modules/platal.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 function bugize($list)
  23 {
  24     $list = split(',', $list);
  25     $ans  = array();
  26
  27     foreach ($list as $bug) {
  28         $clean = str_replace('#', '', $bug);
  29         $ans[] = "<a href='http://trackers.polytechnique.org/task/$clean'>$bug</a>";
  30     }
  31
  32     return join(',', $ans);
  33 }
  34
  35
  36 class PlatalModule extends PLModule
  37 {
  38     function handlers()
  39     {
  40         return array(
  41             'index'       => $this->make_hook('index',     AUTH_PUBLIC),
  42             'cacert.pem'  => $this->make_hook('cacert',    AUTH_PUBLIC),
  43             'changelog'   => $this->make_hook('changelog', AUTH_PUBLIC),
  44
  45             // Preferences thingies
  46             'prefs'       => $this->make_hook('prefs',     AUTH_COOKIE),
  47             'prefs/rss'   => $this->make_hook('prefs_rss', AUTH_COOKIE),
  48             'prefs/webredirect'
  49                           => $this->make_hook('webredir',  AUTH_MDP),
  50             'prefs/skin'  => $this->make_hook('skin',      AUTH_COOKIE),
  51
  52             // password related thingies
  53             'password'      => $this->make_hook('password',  AUTH_MDP),
  54             'tmpPWD'        => $this->make_hook('tmpPWD',    AUTH_PUBLIC),
  55             'password/smtp' => $this->make_hook('smtppass',  AUTH_MDP),
  56             'recovery'      => $this->make_hook('recovery',  AUTH_PUBLIC),
  57             'exit'          => $this->make_hook('exit', AUTH_PUBLIC),
  58             'review'        => $this->make_hook('review', AUTH_PUBLIC),
  59             'deconnexion.php' => $this->make_hook('exit', AUTH_PUBLIC),
  60         );
  61     }
  62
  63     function handler_index(&$page)
  64     {
  65         // Include X-XRDS-Location response-header for Yadis discovery
  66         global $globals;
  67         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
  68
  69         // Redirect to the suitable page
  70         if (S::logged()) {
  71             pl_redirect('events');
  72         } else if (!@$GLOBALS['IS_XNET_SITE']) {
  73             pl_redirect('review');
  74         }
  75     }
  76
  77     function handler_cacert(&$page)
  78     {
  79         $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
  80         header("Pragma:");
  81         header("Set-Cookie:");
  82         header("Cache-Control:");
  83         header("Expires:");
  84         header("Content-Type: application/x-x509-ca-cert");
  85         header("Content-Length: ".strlen($data));
  86         echo $data;
  87         exit;
  88     }
  89
  90     function handler_changelog(&$page)
  91     {
  92         $page->changeTpl('platal/changeLog.tpl');
  93
  94         $clog = pl_entities(file_get_contents(dirname(__FILE__).'/../ChangeLog'));
  95         $clog = preg_replace('/===+\s*/', '</pre><hr /><pre>', $clog);
  96         // url catch only (not all wiki syntax)
  97         $clog = preg_replace(array(
  98             '/((?:https?|ftp):\/\/(?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/ui',
  99             '/(\s|^)www\.((?:\.*,*[\w@~%$£µ&i#\-+=_\/\?;])*)/iu',
 100             '/(?:mailto:)?([a-z0-9.\-+_]+@([\-.+_]?[a-z0-9])+)/i'),
 101           array(
 102             '<a href="\\0">\\0</a>',
 103             '\\1<a href="http://www.\\2">www.\\2</a>',
 104             '<a href="mailto:\\0">\\0</a>'),
 105           $clog);
 106         $clog = preg_replace('!(#[0-9]+(,[0-9]+)*)!e', 'bugize("\1")', $clog);
 107         $clog = preg_replace('!vim:.*$!', '', $clog);
 108         $clog = preg_replace("!(<hr />(\\s|\n)*)?<pre>(\s|\n)*</pre>((\\s|\n)*<hr />)?!m", "", "<pre>$clog</pre>");
 109         $page->assign('ChangeLog', $clog);
 110     }
 111
 112     function __set_rss_state($state)
 113     {
 114         if ($state) {
 115             $_SESSION['core_rss_hash'] = rand_url_id(16);
 116             XDB::execute('UPDATE  auth_user_quick
 117                                    SET  core_rss_hash={?} WHERE user_id={?}',
 118                                    S::v('core_rss_hash'), S::v('uid'));
 119         } else {
 120             XDB::execute('UPDATE  auth_user_quick
 121                                    SET  core_rss_hash="" WHERE user_id={?}',
 122                                    S::v('uid'));
 123             S::kill('core_rss_hash');
 124         }
 125     }
 126
 127     function handler_prefs(&$page)
 128     {
 129         $page->changeTpl('platal/preferences.tpl');
 130         $page->setTitle('Mes préférences');
 131
 132         if (Post::has('mail_fmt')) {
 133             $fmt = Post::v('mail_fmt');
 134             if ($fmt != 'texte') $fmt = 'html';
 135             XDB::execute("UPDATE auth_user_quick
 136                                        SET core_mail_fmt = '$fmt'
 137                                      WHERE user_id = {?}",
 138                                      S::v('uid'));
 139             $_SESSION['mail_fmt'] = $fmt;
 140         }
 141
 142         if (Post::has('rss')) {
 143             $this->__set_rss_state(Post::b('rss'));
 144         }
 145
 146         # FIXME: this code is not multi-domain compatible. We should decide how
 147         # carva will extend to users not in the main domain.
 148         $res = XDB::query("SELECT  alias
 149                              FROM  aliases
 150                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 151                           S::user()->id());
 152         $page->assign('bestalias', $res->fetchOneCell());
 153     }
 154
 155     function handler_webredir(&$page)
 156     {
 157         $page->changeTpl('platal/webredirect.tpl');
 158
 159         $page->setTitle('Redirection de page WEB');
 160
 161         $log =& S::v('log');
 162         $url = Env::v('url');
 163
 164         if (Env::v('submit') == 'Valider' and Env::has('url')) {
 165             XDB::execute('UPDATE auth_user_quick
 166                                        SET redirecturl = {?} WHERE user_id = {?}',
 167                                    $url, S::v('uid'));
 168             S::logger()->log('carva_add', 'http://'.Env::v('url'));
 169             $page->trigSuccess("Redirection activée vers <a href='http://$url'>$url</a>");
 170         } elseif (Env::v('submit') == "Supprimer") {
 171             XDB::execute("UPDATE auth_user_quick
 172                                        SET redirecturl = ''
 173                                      WHERE user_id = {?}",
 174                                    S::v('uid'));
 175             S::logger()->log("carva_del", $url);
 176             Post::kill('url');
 177             $page->trigSuccess('Redirection supprimée');
 178         }
 179
 180         $res = XDB::query('SELECT redirecturl
 181                                        FROM auth_user_quick
 182                                       WHERE user_id = {?}',
 183                                     S::v('uid'));
 184         $page->assign('carva', $res->fetchOneCell());
 185
 186         # FIXME: this code is not multi-domain compatible. We should decide how
 187         # carva will extend to users not in the main domain.
 188         $res = XDB::query("SELECT  alias
 189                              FROM  aliases
 190                             WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
 191                           S::user()->id());
 192         $page->assign('bestalias', $res->fetchOneCell());
 193     }
 194
 195     function handler_prefs_rss(&$page)
 196     {
 197         $page->changeTpl('platal/filrss.tpl');
 198
 199         $page->assign('goback', Env::v('referer', 'login'));
 200
 201         if (Env::v('act_rss') == 'Activer') {
 202             $this->__set_rss_state(true);
 203             $page->trigSuccess("Ton Fil RSS est activé.");
 204         }
 205     }
 206
 207     function handler_password(&$page)
 208     {
 209         global $globals;
 210
 211         if (Post::has('response2'))  {
 212             S::assert_xsrf_token();
 213
 214             $_SESSION['password'] = $password = Post::v('response2');
 215
 216             XDB::execute('UPDATE  auth_user_md5
 217                              SET  password={?}
 218                            WHERE  user_id={?}', $password,
 219                            S::v('uid'));
 220
 221             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 222             // updates the Google Apps password as well.
 223             if ($globals->mailstorage->googleapps_domain) {
 224                 require_once 'googleapps.inc.php';
 225                 $account = new GoogleAppsAccount(S::user());
 226                 if ($account->active() && $account->sync_password) {
 227                     $account->set_password($password);
 228                 }
 229             }
 230
 231             $log =& S::v('log');
 232             S::logger()->log('passwd', '');
 233
 234             if (Cookie::v('ORGaccess')) {
 235                 setcookie('ORGaccess', sha1($password), (time()+25920000), '/', '' ,0);
 236             }
 237
 238             $page->changeTpl('platal/motdepasse.success.tpl');
 239             $page->run();
 240         }
 241
 242         $page->changeTpl('platal/motdepasse.tpl');
 243         $page->addJsLink('motdepasse.js');
 244         $page->setTitle('Mon mot de passe');
 245     }
 246
 247     function handler_smtppass(&$page)
 248     {
 249         $page->changeTpl('platal/acces_smtp.tpl');
 250         $page->setTitle('Acces SMTP/NNTP');
 251
 252         $wp = new PlWikiPage('Xorg.SMTPSécurisé');
 253         $wp->buildCache();
 254         $wp = new PlWikiPage('Xorg.NNTPSécurisé');
 255         $wp->buildCache();
 256
 257         $uid  = S::v('uid');
 258         $pass = Env::v('smtppass1');
 259         $log  = S::v('log');
 260
 261         if (Env::v('op') == "Valider" && strlen($pass) >= 6
 262         &&  Env::v('smtppass1') == Env::v('smtppass2'))
 263         {
 264             XDB::execute('UPDATE auth_user_md5 SET smtppass = {?}
 265                                      WHERE user_id = {?}', $pass, $uid);
 266             $page->trigSuccess('Mot de passe enregistré');
 267             S::logger()->log("passwd_ssl");
 268         } elseif (Env::v('op') == "Supprimer") {
 269             XDB::execute('UPDATE auth_user_md5 SET smtppass = ""
 270                                      WHERE user_id = {?}', $uid);
 271             $page->trigSuccess('Compte SMTP et NNTP supprimé');
 272             S::logger()->log("passwd_del");
 273         }
 274
 275         $res = XDB::query("SELECT IF(smtppass != '', 'actif', '')
 276                                        FROM auth_user_md5
 277                                       WHERE user_id = {?}", $uid);
 278         $page->assign('actif', $res->fetchOneCell());
 279     }
 280
 281     function handler_recovery(&$page)
 282     {
 283         global $globals;
 284
 285         $page->changeTpl('platal/recovery.tpl');
 286
 287         if (!Env::has('login') || !Env::has('birth')) {
 288             return;
 289         }
 290
 291         if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
 292             $page->trigError('Date de naissance incorrecte ou incohérente');
 293             return;
 294         }
 295
 296         $birth   = sprintf('%s-%s-%s',
 297                            substr(Env::v('birth'), 4, 4),
 298                            substr(Env::v('birth'), 2, 2),
 299                            substr(Env::v('birth'), 0, 2));
 300
 301         $mailorg = strtok(Env::v('login'), '@');
 302
 303         // paragraphe rajouté : si la date de naissance dans la base n'existe pas, on l'update
 304         // avec celle fournie ici en espérant que c'est la bonne
 305
 306         $res = XDB::query(
 307                 "SELECT  user_id, naissance
 308                    FROM  auth_user_md5 AS u
 309              INNER JOIN  aliases       AS a ON (u.user_id=a.id AND type != 'homonyme')
 310                   WHERE  a.alias={?} AND u.perms IN ('admin','user') AND u.deces=0", $mailorg);
 311         list($uid, $naissance) = $res->fetchOneRow();
 312
 313         if ($naissance == $birth) {
 314             $res = XDB::query("SELECT  COUNT(*)
 315                                  FROM  emails
 316                                 WHERE  uid = {?} AND flags != 'panne' AND flags != 'filter'", $uid);
 317             $count = intval($res->fetchOneCell());
 318             if ($count == 0) {
 319                 $page->assign('no_addr', true);
 320                 return;
 321             }
 322
 323             $page->assign('ok', true);
 324
 325             $url   = rand_url_id();
 326             XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
 327                                VALUES  ({?},{?},NOW())', $url, $uid);
 328             $res   = XDB::query('SELECT  email
 329                                    FROM  emails
 330                                   WHERE  uid = {?} AND email = {?}',
 331                                 $uid, Post::v('email'));
 332             if ($res->numRows()) {
 333                 $mails = $res->fetchOneCell();
 334             } else {
 335                 $res   = XDB::query('SELECT  email
 336                                        FROM  emails
 337                                       WHERE  uid = {?} AND NOT FIND_IN_SET("filter", flags)', $uid);
 338                 $mails = implode(', ', $res->fetchColumn());
 339             }
 340             $mymail = new PlMailer();
 341             $mymail->setFrom('"Gestion des mots de passe" <support+password@' . $globals->mail->domain . '>');
 342             $mymail->addTo($mails);
 343             $mymail->setSubject('Ton certificat d\'authentification');
 344             $mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
 345 {$globals->baseurl}/tmpPWD/$url
 346
 347 Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la barre de ton navigateur. Si tu n'as pas utilisé ce lien dans six heures, tu peux tout simplement recommencer cette procédure.
 348
 349 --
 350 Polytechnique.org
 351 \"Le portail des élèves & anciens élèves de l'Ecole polytechnique\"
 352
 353 Email envoyé à ".Env::v('login') . (Post::has('email') ? "
 354 Adresse de secours : " . Post::v('email') : ""));
 355             $mymail->send();
 356
 357             // on cree un objet logger et on log l'evenement
 358             $logger = $_SESSION['log'] = new PlLogger($uid);
 359             S::logger()->log('recovery', $mails);
 360         } else {
 361             $page->trigError('Les informations que tu as rentrées ne permettent pas de récupérer ton mot de passe.<br />'.
 362                         'Si tu as un homonyme, utilise prenom.nom.promo comme login');
 363         }
 364     }
 365
 366     function handler_tmpPWD(&$page, $certif = null)
 367     {
 368         global $globals;
 369         XDB::execute('DELETE FROM perte_pass
 370                                       WHERE DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 371
 372         $res   = XDB::query('SELECT uid FROM perte_pass WHERE certificat={?}', $certif);
 373         $ligne = $res->fetchOneAssoc();
 374         if (!$ligne) {
 375             $page->changeTpl('platal/index.tpl');
 376             $page->kill("Cette adresse n'existe pas ou n'existe plus sur le serveur.");
 377         }
 378
 379         $uid = $ligne["uid"];
 380         if (Post::has('response2')) {
 381             $password = Post::v('response2');
 382             XDB::query('UPDATE  auth_user_md5 SET password={?}
 383                                    WHERE  user_id={?} AND perms IN("admin","user")',
 384                                  $password, $uid);
 385             XDB::query('DELETE FROM perte_pass WHERE certificat={?}', $certif);
 386
 387             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
 388             // updates the Google Apps password as well.
 389             if ($globals->mailstorage->googleapps_domain) {
 390                 require_once 'googleapps.inc.php';
 391                 $account = new GoogleAppsAccount(User::getSilent($uid));
 392                 if ($account->active() && $account->sync_password) {
 393                     $account->set_password($password);
 394                 }
 395             }
 396
 397             $logger = new PlLogger($uid);
 398             S::logger()->log("passwd","");
 399             $page->changeTpl('platal/tmpPWD.success.tpl');
 400         } else {
 401             $page->changeTpl('platal/motdepasse.tpl');
 402             $page->addJsLink('motdepasse.js');
 403         }
 404     }
 405
 406     function handler_skin(&$page)
 407     {
 408         global $globals;
 409
 410         $page->changeTpl('platal/skins.tpl');
 411         $page->setTitle('Skins');
 412
 413         if (Env::has('newskin'))  {  // formulaire soumis, traitons les données envoyées
 414             XDB::execute('UPDATE auth_user_quick
 415                              SET skin={?} WHERE user_id={?}',
 416                          Env::i('newskin'), S::v('uid'));
 417             S::kill('skin');
 418             Platal::session()->setSkin();
 419         }
 420
 421         $res = XDB::query('SELECT id FROM skins WHERE skin_tpl={?}', S::v('skin'));
 422         $page->assign('skin_id', $res->fetchOneCell());
 423
 424         $sql = "SELECT s.*,auteur,count(*) AS nb
 425                   FROM skins AS s
 426              LEFT JOIN auth_user_quick AS a ON s.id=a.skin
 427                  WHERE skin_tpl != '' AND ext != ''
 428               GROUP BY id ORDER BY s.date DESC";
 429         $page->assign('skins', XDB::iterator($sql));
 430     }
 431
 432     function handler_exit(&$page, $level = null)
 433     {
 434         if (S::has('suid')) {
 435             $suid = S::v('suid');
 436             $log  = S::v('log');
 437             S::logger()->log("suid_stop", S::user()->login() . " by " . $suid['hruid']);
 438             Platal::session()->stopSUID();
 439             pl_redirect('admin/user/' . S::user()->login());
 440         }
 441
 442         if ($level == 'forget' || $level == 'forgetall') {
 443             setcookie('ORGaccess', '', time() - 3600, '/', '', 0);
 444             Cookie::kill('ORGaccess');
 445             if (isset($_SESSION['log']))
 446                 S::logger()->log("cookie_off");
 447         }
 448
 449         if ($level == 'forgetuid' || $level == 'forgetall') {
 450             setcookie('ORGuid', '', time() - 3600, '/', '', 0);
 451             Cookie::kill('ORGuid');
 452             setcookie('ORGdomain', '', time() - 3600, '/', '', 0);
 453             Cookie::kill('ORGdomain');
 454         }
 455
 456         if (isset($_SESSION['log'])) {
 457             $ref = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
 458             S::logger()->log('deconnexion',$ref);
 459         }
 460         Platal::session()->destroy();
 461
 462         if (Get::has('redirect')) {
 463             http_redirect(rawurldecode(Get::v('redirect')));
 464         } else {
 465             $page->changeTpl('platal/exit.tpl');
 466         }
 467     }
 468
 469     function handler_review(&$page, $action = null, $mode = null)
 470     {
 471         // Include X-XRDS-Location response-header for Yadis discovery
 472         global $globals;
 473         header('X-XRDS-Location: ' . $globals->baseurl . '/openid/idp_xrds');
 474
 475         $this->load('review.inc.php');
 476         $dom = 'Review';
 477         if (@$GLOBALS['IS_XNET_SITE']) {
 478             $dom .= 'Xnet';
 479         }
 480         $wp = new PlWikiPage($dom . '.Admin');
 481         $conf = explode('%0a', $wp->getField('text'));
 482         $wiz = new PlWizard('Tour d\'horizon', PlPage::getCoreTpl('plwizard.tpl'), true);
 483         foreach ($conf as $line) {
 484             $list = preg_split('/\s*[*|]\s*/', $line, -1, PREG_SPLIT_NO_EMPTY);
 485             $wiz->addPage('ReviewPage', $list[0], $list[1]);
 486         }
 487         $wiz->apply($page, 'review', $action, $mode);
 488     }
 489 }
 490
 491 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 492 ?>