X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Femail.php;h=a2ada029ad2990f2e8ade657c509febc235274ed;hb=a5878ac19cc6ea75a753470cf68b7d2180d6cd51;hp=63cd1ab8d80807debb1b41a97c78eba810950c63;hpb=e4ecada44147bebc922da00e72324e7e9622a247;p=platal.git

diff --git a/modules/email.php b/modules/email.php
index 63cd1ab..a2ada02 100644
--- a/modules/email.php
+++ b/modules/email.php
@@ -33,6 +33,8 @@ class EmailModule extends PLModule
             'emails/antispam/submit'  => $this->make_hook('submit', AUTH_COOKIE),
             'emails/test'     => $this->make_hook('test', AUTH_COOKIE, 'user', NO_AUTH),
 
+            'emails/imap/in'  => $this->make_hook('imap_in', AUTH_PUBLIC),
+
             'admin/emails/duplicated' => $this->make_hook('duplicated', AUTH_MDP, 'admin'),
             'admin/emails/watch'      => $this->make_hook('duplicated', AUTH_MDP, 'admin'),
             'admin/emails/lost'       => $this->make_hook('lost', AUTH_MDP, 'admin'),
@@ -50,6 +52,10 @@ class EmailModule extends PLModule
         $uid = S::v('uid');
 
         if ($action == 'best' && $email) {
+            if (!S::has_xsrf_token()) {
+                return PL_FORBIDDEN;
+            }
+
             // bestalias is the first bit : 1
             // there will be maximum 8 bits in flags : 255
             XDB::execute("UPDATE  aliases SET flags=flags & (255 - 1) WHERE id={?}", $uid);
@@ -100,6 +106,8 @@ class EmailModule extends PLModule
         $page->assign('demande', AliasReq::get_request($uid));
 
         if ($action == 'delete' && $value) {
+            S::assert_xsrf_token();
+
             //Suppression d'un alias
             XDB::execute(
                 'DELETE virtual, virtual_redirect
@@ -121,9 +129,10 @@ class EmailModule extends PLModule
         list($alias, $visibility) = $res->fetchOneRow();
         $page->assign('actuel', $alias);
 
-        if ($action == 'ask' && Env::has('alias') and Env::has('raison')) {
-            //Si l'utilisateur vient de faire une damande
+        if ($action == 'ask' && Env::has('alias') && Env::has('raison')) {
+            S::assert_xsrf_token();
 
+            //Si l'utilisateur vient de faire une damande
             $alias  = Env::v('alias');
             $raison = Env::v('raison');
             $public = (Env::v('public', 'off') == 'on')?"public":"private";
@@ -167,10 +176,11 @@ class EmailModule extends PLModule
                 $page->assign('success',$alias);
                 return;
             }
-        }
-        elseif ($action == 'set'
-            && ($value == 'public' || $value == 'private'))
-        {
+        } elseif ($action == 'set' && ($value == 'public' || $value == 'private')) {
+            if (!S::has_xsrf_token()) {
+                return PL_FORBIDDEN;
+            }
+
             if ($value == 'public') {
                 XDB::execute("UPDATE auth_user_quick SET emails_alias_pub = 'public'
                                          WHERE user_id = {?}", S::v('uid'));
@@ -224,6 +234,8 @@ class EmailModule extends PLModule
         }
 
         if (Env::has('emailop')) {
+            S::assert_xsrf_token();
+
             $actifs = Env::v('emails_actifs', Array());
             print_r(Env::v('emails_rewrite'));
             if (Env::v('emailop') == "ajouter" && Env::has('email')) {
@@ -284,6 +296,8 @@ class EmailModule extends PLModule
         $page->changeTpl('emails/submit_spam.tpl');
 
         if (Post::has('send_email')) {
+            S::assert_xsrf_token();
+
             $upload = PlUpload::get($_FILES['mail'], S::v('forlife'), 'spam.submit', true);
             if (!$upload) {
                 $page->trig('Une erreur a été rencontrée lors du transfert du fichier');
@@ -318,6 +332,10 @@ class EmailModule extends PLModule
 
         // action si on recoit un formulaire
         if (Post::has('save')) {
+            if (!S::has_xsrf_token()) {
+                return PL_FORBIDDEN;
+            }
+
             unset($_POST['save']);
             if (trim(preg_replace('/-- .*/', '', Post::v('contenu'))) != "") {
                 $_POST['to_contacts'] = explode(';', @$_POST['to_contacts']);
@@ -328,6 +346,8 @@ class EmailModule extends PLModule
             }
             exit;
         } else if (Env::v('submit') == 'Envoyer') {
+            S::assert_xsrf_token();
+
             function getEmails($aliases)
             {
                 if (!is_array($aliases)) {
@@ -423,6 +443,9 @@ class EmailModule extends PLModule
         global $globals;
         require_once 'emails.inc.php';
 
+        if (!S::has_xsrf_token()) {
+            return PL_FORBIDDEN;
+        }
         if (!S::has_perms() || !$forlife) {
             $forlife = S::v('bestalias');
         }
@@ -443,6 +466,36 @@ class EmailModule extends PLModule
         exit;
     }
 
+    function handler_imap_in(&$page, $hash = null, $login = null)
+    {
+        $page->changeTpl('emails/imap_register.tpl');
+        $id = null;
+        if (!empty($hash) || !empty($login)) {
+            $req = XDB::query("SELECT  u.prenom, FIND_IN_SET('femme', u.flags) AS sexe, a.id
+                                 FROM  aliases AS a
+                           INNER JOIN  newsletter_ins AS ni ON (a.id = ni.user_id)
+                           INNER JOIN  auth_user_md5 AS u ON (u.user_id = a.id)
+                                WHERE  a.alias = {?} AND ni.hash = {?}", $login, $hash);
+            list($prenom, $sexe, $id) = $req->fetchOneRow();
+        }
+
+        require_once('emails.inc.php');
+        $page->assign('ok', false);
+        if (S::logged() && (is_null($id) || $id == S::i('uid'))) {
+            $storage = new EmailStorage(S::i('uid'), 'imap');
+            $storage->activate();
+            $page->assign('ok', true);
+            $page->assign('prenom', S::v('prenom'));
+            $page->assign('sexe', S::v('femme'));
+        } else if (!S::logged() && $id) {
+            $storage = new EmailStorage($id, 'imap');
+            $storage->activate();
+            $page->assign('ok', true);
+            $page->assign('prenom', $prenom);
+            $page->assign('sexe', $sexe);
+        }
+    }
+
     function handler_broken(&$page, $warn = null, $email = null)
     {
         require_once 'emails.inc.php';
@@ -454,12 +507,13 @@ class EmailModule extends PLModule
         $page->changeTpl('emails/broken.tpl');
 
         if ($warn == 'warn' && $email) {
+            S::assert_xsrf_token();
+
             $email = valide_email($email);
             // vérifications d'usage
             $sel = XDB::query(
                     "SELECT  e.uid, a.alias
                        FROM  emails        AS e
-                 INNER JOIN  auth_user_md5 AS u ON e.uid = u.user_id
                  INNER JOIN  aliases       AS a ON (e.uid = a.id AND type!='homonyme'
                                                     AND FIND_IN_SET('bestalias',a.flags))
                       WHERE  e.email={?}", $email);
@@ -478,11 +532,11 @@ Nous te suggérons de vérifier cette adresse, et le cas échéant de mettre
 à jour sur le site <{$globals->baseurl}/emails> tes adresses
 de redirection...
 
-Pour plus de rensignements sur le service de patte cassée, n'hésites pas à
+Pour plus de renseignements sur le service de patte cassée, n'hésite pas à
 consulter la page <{$globals->baseurl}/emails/broken>.
 
 
-A bientôt sur Polytechnique.org !
+À bientôt sur Polytechnique.org !
 L'équipe d'administration <support@" . $globals->mail->domain . '>';
 
                 $mail = new PlMailer();
@@ -494,18 +548,19 @@ L'équipe d'administration <support@" . $globals->mail->domain . '>';
                 $page->trig("Mail envoyé ! :o)");
             }
         } elseif (Post::has('email')) {
+            S::assert_xsrf_token();
+
             $email = valide_email(Post::v('email'));
 
             list(,$fqdn) = explode('@', $email);
             $fqdn = strtolower($fqdn);
-            if ($fqdn == 'polytechnique.org' || $fqdn == 'melix.org'
-            ||  $fqdn == 'm4x.org' || $fqdn == 'melix.net')
-            {
+            if ($fqdn == 'polytechnique.org' || $fqdn == 'melix.org' ||  $fqdn == 'm4x.org' || $fqdn == 'melix.net') {
                 $page->assign('neuneu', true);
             } else {
                 $page->assign('email',$email);
                 $sel = XDB::query(
-                        "SELECT  e1.uid, e1.panne != 0 AS panne, count(e2.uid) AS nb_mails,
+                        "SELECT  e1.uid, e1.panne != 0 AS panne,
+                                 (count(e2.uid) + IF(FIND_IN_SET('googleapps', u.mail_storage), 1, 0)) AS nb_mails,
                                  u.nom, u.prenom, u.promo, a.alias AS forlife
                            FROM  emails as e1
                       LEFT JOIN  emails as e2 ON(e1.uid = e2.uid
@@ -544,8 +599,11 @@ L'équipe d'administration <support@" . $globals->mail->domain . '>';
                         'dangerous' => 'Usurpations par cette adresse');
         $page->assign('states', $states);
 
+        if (Post::has('action')) {
+            S::assert_xsrf_token();
+        }
         switch (Post::v('action')) {
-        case 'create':
+          case 'create':
             if (trim(Post::v('emailN')) != '') {
                 Xdb::execute('INSERT IGNORE INTO emails_watch (email, state, detection, last, uid, description)
                                           VALUES ({?}, {?}, CURDATE(), NOW(), {?}, {?})',
@@ -553,13 +611,13 @@ L'équipe d'administration <support@" . $globals->mail->domain . '>';
             };
             break;
 
-        case 'edit':
+          case 'edit':
             Xdb::execute('UPDATE emails_watch
                              SET state = {?}, last = NOW(), uid = {?}, description = {?}
                            WHERE email = {?}', Post::v('stateN'), S::i('uid'), Post::v('descriptionN'), Post::v('emailN'));
             break;
 
-        default:
+          default:
             if ($action == 'delete' && !is_null($email)) {
                 Xdb::execute('DELETE FROM emails_watch WHERE email = {?}', $email);
             }