WebSVN – oidplus – Blame – /trunk/plugins/raPages/102_change_email/OIDplusPageRaChangeEMail.class.php

Rev	Author	Line No.	Line
61	daniel-mar	1	<?php
		2
		3	/*
		4	* OIDplus 2.0
		5	* Copyright 2019 Daniel Marschall, ViaThinkSoft
		6	*
		7	* Licensed under the Apache License, Version 2.0 (the "License");
		8	* you may not use this file except in compliance with the License.
		9	* You may obtain a copy of the License at
		10	*
		11	* http://www.apache.org/licenses/LICENSE-2.0
		12	*
		13	* Unless required by applicable law or agreed to in writing, software
		14	* distributed under the License is distributed on an "AS IS" BASIS,
		15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		16	* See the License for the specific language governing permissions and
		17	* limitations under the License.
		18	*/
		19
112	daniel-mar	20	if (!defined('IN_OIDPLUS')) die();
		21
61	daniel-mar	22	class OIDplusPageRaChangeEMail extends OIDplusPagePlugin {
		23	public function type() {
		24	return 'ra';
		25	}
		26
		27	public function priority() {
		28	return 102;
		29	}
		30
		31	public function action(&$handled) {
107	daniel-mar	32	if (isset($_POST["action"]) && ($_POST["action"] == "change_ra_email")) {
61	daniel-mar	33	$handled = true;
		34
152	daniel-mar	35	if (!OIDplus::config()->getValue('allow_ra_email_change') && !OIDplus::authUtils()::isAdminLoggedIn()) {
107	daniel-mar	36	die(json_encode(array("error" => 'This functionality has been disabled by the administrator.')));
61	daniel-mar	37	}
		38
		39	$old_email = $_POST['old_email'];
		40	$new_email = $_POST['new_email'];
		41
		42	if (!OIDplus::authUtils()::isRaLoggedIn($old_email) && !OIDplus::authUtils()::isAdminLoggedIn()) {
107	daniel-mar	43	die(json_encode(array("error" => 'Authentification error. Please log in as the RA to update its email address.')));
61	daniel-mar	44	}
		45
104	daniel-mar	46	if (!oidplus_valid_email($new_email)) {
107	daniel-mar	47	die(json_encode(array("error" => 'eMail address is invalid.')));
61	daniel-mar	48	}
		49
150	daniel-mar	50	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($old_email));
61	daniel-mar	51	if (OIDplus::db()->num_rows($res) == 0) {
107	daniel-mar	52	die(json_encode(array("error" => 'eMail address does not exist anymore. It was probably already changed.')));
61	daniel-mar	53	}
		54
150	daniel-mar	55	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($new_email));
61	daniel-mar	56	if (OIDplus::db()->num_rows($res) > 0) {
107	daniel-mar	57	die(json_encode(array("error" => 'eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.')));
61	daniel-mar	58	}
152	daniel-mar	59
		60	if (OIDplus::authUtils()::isAdminLoggedIn()) {
		61	OIDplus::logger()->log("RA($old_email)!+RA($new_email)!+A!", "Admin changed email address '$old_email' to '$new_email'");
		62
		63	$ra_was_logged_in = OIDplus::authUtils()::isRaLoggedIn($old_email);
61	daniel-mar	64
152	daniel-mar	65	$ra = new OIDplusRA($old_email);
		66	$ra->change_email($new_email);
115	daniel-mar	67
152	daniel-mar	68	if (!OIDplus::db()->query("update ".OIDPLUS_TABLENAME_PREFIX."objects set ra_email = ? where ra_email = ?", array($new_email, $old_email))) {
		69	throw new Exception(OIDplus::db()->error());
		70	}
61	daniel-mar	71
152	daniel-mar	72	if ($ra_was_logged_in) {
		73	OIDplus::authUtils()->raLogout($old_email);
		74	OIDplus::authUtils()->raLogin($new_email);
		75	}
61	daniel-mar	76
152	daniel-mar	77	echo json_encode(array("status" => 0));
		78	} else {
		79	OIDplus::logger()->log("RA($old_email)!+RA($new_email)!", "Requested email change from '$old_email' to '$new_email'");
		80
		81	$timestamp = time();
		82	$activate_url = OIDplus::system_url() . '?goto='.urlencode('oidplus:activate_new_ra_email$'.$old_email.'$'.$new_email.'$'.$timestamp.'$'.OIDplus::authUtils()::makeAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp));
		83
		84	$message = file_get_contents(__DIR__ . '/change_request_email.tpl');
		85	$message = str_replace('{{SYSTEM_URL}}', OIDplus::system_url(), $message);
		86	$message = str_replace('{{SYSTEM_TITLE}}', OIDplus::config()->systemTitle(), $message);
		87	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
		88	$message = str_replace('{{OLD_EMAIL}}', $old_email, $message);
		89	$message = str_replace('{{NEW_EMAIL}}', $new_email, $message);
		90	$message = str_replace('{{ACTIVATE_URL}}', $activate_url, $message);
		91	my_mail($new_email, OIDplus::config()->systemTitle().' - Change email request', $message);
		92
		93	echo json_encode(array("status" => 0));
		94	}
107	daniel-mar	95	}
		96
		97	if (isset($_POST["action"]) && ($_POST["action"] == "activate_new_ra_email")) {
61	daniel-mar	98	$handled = true;
		99
		100	if (!OIDplus::config()->getValue('allow_ra_email_change')) {
107	daniel-mar	101	die(json_encode(array("error" => 'This functionality has been disabled by the administrator.')));
61	daniel-mar	102	}
		103
		104	$old_email = $_POST['old_email'];
		105	$new_email = $_POST['new_email'];
		106	$password = $_POST['password'];
		107
		108	$auth = $_POST['auth'];
		109	$timestamp = $_POST['timestamp'];
		110
		111	if (!OIDplus::authUtils()::validateAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp, $auth)) {
107	daniel-mar	112	die(json_encode(array("error" => 'Invalid auth key')));
61	daniel-mar	113	}
		114
		115	if ((OIDplus::config()->getValue('max_ra_email_change_time') > 0) && (time()-$timestamp > OIDplus::config()->maxEmailChangeTime())) {
107	daniel-mar	116	die(json_encode(array("error" => 'Activation link expired!')));
61	daniel-mar	117	}
		118
150	daniel-mar	119	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($old_email));
61	daniel-mar	120	if (OIDplus::db()->num_rows($res) == 0) {
107	daniel-mar	121	die(json_encode(array("error" => 'eMail address does not exist anymore. It was probably already changed.')));
61	daniel-mar	122	}
		123
150	daniel-mar	124	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($new_email));
61	daniel-mar	125	if (OIDplus::db()->num_rows($res) > 0) {
107	daniel-mar	126	die(json_encode(array("error" => 'eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.')));
61	daniel-mar	127	}
		128
		129	$ra = new OIDplusRA($old_email);
		130	if (!$ra->checkPassword($password)) {
107	daniel-mar	131	die(json_encode(array("error" => 'Wrong password')));
61	daniel-mar	132	}
		133
		134	$ra->change_email($new_email);
		135
150	daniel-mar	136	if (!OIDplus::db()->query("update ".OIDPLUS_TABLENAME_PREFIX."objects set ra_email = ? where ra_email = ?", array($new_email, $old_email))) {
61	daniel-mar	137	throw new Exception(OIDplus::db()->error());
		138	}
		139
		140	OIDplus::authUtils()->raLogout($old_email);
		141	OIDplus::authUtils()->raLogin($new_email);
		142
115	daniel-mar	143	OIDplus::logger()->log("RA($old_email)!", "Changed email address from '$old_email' to '$new_email'");
		144	OIDplus::logger()->log("RA($new_email)!", "RA '$old_email' has changed its email address to '$new_email'");
		145
61	daniel-mar	146	$message = file_get_contents(__DIR__ . '/email_change_confirmation.tpl');
		147	$message = str_replace('{{SYSTEM_URL}}', OIDplus::system_url(), $message);
		148	$message = str_replace('{{SYSTEM_TITLE}}', OIDplus::config()->systemTitle(), $message);
76	daniel-mar	149	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
61	daniel-mar	150	$message = str_replace('{{OLD_EMAIL}}', $old_email, $message);
		151	$message = str_replace('{{NEW_EMAIL}}', $new_email, $message);
		152	my_mail($old_email, OIDplus::config()->systemTitle().' - eMail address changed', $message);
		153
107	daniel-mar	154	echo json_encode(array("status" => 0));
61	daniel-mar	155	}
		156	}
		157
75	daniel-mar	158	public function init($html=true) {
		159	OIDplus::config()->prepareConfigKey('max_ra_email_change_time', 'Max RA email change time in seconds (0 = infinite)', '0', 0, 1);
		160	OIDplus::config()->prepareConfigKey('allow_ra_email_change', 'Allow that RAs change their email address (0/1)', '1', 0, 1);
61	daniel-mar	161	}
		162
		163	public function cfgSetValue($name, $value) {
		164	if ($name == 'allow_ra_email_change') {
		165	if (($value != '0') && ($value != '1')) {
		166	throw new Exception("Please enter either 0 or 1.");
		167	}
		168	}
		169	if (($name == 'max_ra_invite_time') \|\| ($name == 'max_ra_pwd_reset_time') \|\| ($name == 'max_ra_email_change_time')) {
		170	if (!is_numeric($value) \|\| ($value < 0)) {
		171	throw new Exception("Please enter a valid value.");
		172	}
		173	}
		174	}
		175
		176	public function gui($id, &$out, &$handled) {
		177	if (explode('$',$id)[0] == 'oidplus:change_ra_email') {
		178	$handled = true;
		179	$out['title'] = 'Change RA email';
148	daniel-mar	180	$out['icon'] = file_exists(__DIR__.'/icon_big.png') ? 'plugins/'.basename(dirname(__DIR__)).'/'.basename(__DIR__).'/icon_big.png' : '';
61	daniel-mar	181
		182	$ra_email = explode('$',$id)[1];
		183
150	daniel-mar	184	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($ra_email));
61	daniel-mar	185	if (OIDplus::db()->num_rows($res) == 0) {
		186	$out['icon'] = 'img/error_big.png';
		187	$out['text'] = 'RA <b>'.htmlentities($ra_email).'</b> does not exist';
152	daniel-mar	188	} else if (!OIDplus::config()->getValue('allow_ra_email_change') && !OIDplus::authUtils()::isAdminLoggedIn()) {
61	daniel-mar	189	$out['icon'] = 'img/error_big.png';
		190	$out['text'] .= '<p>This functionality has been disabled by the administrator.</p>';
		191	} else if (!OIDplus::authUtils()::isRaLoggedIn($ra_email) && !OIDplus::authUtils()::isAdminLoggedIn()) {
		192	$out['icon'] = 'img/error_big.png';
152	daniel-mar	193	$out['text'] .= '<p>You need to <a '.oidplus_link('oidplus:login').'>log in</a> as the requested RA <b>'.htmlentities($ra_email).'</b> or as admin.</p>';
61	daniel-mar	194	} else {
152	daniel-mar	195	if (OIDplus::authUtils()::isAdminLoggedIn()) {
		196	$out['text'] .= '<form id="changeRaEmailForm" onsubmit="return changeRaEmailFormOnSubmit(true);">';
		197	$out['text'] .= '<input type="hidden" id="old_email" value="'.htmlentities($ra_email).'"/><br>';
		198	$out['text'] .= '<div><label class="padding_label">Old address:</label><b>'.htmlentities($ra_email).'</b></div>';
		199	$out['text'] .= '<div><label class="padding_label">New address:</label><input type="text" id="new_email" value=""/></div>';
		200	$out['text'] .= '<br><input type="submit" value="Change password"> (admin does not require email verification)</form>';
		201	} else {
		202	$out['text'] .= '<form id="changeRaEmailForm" onsubmit="return changeRaEmailFormOnSubmit(false);">';
		203	$out['text'] .= '<input type="hidden" id="old_email" value="'.htmlentities($ra_email).'"/><br>';
		204	$out['text'] .= '<div><label class="padding_label">Old address:</label><b>'.htmlentities($ra_email).'</b></div>';
		205	$out['text'] .= '<div><label class="padding_label">New address:</label><input type="text" id="new_email" value=""/></div>';
		206	$out['text'] .= '<br><input type="submit" value="Send new activation email"></form>';
		207	}
61	daniel-mar	208	}
		209	} else if (explode('$',$id)[0] == 'oidplus:activate_new_ra_email') {
		210	$handled = true;
		211
		212	$old_email = explode('$',$id)[1];
		213	$new_email = explode('$',$id)[2];
		214	$timestamp = explode('$',$id)[3];
		215	$auth = explode('$',$id)[4];
		216
152	daniel-mar	217	if (!OIDplus::config()->getValue('allow_ra_email_change') && !OIDplus::authUtils()::isAdminLoggedIn()) {
61	daniel-mar	218	$out['icon'] = 'img/error_big.png';
		219	$out['text'] .= '<p>This functionality has been disabled by the administrator.</p>';
		220	} else {
		221	$out['title'] = 'Perform email address change';
148	daniel-mar	222	$out['icon'] = file_exists(__DIR__.'/icon_big.png') ? 'plugins/'.basename(dirname(__DIR__)).'/'.basename(__DIR__).'/icon_big.png' : '';
61	daniel-mar	223
150	daniel-mar	224	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($old_email));
61	daniel-mar	225	if (OIDplus::db()->num_rows($res) == 0) {
		226	$out['icon'] = 'img/error_big.png';
		227	$out['text'] = 'eMail address does not exist anymore. It was probably already changed.';
		228	} else {
150	daniel-mar	229	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = ?", array($new_email));
61	daniel-mar	230	if (OIDplus::db()->num_rows($res) > 0) {
		231	$out['icon'] = 'img/error_big.png';
		232	$out['text'] = 'eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.';
		233	} else {
		234	if (!OIDplus::authUtils()::validateAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp, $auth)) {
		235	$out['icon'] = 'img/error_big.png';
		236	$out['text'] = 'Invalid authorization. Is the URL OK?';
		237	} else {
		238	$out['text'] = '<p>Old eMail-Address: <b>'.$old_email.'</b></p>
		239	<p>New eMail-Address: <b>'.$new_email.'</b></p>
		240
		241	<form id="activateNewRaEmailForm" onsubmit="return activateNewRaEmailFormOnSubmit();">
		242	<input type="hidden" id="old_email" value="'.htmlentities($old_email).'"/>
		243	<input type="hidden" id="new_email" value="'.htmlentities($new_email).'"/>
		244	<input type="hidden" id="timestamp" value="'.htmlentities($timestamp).'"/>
		245	<input type="hidden" id="auth" value="'.htmlentities($auth).'"/>
		246
152	daniel-mar	247	<div><label class="padding_label">Please verify your password:</label><input type="password" id="password" value=""/></div>
		248	<br><input type="submit" value="Change email address">
61	daniel-mar	249	</form>';
		250	}
		251	}
		252	}
		253	}
		254	}
		255	}
		256
106	daniel-mar	257	public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') {
61	daniel-mar	258	if (file_exists(__DIR__.'/treeicon.png')) {
148	daniel-mar	259	$tree_icon = 'plugins/'.basename(dirname(__DIR__)).'/'.basename(__DIR__).'/treeicon.png';
61	daniel-mar	260	} else {
		261	$tree_icon = null; // default icon (folder)
		262	}
		263
		264	$json[] = array(
		265	'id' => 'oidplus:change_ra_email$'.$ra_email,
		266	'icon' => $tree_icon,
		267	'text' => 'Change email address'
		268	);
104	daniel-mar	269
		270	return true;
61	daniel-mar	271	}
108	daniel-mar	272
		273	public function tree_search($request) {
		274	return false;
		275	}
61	daniel-mar	276	}
		277
		278	OIDplus::registerPagePlugin(new OIDplusPageRaChangeEMail());

Subversion Repositories oidplus

oidplus/trunk/plugins/raPages/102_change_email/OIDplusPageRaChangeEMail.class.php @ 511 – Rev 152