect
 317                                    FROM  email_redirect_account
 318                                   WHERE  uid = {?} AND redirect = {?}',
 319                                 $user->id(), Post::t('email'));
 320         if (is_null($to)) {
 321             $emails = XDB::fetchColumn('SELECT  redirect
 322                                           FROM  email_redirect_account
 323                                          WHERE  uid = {?} AND flags = \'inactive\' AND type = \'smtp\'',
 324                                        $user->id());
 325             $inactives_to = implode(', ', $emails);
 326         }
 327         $mymail = new PlMailer();
 328         $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 329         if (is_null($to)) {
 330             $mymail->addTo($user);
 331             $mymail->addTo($inactives_to);
 332         } else {
 333             $mymail->addTo($to);
 334         }
 335         $mymail->setSubject("Ton certificat d'authentification");
 336         $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 337 {$globals->baseurl}/tmpPWD/$url
 338
 339 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 340
 341 --
 342 Polytechnique.org
 343 \"Le portail des élèves & anciens élèves de l'École polytechnique\"
 344
 345 Email envoyé à ".Env::v('login') . (is_null($to) ? '' : '
 346 Adresse de secours : ' . $to));
 347         $mymail->send();
 348
 349         S::logger($user->id())->log('recovery', is_null($to) ? $inactives_to . ', ' . $user->bestEmail() : $to);
 350     }
 351
 352     function handler_recovery_ext($page)
 353     {
 354         $page->changeTpl('xnet/recovery.tpl');
 355
 356         if (!Post::has('login')) {
 357             return;
 358         }
 359
 360         $user = User::getSilent(Post::t('login'));
 361         if (is_null($user)) {
 362             $page->trigError('Le compte n\'existe pas.');
 363             return;
 364         }
 365         if ($user->state != 'active') {
 366             $page->trigError('Ton compte n\'est pas activé.');
 367             return;
 368         }
 369
 370         $page->assign('ok', true);
 371
 372         $hash = rand_url_id();
 373         XDB::execute('INSERT INTO  account_lost_passwords (uid, created, certificat)
 374                            VALUES  ({?}, NOW(), {?})',
 375                      $user->id(), $hash);
 376
 377         $mymail = new PlMailer('platal/password_recovery_xnet.mail.tpl');
 378         $mymail->setTo($user);
 379         $mymail->assign('hash', $hash);
 380         $mymail->assign('email', Post::t('login'));
 381         $mymail->send();
 382
 383         S::logger($user->id())->log('recovery', $user->bestEmail());
 384     }
 385
 386     function handler_tmpPWD($page, $certif = null)
 387     {
 388         global $globals;
 389         XDB::execute('DELETE FROM  account_lost_passwords
 390                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 391
 392         if (Post::has('pwhash') && Post::t('pwhash')) {
 393             $uid = XDB::fetchOneCell('SELECT  uid
 394                                         FROM  accounts
 395                                        WHERE  hruid = {?}',
 396                                      Post::t('username'));
 397             $password = Post::t('pwhash');
 398             XDB::query('UPDATE  accounts
 399                            SET  password = {?}
 400                          WHERE  uid = {?} AND state = \'active\'',
 401                        $password, $uid);
 402             XDB::query('DELETE FROM  account_lost_passwords
 403                               WHERE  certificat = {?}', $certif);
 404
 405             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 406             // updates the Google Apps password as well.
 407             if ($globals->mailstorage->googleapps_domain) {
 408                 require_once 'googleapps.inc.php';
 409                 $account = new GoogleAppsAccount(User::getSilent($uid));
 410                 if ($account->active() && $account->sync_password) {
 411                     $account->set_password($password);
 412                 }
 413             }
 414
 415             S::logger($uid)->log("passwd", "");
 416
 417             // Try to start a session (so the user don't have to log in); we will use
 418             // the password available in Post:: to authenticate the user.
 419             Platal::session()->start(AUTH_MDP);
 420
 421             $page->changeTpl('platal/tmpPWD.success.tpl');
 422         } else {
 423             $res = XDB::query('SELECT  uid
 424                                  FROM  account_lost_passwords
 425                                 WHERE  certificat = {?}', $certif);
 426             $ligne = $res->fetchOneAssoc();
 427             if (!$ligne) {
 428                 $page->changeTpl('platal/index.tpl');
 429                 $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 430             }
 431
 432             $hruid = XDB::fetchOneCell('SELECT  hruid
 433                                           FROM  accounts
 434                                          WHERE  uid = {?}',
 435                                        $ligne['uid']);
 436             $page->changeTpl('platal/password.tpl');
 437             $page->assign('hruid', $hruid);
 438             $page->assign('do_auth', 1);
 439         }
 440     }
 441
 442     function handler_register_ext($page, $hash = null)
 443     {
 444         XDB::execute('DELETE FROM  register_pending_xnet
 445                             WHERE  DATE_SUB(NOW(), INTERVAL 1 MONTH) > date');
 446         $res = XDB::fetchOneAssoc('SELECT  uid, hruid, email
 447                                      FROM  register_pending_xnet
 448                                     WHERE  hash = {?}',
 449                                   $hash);
 450
 451         if (is_null($hash) || is_null($res)) {
 452             $page->trigErrorRedirect('Cette adresse n\'existe pas ou n\'existe plus sur le serveur.', '');
 453         }
 454
 455         if (Post::has('pwhash') && Post::t('pwhash')) {
 456             XDB::startTransaction();
 457             XDB::query('UPDATE  accounts
 458                            SET  password = {?}, state = \'active\', registration_date = NOW()
 459                          WHERE  uid = {?} AND state = \'pending\' AND type = \'xnet\'',
 460                        Post::t('pwhash'), $res['uid']);
 461             XDB::query('DELETE FROM  register_pending_xnet
 462                               WHERE  uid = {?}',
 463                               $res['uid']);
 464             XDB::commit();
 465
 466             S::logger($res['uid'])->log('passwd', '');
 467
 468             // Try to start a session (so the user don't have to log in); we will use
 469             // the password available in Post:: to authenticate the user.
 470             Post::kill('wait');
 471             Platal::session()->startAvailableAuth();
 472
 473             $page->changeTpl('xnet/register.success.tpl');
 474             $page->assign('email', $res['email']);
 475         } else {
 476             $page->changeTpl('platal/password.tpl');
 477             $page->assign('xnet', true);
 478             $page->assign('hruid', $res['hruid']);
 479             $page->assign('do_auth', 1);
 480         }
 481     }
 482
 483     function handler_skin($page)
 484     {
 485         global $globals;
 486
 487         $page->changeTpl('platal/skins.tpl');
 488         $page->setTitle('Skins');
 489
 490         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 491             XDB::execute('UPDATE  accounts
 492                              SET  skin = {?}
 493                            WHERE  uid = {?}',
 494                          Env::i('newskin'), S::i('uid'));
 495             S::kill('skin');
 496             Platal::session()->setSkin();
 497         }
 498
 499         $res = XDB::query('SELECT  id
 500                              FROM  skins
 501                             WHERE  skin_tpl = {?}', S::v('skin'));
 502         $page->assign('skin_id', $res->fetchOneCell());
 503
 504         $sql = 'SELECT  s.*, auteur, COUNT(*) AS nb
 505                   FROM  skins AS s
 506              LEFT JOIN  accounts AS a ON (a.skin = s.id)
 507                  WHERE  skin_tpl != \'\' AND ext != \'\'
 508               GROUP BY  id ORDER BY s.date DESC';
 509         $page->assign('skins', XDB::iterator($sql));
 510     }
 511
 512     function handler_exit($page, $level = null)
 513     {
 514         if (S::suid()) {
 515             $old = S::user()->login();
 516             S::logger()->log('suid_stop', $old . " by " . S::suid('hruid'));
 517             Platal::session()->stopSUID();
 518             $target = S::s('suid_startpage');
 519             S::kill('suid_startpage');
 520             if (!empty($target)) {
 521                 http_redirect($target);
 522             }
 523             pl_redirect('admin/user/' . $old);
 524         }
 525
 526         if ($level == 'forget' || $level == 'forgetall') {
 527             Platal::session()->killAccessCookie();
 528         }
 529
 530         if ($level == 'forgetuid' || $level == 'forgetall') {
 531             Platal::session()->killLoginFormCookies();
 532         }
 533
 534         if (S::logged()) {
 535             S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
 536             Platal::session()->destroy();
 537         }
 538
 539         if (Get::has('redirect')) {
 540             http_redirect(rawurldecode(Get::v('redirect')));
 541         } else {
 542             $page->changeTpl('platal/exit.tpl');
 543         }
 544     }
 545
 546     function handler_review($page, $action = null, $mode = null)
 547     {
 548         // Include X-XRDS-Location response-header for Yadis discovery
 549         global $globals;
 550         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/xrds');
 551
 552         $this->load('review.inc.php');
 553         $dom = 'Review';
 554         if (@$GLOBALS['IS_XNET_SITE']) {
 555             $dom .= 'Xnet';
 556         }
 557         $wp = new PlWikiPage($dom . '.Admin');
 558         $conf = explode('%0a', $wp->getField('text'));
 559         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 560         foreach ($conf as $line) {
 561             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 562             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 563         }
 564         $wiz->apply($page, 'review', $action, $mode);
 565     }
 566 }
 567
 568 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 569 ?>