X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;ds=sidebyside;f=modules%2Fplatal.php;h=715ba789d93ce7285b5bd64adca72e4feaa1e09a;hb=fa0c836f1588c3cff9ae2fa0c68e55bea99158da;hp=9d8c2051cb8f56db6788cb1fecf56af8f7ed6193;hpb=4abb0fe4bcefc73a18891e9768640d8811a09acc;p=platal.git
diff --git a/modules/platal.php b/modules/platal.php
index 9d8c205..715ba78 100644
--- a/modules/platal.php
+++ b/modules/platal.php
@@ -1,6 +1,6 @@
$this->make_hook('prefs', AUTH_COOKIE),
'prefs/rss' => $this->make_hook('prefs_rss', AUTH_COOKIE),
- 'prefs/webredirect' => $this->make_hook('webredir', AUTH_MDP),
+ 'prefs/webredirect' => $this->make_hook('webredir', AUTH_MDP, 'mail'),
'prefs/skin' => $this->make_hook('skin', AUTH_COOKIE),
// password related thingies
'password' => $this->make_hook('password', AUTH_MDP),
'tmpPWD' => $this->make_hook('tmpPWD', AUTH_PUBLIC),
- 'password/smtp' => $this->make_hook('smtppass', AUTH_MDP),
+ 'password/smtp' => $this->make_hook('smtppass', AUTH_MDP, 'mail'),
'recovery' => $this->make_hook('recovery', AUTH_PUBLIC),
'exit' => $this->make_hook('exit', AUTH_PUBLIC),
'review' => $this->make_hook('review', AUTH_PUBLIC),
@@ -59,7 +59,7 @@ class PlatalModule extends PLModule
);
}
- function handler_index(&$page)
+ function handler_index($page)
{
// Include X-XRDS-Location response-header for Yadis discovery
global $globals;
@@ -73,14 +73,14 @@ class PlatalModule extends PLModule
}
}
- function handler_cacert(&$page)
+ function handler_cacert($page)
{
pl_cached_content_headers("application/x-x509-ca-cert");
readfile("/etc/ssl/xorgCA/cacert.pem");
exit;
}
- function handler_changelog(&$page, $core = null)
+ function handler_changelog($page, $core = null)
{
$page->changeTpl('platal/changeLog.tpl');
@@ -113,42 +113,40 @@ class PlatalModule extends PLModule
function __set_rss_state($state)
{
if ($state) {
- S::user()->token = rand_url_id(16);
- XDB::execute('UPDATE accounts
- SET token = {?}
- WHERE uid = {?}', S::user()->token, S::i('uid'));
+ if (!S::user()->token) {
+ S::user()->token = rand_url_id(16);
+ S::set('token', S::user()->token);
+ XDB::execute('UPDATE accounts
+ SET token = {?}
+ WHERE uid = {?}', S::user()->token, S::i('uid'));
+ }
} else {
S::kill('token');
+ S::user()->token = null;
XDB::execute('UPDATE accounts
SET token = NULL
WHERE uid = {?}', S::i('uid'));
}
}
- function handler_prefs(&$page)
+ function handler_prefs($page)
{
$page->changeTpl('platal/preferences.tpl');
$page->setTitle('Mes préférences');
if (Post::has('email_format')) {
+ S::assert_xsrf_token();
$fmt = Post::s('email_format');
S::user()->setEmailFormat($fmt);
}
if (Post::has('rss')) {
- $this->__set_rss_state(Post::b('rss'));
+ S::assert_xsrf_token();
+ $this->__set_rss_state(Post::s('rss') == 'on');
}
-
- # FIXME: this code is not multi-domain compatible. We should decide how
- # carva will extend to users not in the main domain.
- $res = XDB::query("SELECT alias
- FROM aliases
- WHERE uid = {?} AND FIND_IN_SET('bestalias', flags)",
- S::user()->id());
- $page->assign('bestalias', $res->fetchOneCell());
}
- function handler_webredir(&$page)
+ function handler_webredir($page)
{
$page->changeTpl('platal/webredirect.tpl');
$page->setTitle('Redirection de page WEB');
@@ -158,8 +156,9 @@ class PlatalModule extends PLModule
$page->trigError('URL invalide');
} else {
$url = Env::t('url');
- XDB::execute('REPLACE INTO carvas (uid, url)
- VALUES ({?}, {?})',
+ XDB::execute('INSERT INTO carvas (uid, url)
+ VALUES ({?}, {?})
+ ON DUPLICATE KEY UPDATE url = VALUES(url)',
S::i('uid'), $url);
S::logger()->log('carva_add', 'http://' . $url);
$page->trigSuccess("Redirection activée vers $url");
@@ -179,14 +178,14 @@ class PlatalModule extends PLModule
# FIXME: this code is not multi-domain compatible. We should decide how
# carva will extend to users not in the main domain.
- $res = XDB::query("SELECT alias
- FROM aliases
- WHERE uid = {?} AND FIND_IN_SET('bestalias', flags)",
- S::user()->id());
- $page->assign('bestalias', $res->fetchOneCell());
+ $best = XDB::fetchOneCell('SELECT email
+ FROM email_source_account
+ WHERE uid = {?} AND FIND_IN_SET(\'bestalias\', flags)',
+ S::user()->id());
+ $page->assign('bestalias', $best);
}
- function handler_prefs_rss(&$page)
+ function handler_prefs_rss($page)
{
$page->changeTpl('platal/filrss.tpl');
@@ -198,7 +197,7 @@ class PlatalModule extends PLModule
}
}
- function handler_password(&$page)
+ function handler_password($page)
{
global $globals;
@@ -229,11 +228,11 @@ class PlatalModule extends PLModule
}
$page->changeTpl('platal/password.tpl');
- $page->addJsLink('password.js');
$page->setTitle('Mon mot de passe');
+ $page->assign('do_auth', 0);
}
- function handler_smtppass(&$page)
+ function handler_smtppass($page)
{
$page->changeTpl('platal/acces_smtp.tpl');
$page->setTitle('Acces SMTP/NNTP');
@@ -267,7 +266,7 @@ class PlatalModule extends PLModule
$page->assign('actif', $res->fetchOneCell());
}
- function handler_recovery(&$page)
+ function handler_recovery($page)
{
global $globals;
@@ -277,7 +276,7 @@ class PlatalModule extends PLModule
return;
}
- if (!ereg('[0-3][0-9][0-1][0-9][1][9]([0-9]{2})', Env::v('birth'))) {
+ if (!preg_match('/^[0-3][0-9][0-1][0-9][1][9]([0-9]{2})$/', Env::v('birth'))) {
$page->trigError('Date de naissance incorrecte ou incohérente');
return;
}
@@ -302,35 +301,35 @@ class PlatalModule extends PLModule
return;
}
- $res = XDB::query("SELECT COUNT(*)
- FROM emails
- WHERE uid = {?} AND flags != 'panne' AND flags != 'filter'", $user->id());
- $count = intval($res->fetchOneCell());
- if ($count == 0) {
+ if ($user->lost) {
$page->assign('no_addr', true);
return;
}
$page->assign('ok', true);
- $url = rand_url_id();
+ $url = rand_url_id();
XDB::execute('INSERT INTO account_lost_passwords (certificat,uid,created)
VALUES ({?},{?},NOW())', $url, $user->id());
- $res = XDB::query('SELECT email
- FROM emails
- WHERE uid = {?} AND email = {?}',
- $user->id(), Post::v('email'));
- if ($res->numRows()) {
- $mails = $res->fetchOneCell();
- } else {
- $res = XDB::query("SELECT email
- FROM emails
- WHERE uid = {?} AND NOT FIND_IN_SET('filter', flags)", $user->id());
- $mails = implode(', ', $res->fetchColumn());
+ $to = XDB::fetchOneCell('SELECT redirect
+ FROM email_redirect_account
+ WHERE uid = {?} AND redirect = {?}',
+ $user->id(), Post::t('email'));
+ if (is_null($to)) {
+ $emails = XDB::fetchColumn('SELECT redirect
+ FROM email_redirect_account
+ WHERE uid = {?} AND flags = \'inactive\' AND type = \'smtp\'',
+ $user->id());
+ $inactives_to = implode(', ', $emails);
}
$mymail = new PlMailer();
$mymail->setFrom('"Gestion des mots de passe" mail->domain . '>');
- $mymail->addTo($mails);
+ if (is_null($to)) {
+ $mymail->addTo($user);
+ $mymail->addTo($inactives_to);
+ } else {
+ $mymail->addTo($to);
+ }
$mymail->setSubject("Ton certificat d'authentification");
$mymail->setTxtBody("Visite la page suivante qui expire dans six heures :
{$globals->baseurl}/tmpPWD/$url
@@ -341,15 +340,14 @@ Si en cliquant dessus tu n'y arrives pas, copie intégralement l'adresse dans la
Polytechnique.org
\"Le portail des élèves & anciens élèves de l'Ãcole polytechnique\"
-Email envoyé à ".Env::v('login') . (Post::has('email') ? "
-Adresse de secours : " . Post::v('email') : ""));
+Email envoyé à ".Env::v('login') . (is_null($to) ? '' : '
+Adresse de secours : ' . $to));
$mymail->send();
- // on cree un objet logger et on log l'evenement
- S::logger($user->id())->log('recovery', $mails);
+ S::logger($user->id())->log('recovery', is_null($to) ? $inactives_to . ', ' . $user->bestEmail() : $to);
}
- function handler_tmpPWD(&$page, $certif = null)
+ function handler_tmpPWD($page, $certif = null)
{
global $globals;
// XXX: recovery requires data from the profile
@@ -385,14 +383,24 @@ Adresse de secours : " . Post::v('email') : ""));
}
S::logger($uid)->log("passwd", "");
+
+ // Try to start a session (so the user don't have to log in); we will use
+ // the password available in Post:: to authenticate the user.
+ Platal::session()->start(AUTH_MDP);
+
$page->changeTpl('platal/tmpPWD.success.tpl');
} else {
+ $hruid = XDB::fetchOneCell('SELECT hruid
+ FROM accounts
+ WHERE uid = {?}',
+ $uid);
$page->changeTpl('platal/password.tpl');
- $page->addJsLink('password.js');
+ $page->assign('hruid', $hruid);
+ $page->assign('do_auth', 1);
}
}
- function handler_skin(&$page)
+ function handler_skin($page)
{
global $globals;
@@ -421,12 +429,18 @@ Adresse de secours : " . Post::v('email') : ""));
$page->assign('skins', XDB::iterator($sql));
}
- function handler_exit(&$page, $level = null)
+ function handler_exit($page, $level = null)
{
if (S::suid()) {
- S::logger()->log('suid_stop', S::user()->login() . " by " . S::suid('hruid'));
+ $old = S::user()->login();
+ S::logger()->log('suid_stop', $old . " by " . S::suid('hruid'));
Platal::session()->stopSUID();
- pl_redirect('admin/user/' . S::user()->login());
+ $target = S::s('suid_startpage');
+ S::kill('suid_startpage');
+ if (!empty($target)) {
+ http_redirect($target);
+ }
+ pl_redirect('admin/user/' . $old);
}
if ($level == 'forget' || $level == 'forgetall') {
@@ -449,7 +463,7 @@ Adresse de secours : " . Post::v('email') : ""));
}
}
- function handler_review(&$page, $action = null, $mode = null)
+ function handler_review($page, $action = null, $mode = null)
{
// Include X-XRDS-Location response-header for Yadis discovery
global $globals;