X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fregister.php;h=613c1cec45889c2bd2a9f0a1616d1907ce51f466;hb=e46cf8c46341b447cc3701c8afcc9baec3da11e5;hp=ea295160c9788d8b9b2b1ce2010b0b93c1a1028b;hpb=2b6d403c3f3a78286f940919f82e53c4eb80de60;p=platal.git diff --git a/modules/register.php b/modules/register.php index ea29516..177580e 100644 --- a/modules/register.php +++ b/modules/register.php @@ -1,6 +1,6 @@ $this->make_hook('register', AUTH_PUBLIC), 'register/end' => $this->make_hook('end', AUTH_PUBLIC), - 'register/end.php' => $this->make_hook('end_old', AUTH_PUBLIC), - 'register/success' => $this->make_hook('success', AUTH_MDP), ); } function handler_register(&$page, $hash = null) { - global $globals; - - $sub_state = Session::getMixed('sub_state', Array()); + $alert = null; + $sub_state = S::v('sub_state', Array()); if (!isset($sub_state['step'])) { $sub_state['step'] = 0; } - if (Get::has('back') && Get::getInt('back') < $sub_state['step']) { - $sub_state['step'] = max(0,Get::getInt('back')); + if (!isset($sub_state['backs'])) { + $sub_state['backs'] = array(); } - - // Compatibility with old sources, keep it atm - if (!$hash && Env::has('hash')) { - $hash = Env::get('hash'); + if (Get::has('back') && Get::i('back') < $sub_state['step']) { + $sub_state['step'] = max(0,Get::i('back')); + $state = $sub_state; + unset($state['backs']); + $sub_state['backs'][] = $state; + if (count($sub_state['backs']) == 3) { + $alert .= "Tentative d'inscription très hésitante - "; + } } if ($hash) { - $res = $globals->xdb->query( - "SELECT m.uid, u.promo, u.nom, u.prenom, u.matricule + $res = XDB::query( + "SELECT m.uid, u.promo, u.nom, u.prenom, u.matricule, u.naissance_ini, FIND_IN_SET('watch', u.flags) FROM register_marketing AS m INNER JOIN auth_user_md5 AS u ON u.user_id = m.uid WHERE m.hash={?}", $hash); - if (list($uid, $promo, $nom, $prenom, $ourmat) = $res->fetchOneRow()) { + if (list($uid, $promo, $nom, $prenom, $ourmat, $naiss, $watch) = $res->fetchOneRow()) { $sub_state['uid'] = $uid; $sub_state['hash'] = $hash; $sub_state['promo'] = $promo; $sub_state['nom'] = $nom; $sub_state['prenom'] = $prenom; $sub_state['ourmat'] = $ourmat; + $sub_state['watch'] = $watch; + $sub_state['naissance_ini'] = $naiss; - $globals->xdb->execute( + XDB::execute( "REPLACE INTO register_mstats (uid,sender,success) SELECT m.uid, m.sender, 0 FROM register_marketing AS m @@ -72,11 +75,13 @@ class RegisterModule extends PLModule switch ($sub_state['step']) { case 0: + $wp = new PlWikiPage('Reference.Charte'); + $wp->buildCache(); if (Post::has('step1')) { $sub_state['step'] = 1; if (isset($sub_state['hash'])) { $sub_state['step'] = 3; - require_once('register.inc.php'); + $this->load('register.inc.php'); create_aliases($sub_state); } } @@ -84,9 +89,14 @@ class RegisterModule extends PLModule case 1: if (Post::has('promo')) { - $promo = Post::getInt('promo'); - if ($promo < 1900 || $promo > date('Y')) { - $err = "La promotion saisie est incorrecte !"; + $promo = Post::i('promo'); + $res = XDB::query("SELECT COUNT(*) + FROM auth_user_md5 + WHERE perms='pending' AND deces = '0000-00-00' + AND promo = {?}", + $promo); + if (!$res->fetchOneCell()) { + $err = "La promotion saisie est incorrecte ou tous les camarades de cette promotion sont inscrits !"; } else { $sub_state['step'] = 2; $sub_state['promo'] = $promo; @@ -101,10 +111,10 @@ class RegisterModule extends PLModule case 2: if (count($_POST)) { - require_once('register.inc.php'); - $sub_state['prenom'] = Post::get('prenom'); - $sub_state['nom'] = Post::get('nom'); - $sub_state['mat'] = Post::get('mat'); + $this->load('register.inc.php'); + $sub_state['prenom'] = Post::v('prenom'); + $sub_state['nom'] = Post::v('nom'); + $sub_state['mat'] = Post::v('mat'); $err = check_new_user($sub_state); if ($err !== true) { break; } @@ -118,195 +128,364 @@ class RegisterModule extends PLModule case 3: if (count($_POST)) { - require_once('register.inc.php'); - if (!isvalid_email(Post::get('email'))) { - $err[] = "Le champ 'E-mail' n'est pas valide."; - } elseif (!isvalid_email_redirection(Post::get('email'))) { + $this->load('register.inc.php'); + + // Validate the email address format and domain. + require_once 'emails.inc.php'; + if (!isvalid_email(Post::v('email'))) { + $err[] = "Le champ 'Email' n'est pas valide."; + } elseif (!isvalid_email_redirection(Post::v('email'))) { $err[] = $sub_state['forlife']." doit renvoyer vers un email existant ". - "valide, en particulier, il ne peut pas être renvoyé vers lui-même."; + "valide, en particulier, il ne peut pas être renvoyé vers lui-même."; } - if (!preg_match('/^[0-3][0-9][01][0-9][12][90][0-9][0-9]$/', - Post::get('naissance'))) - { + + // Validate the birthday format and range. + $birth = trim(Env::v('naissance')); + if (!preg_match('@^[0-3]?\d/[01]?\d/(19|20)?\d{2}$@', $birth)) { $err[] = "La 'Date de naissance' n'est pas correcte."; + } else { + $birth = explode('/', $birth, 3); + for ($i = 0; $i < 3; $i++) + $birth[$i] = intval($birth[$i]); + if ($birth[2] < 100) $birth[2] += 1900; + $year = $birth[2]; + $promo = (int)$sub_state['promo']; + if ($year > $promo - 15 || $year < $promo - 30) { + $err[] = "La 'Date de naissance' n'est pas correcte."; + $alert = "Date de naissance incorrecte à l'inscription - "; + $sub_state['wrong_naissance'] = $birth; + } + } + + // Register the optional services requested by the user. + $services = array(); + foreach (array('ax_letter', 'imap', 'ml_promo', 'nl') as $service) { + if (Post::b($service)) { + $services[] = $service; + } + } + $sub_state['services'] = $services; + + // Validate the password. + if (!Post::v('response2', false)) { + $err[] = "Le mot de passe n'est pas valide."; + } + + // Check if the given email is known as dangerous. + $res = XDB::query("SELECT w.state, w.description + FROM emails_watch AS w + WHERE w.email = {?} AND w.state != 'safe'", + Post::v('email')); + $email_banned = false; + if ($res->numRows()) { + list($state, $description) = $res->fetchOneRow(); + $alert .= "Email surveillé proposé à l'inscription - "; + $sub_state['email_desc'] = $description; + if ($state == 'dangerous') { + $email_banned = true; + } + } + if ($sub_state['watch']) { + $alert .= "Inscription d'un utilisateur surveillé - "; + } + + if (($ip_banned = check_ip('unsafe'))) { + unset($err); } if (isset($err)) { $err = join('
', $err); } else { - $birth = Env::get('naissance'); - $sub_state['naissance'] = sprintf("%s-%s-%s", - substr($birth,4,4), - substr($birth,2,2), - substr($birth,0,2)); - $sub_state['email'] = Post::get('email'); - $sub_state['step'] = 4; - finish_ins($sub_state); + $sub_state['naissance'] = sprintf("%04d-%02d-%02d", + intval($birth[2]), intval($birth[1]), intval($birth[0])); + $sub_state['email'] = Post::v('email'); + $sub_state['password'] = Post::v('response2'); + + // Update the current alert if the birthdate is incorrect, + // or if the IP address of the user has been banned. + if ($sub_state['naissance_ini'] != '0000-00-00' && $sub_state['naissance'] != $sub_state['naissance_ini']) { + $alert .= "Date de naissance incorrecte à l'inscription - "; + } + if ($ip_banned) { + $alert .= "Tentative d'inscription depuis une IP surveillée"; + } + + // Prevent banned user from actually registering; save the current state for others. + if ($email_banned || $ip_banned) { + global $globals; + $err = "Une erreur s'est produite lors de l'inscription." + . " Merci de contacter = 3) { + $alert .= "Fin d'une inscription hésitante"; + } + finish_ins($sub_state); + } } } break; } $_SESSION['sub_state'] = $sub_state; + if (!empty($alert)) { + send_warning_mail($alert); + } + $page->changeTpl('register/step'.intval($sub_state['step']).'.tpl'); - $page->assign('simple', true); + $page->addJsLink('motdepasse.js'); if (isset($err)) { - $page->trig($err); + $page->trigError($err); } - - return PL_OK; - } - - function handler_end_old(&$page) - { - return $this->handler_end($page, Env::get('hash')); } function handler_end(&$page, $hash = null) { global $globals; - - $page->changeTpl('register/end.tpl'); + $_SESSION['sub_state'] = array('step' => 5); + + // Reject registration requests from unsafe IP addresses (and remove the + // registration information from the database, to prevent IP changes). + if (check_ip('unsafe')) { + send_warning_mail('Une IP surveillée a tenté de finaliser son inscription'); + XDB::execute("DELETE FROM register_pending + WHERE hash = {?} AND hash != 'INSCRIT'", $hash); + return PL_FORBIDDEN; + } require_once('user.func.inc.php'); + // Retrieve the pre-registration information using the url-provided + // authentication token. if ($hash) { - $res = $globals->xdb->query( + $res = XDB::query( "SELECT r.uid, r.forlife, r.bestalias, r.mailorg2, - r.password, r.email, r.naissance, u.nom, u.prenom, - u.promo, u.flags + r.password, r.email, r.services, r.naissance, u.nom, u.prenom, + u.promo, FIND_IN_SET('femme', u.flags), u.naissance_ini FROM register_pending AS r INNER JOIN auth_user_md5 AS u ON r.uid = u.user_id - WHERE hash={?} AND hash!='INSCRIT'", $hash); + WHERE hash = {?} AND hash != 'INSCRIT'", $hash); } - - if (!$hash || !list($uid, $forlife, $bestalias, $mailorg2, $password, $email, - $naissance, $nom, $prenom, $promo, $femme) = $res->fetchOneRow()) - { + if (!$hash || $res->numRows() == 0) { $page->kill("

Cette adresse n'existe pas, ou plus, sur le serveur.

-

Causes probables :

+

Causes probables :

    -
  1. Vérifie que tu visites l'adresse du dernier - e-mail reçu s'il y en a eu plusieurs.
  2. -
  3. Tu as peut-être mal copié l'adresse reçue par - mail, vérifie-la à la main.
  4. -
  5. Tu as peut-être attendu trop longtemps pour - confirmer. Les pré-inscriptions sont annulées +
  6. Vérifie que tu visites l'adresse du dernier + email reçu s'il y en a eu plusieurs.
  7. +
  8. Tu as peut-être mal copié l'adresse reçue par + email, vérifie-la à la main.
  9. +
  10. Tu as peut-être attendu trop longtemps pour + confirmer. Les pré-inscriptions sont annulées tous les 30 jours.
  11. -
  12. Tu es en fait déjà inscrit.
  13. +
  14. Tu es en fait déjà inscrit.
"); } + list($uid, $forlife, $bestalias, $mailorg2, $password, $email, $services, + $naissance, $nom, $prenom, $promo, $femme, $naiss_ini) = $res->fetchOneRow(); + // Prepare the template for display. + $page->changeTpl('register/end.tpl'); + $page->addJsLink('do_challenge_response_logged.js'); + $page->assign('forlife', $forlife); + $page->assign('prenom', $prenom); + $page->assign('femme', $femme); + + // Check if the user did enter a valid password; if not (or if none is found), + // get her an information page. + if (Env::has('response')) { + require_once 'secure_hash.inc.php'; + $expected_response = hash_encrypt("$forlife:$password:" . S::v('challenge')); + if (Env::v('response') != $expected_response) { + $page->trigError("Mot de passe invalide."); + S::logger($uid)->log('auth_fail', 'bad password (register/end)'); + return; + } + } else { + return; + } - /***********************************************************/ - /****************** REALLY CREATE ACCOUNT ******************/ - /***********************************************************/ - - $globals->xdb->execute('UPDATE auth_user_md5 - SET password={?}, perms="user", - date=NOW(), naissance={?}, date_ins = NOW() - WHERE user_id={?}', $password, $naissance, $uid); - $globals->xdb->execute('REPLACE INTO auth_user_quick (user_id) VALUES ({?})', $uid); - $globals->xdb->execute('INSERT INTO aliases (id,alias,type) - VALUES ({?}, {?}, "a_vie")', $uid, - $forlife); - $globals->xdb->execute('INSERT INTO aliases (id,alias,type,flags) - VALUES ({?}, {?}, "alias", "bestalias")', - $uid, $bestalias); + // + // Create the user account. + // + XDB::execute("UPDATE auth_user_md5 + SET password = {?}, perms = 'user', + date = NOW(), naissance = {?}, date_ins = NOW() + WHERE user_id = {?}", $password, $naissance, $uid); + XDB::execute("REPLACE INTO auth_user_quick (user_id) VALUES ({?})", $uid); + XDB::execute("INSERT INTO aliases (id, alias, type) + VALUES ({?}, {?}, 'a_vie')", $uid, $forlife); + XDB::execute("INSERT INTO aliases (id, alias, type, flags) + VALUES ({?}, {?}, 'alias', 'bestalias')", $uid, $bestalias); if ($mailorg2) { - $globals->xdb->execute('INSERT INTO aliases (id,alias,type) - VALUES ({?}, {?}, "alias")', $uid, - $mailorg2); + XDB::execute("INSERT INTO aliases (id, alias, type) + VALUES ({?}, {?}, 'alias')", $uid, $mailorg2); } + // Add the registration email address as first and only redirection. require_once('emails.inc.php'); - $redirect = new Redirect($uid); + $user = User::getSilent($uid); + $redirect = new Redirect($user); $redirect->add_email($email); - // on cree un objet logger et on log l'inscription - $logger = new DiogenesCoreLogger($uid); - $logger->log('inscription', $email); - - $globals->xdb->execute('UPDATE register_pending SET hash="INSCRIT" WHERE uid={?}', $uid); + // Try to start a session (so the user don't have to log in); we will use + // the password available in Post:: to authenticate the user. + Platal::session()->start(AUTH_MDP); + + // Subscribe the user to the services she did request at registration time. + foreach (explode(',', $services) as $service) { + switch ($service) { + case 'ax_letter': + Platal::load('axletter', 'axletter.inc.php'); + AXLetter::subscribe(S::user()->id()); + break; + case 'imap': + require_once 'emails.inc.php'; + $user = S::user(); + $storage = new EmailStorage($user, 'imap'); + $storage->activate(); + break; + case 'ml_promo': + $r = XDB::query('SELECT id FROM groupex.asso WHERE diminutif = {?}', S::user()->promo()); + if ($r->numRows()) { + $asso_id = $r->fetchOneCell(); + XDB::execute('REPLACE INTO groupex.membres (uid, asso_id) + VALUES ({?}, {?})', + S::user()->id(), $asso_id); + $mmlist = new MMList(S::user()->id(), S::v('password')); + $mmlist->subscribe("promo" . S::v('promo')); + } + break; + case 'nl': + require_once 'newsletter.inc.php'; + NewsLetter::subscribe(); + break; + } + } - $globals->hook->subscribe($forlife, $uid, $promo, $password); + // Log the registration in the user session. + S::logger($uid)->log('inscription', $email); + XDB::execute("UPDATE register_pending + SET hash = 'INSCRIT' + WHERE uid = {?}", $uid); - require_once('xorg.mailer.inc.php'); - $mymail = new XOrgMailer('register/inscription.reussie.tpl'); + // Congratulate our newly registered user by email. + $mymail = new PlMailer('register/inscription.reussie.tpl'); $mymail->assign('forlife', $forlife); $mymail->assign('prenom', $prenom); $mymail->send(); - start_connexion($uid,false); - $_SESSION['auth'] = AUTH_MDP; + // Index the user, to allow her to appear in searches. + require_once('user.func.inc.php'); + user_reindex($uid); + + // Notify other users which were watching for her arrival. + require_once 'notifs.inc.php'; + register_watch_op($uid, WATCH_INSCR); + inscription_notifs_base($uid); + + // Forcibly register the new user on default forums. + $promo_forum = 'xorg.promo.x' . $promo; + $registered_forums = array('xorg.general', 'xorg.pa.divers', 'xorg.pa.logements', $promo_forum); + foreach ($registered_forums as $forum) { + XDB::execute("INSERT INTO forums.abos (fid,uid) + SELECT fid, {?} + FROM forums.list + WHERE nom = {?}", + $uid, $val); + + // Notify the newsgroup admin of the promotion forum needs be created. + if (XDB::affectedRows() == 0 && $forum == $promo_forum) { + $res = XDB::query("SELECT SUM(perms IN ('admin','user') AND deces = 0), COUNT(*) + FROM auth_user_md5 + WHERE promo = {?}", $promo); + list($promo_registered_count, $promo_count) = $res->fetchOneRow(); + if ($promo_registered_count > 0.2 * $promo_count) { + $mymail = new PlMailer('admin/forums-promo.mail.tpl'); + $mymail->assign('promo', $promo); + $mymail->send(); + } + } + } + + // Update the global registration count stats. + $globals->updateNbIns(); + + // + // Update collateral data sources, and inform watchers by email. + // - /***********************************************************/ - /************* envoi d'un mail au démarcheur ***************/ - /***********************************************************/ - $res = $globals->xdb->iterRow( - "SELECT DISTINCT sa.alias, IF(s.nom_usage,s.nom_usage,s.nom) AS nom, - s.prenom, s.flags AS femme + // Email the referrer(s) of this new user. + $res = XDB::iterRow( + "SELECT sa.alias, IF(s.nom_usage,s.nom_usage,s.nom) AS nom, + s.prenom, FIND_IN_SET('femme', s.flags) AS femme, + GROUP_CONCAT(m.email SEPARATOR ', ') AS mails, MAX(m.last) AS dateDernier FROM register_marketing AS m - INNER JOIN auth_user_md5 AS s ON ( m.sender = s.user_id ) - INNER JOIN aliases AS sa ON ( sa.id = m.sender - AND FIND_IN_SET('bestalias', sa.flags) ) - WHERE m.uid = {?}", $uid); - $globals->xdb->execute("UPDATE register_mstats SET success=NOW() WHERE uid={?}", $uid); - - while (list($salias, $snom, $sprenom, $sfemme) = $res->next()) { - require_once('diogenes/diogenes.hermes.inc.php'); - $mymail = new HermesMailer(); - $mymail->setSubject("$prenom $nom s'est inscrit à Polytechnique.org !"); - $mymail->setFrom('"Marketing Polytechnique.org" '); + INNER JOIN auth_user_md5 AS s ON (m.sender = s.user_id) + INNER JOIN aliases AS sa ON (sa.id = m.sender + AND FIND_IN_SET('bestalias', sa.flags)) + WHERE m.uid = {?} + GROUP BY m.sender + ORDER BY dateDernier DESC", $uid); + XDB::execute("UPDATE register_mstats + SET success = NOW() + WHERE uid = {?}", $uid); + + $market = array(); + while (list($salias, $snom, $sprenom, $sfemme, $mails, $dateDernier) = $res->next()) { + $market[] = " - par $snom $sprenom sur $mails (le plus récemment le $dateDernier)"; + $mymail = new PlMailer(); + $mymail->setSubject("$prenom $nom s'est inscrit à Polytechnique.org !"); + $mymail->setFrom('"Marketing Polytechnique.org" mail->domain . '>'); $mymail->addTo("\"$sprenom $snom\" <$salias@{$globals->mail->domain}>"); - $msg = ($sfemme?'Cher':'Chère')." $sprenom,\n\n" - . "Nous t'écrivons pour t'informer que {$prenom} {$nom} (X{$promo}), " - . "que tu avais incité".($femme?'e':'')." à s'inscrire à Polytechnique.org, " - . "vient à l'instant de terminer son inscription.\n\n" - . "Merci de ta participation active à la reconnaissance de ce site !!!\n\n" + $msg = ($sfemme?'Chère':'Cher')." $sprenom,\n\n" + . "Nous t'écrivons pour t'informer que $prenom $nom (X$promo), " + . "que tu avais incité".($femme?'e':'')." à s'inscrire à Polytechnique.org, " + . "vient à l'instant de terminer son inscription.\n\n" + . "Merci de ta participation active à la reconnaissance de ce site !!!\n\n" . "Bien cordialement,\n" - . "L'équipe Polytechnique.org"; + . "-- \n" + . "L'équipe Polytechnique.org"; $mymail->setTxtBody(wordwrap($msg, 72)); $mymail->send(); } - $globals->xdb->execute("DELETE FROM register_marketing WHERE uid = {?}", $uid); - - redirect($globals->baseurl.'/register/success'); - $page->assign('uid', $uid); - - return PL_OK; - } - - function handler_success(&$page) - { - global $globals; - - $page->changeTpl('register/success.tpl'); - - if (Env::has('response2')) { - $_SESSION['password'] = $password = Post::get('response2'); - - $globals->xdb->execute('UPDATE auth_user_md5 SET password={?} - WHERE user_id={?}', $password, - Session::getInt('uid')); - - $log =& Session::getMixed('log'); - $log->log('passwd', ''); - - if (Cookie::get('ORGaccess')) { - require_once('secure_hash.inc.php'); - setcookie('ORGaccess', hash_encrypt($password), (time()+25920000), '/', '' ,0); + // Email the plat/al administrators about the registration. + if ($globals->register->notif) { + $mymail = new PlMailer(); + $mymail->setSubject("Inscription de $prenom $nom (X$promo)"); + $mymail->setFrom('"Webmaster Polytechnique.org" mail->domain . '>'); + $mymail->addTo($globals->register->notif); + $mymail->addHeader('Reply-To', $globals->register->notif); + $msg = "$prenom $nom (X$promo) a terminé son inscription avec les données suivantes :\n" + . " - nom : $nom\n" + . " - prenom : $prenom\n" + . " - promo : $promo\n" + . " - naissance : $naissance (date connue : $naiss_ini)\n" + . " - forlife : $forlife\n" + . " - email : $email\n" + . " - sexe : $femme\n" + . " - ip : " . S::logger()->ip . " (" . S::logger()->host . ")\n" + . (S::logger()->proxy_ip ? " - proxy : " . S::logger()->proxy_ip . " (" . S::logger()->proxy_host . ")\n" : "") + . "\n\n"; + if (count($market) > 0) { + $msg .= "Les marketings suivants avaient été effectués :\n" + . implode("\n", $market); + } else { + $msg .= "$prenom $nom n'a jamais reçu d'email de marketing."; } - - $page->assign('mdpok', true); + $mymail->setTxtBody($msg); + $mymail->send(); } - $page->addJsLink('javascript/motdepasse.js'); + // Remove old pending marketing requests for the new user. + Marketing::clear($uid); - return PL_OK; + pl_redirect('profile/edit'); } } +// vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: ?>