WebSVN – oidplus – Blame – /trunk/plugins/raPages/102_change_email/plugin.inc.php

Rev	Author	Line No.	Line
61	daniel-mar	1	<?php
		2
		3	/*
		4	* OIDplus 2.0
		5	* Copyright 2019 Daniel Marschall, ViaThinkSoft
		6	*
		7	* Licensed under the Apache License, Version 2.0 (the "License");
		8	* you may not use this file except in compliance with the License.
		9	* You may obtain a copy of the License at
		10	*
		11	* http://www.apache.org/licenses/LICENSE-2.0
		12	*
		13	* Unless required by applicable law or agreed to in writing, software
		14	* distributed under the License is distributed on an "AS IS" BASIS,
		15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		16	* See the License for the specific language governing permissions and
		17	* limitations under the License.
		18	*/
		19
		20	class OIDplusPageRaChangeEMail extends OIDplusPagePlugin {
		21	public function type() {
		22	return 'ra';
		23	}
		24
		25	public function priority() {
		26	return 102;
		27	}
		28
		29	public function action(&$handled) {
		30	if ($_POST["action"] == "change_ra_email") {
		31	$handled = true;
		32
		33	if (!OIDplus::config()->getValue('allow_ra_email_change')) {
		34	die('This functionality has been disabled by the administrator.');
		35	}
		36
		37	$old_email = $_POST['old_email'];
		38	$new_email = $_POST['new_email'];
		39
		40	if (!OIDplus::authUtils()::isRaLoggedIn($old_email) && !OIDplus::authUtils()::isAdminLoggedIn()) {
		41	die('Authentification error. Please log in as the RA to update its email address.');
		42	}
		43
104	daniel-mar	44	if (!oidplus_valid_email($new_email)) {
61	daniel-mar	45	die('eMail address is invalid.');
		46	}
		47
		48	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($old_email)."'");
		49	if (OIDplus::db()->num_rows($res) == 0) {
		50	die('eMail address does not exist anymore. It was probably already changed.');
		51	}
		52
		53	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($new_email)."'");
		54	if (OIDplus::db()->num_rows($res) > 0) {
		55	die('eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.');
		56	}
		57
		58	$timestamp = time();
		59	$activate_url = OIDplus::system_url() . '?goto='.urlencode('oidplus:activate_new_ra_email$'.$old_email.'$'.$new_email.'$'.$timestamp.'$'.OIDplus::authUtils()::makeAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp));
		60
		61	$message = file_get_contents(__DIR__ . '/change_request_email.tpl');
		62	$message = str_replace('{{SYSTEM_URL}}', OIDplus::system_url(), $message);
		63	$message = str_replace('{{SYSTEM_TITLE}}', OIDplus::config()->systemTitle(), $message);
76	daniel-mar	64	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
61	daniel-mar	65	$message = str_replace('{{OLD_EMAIL}}', $old_email, $message);
		66	$message = str_replace('{{NEW_EMAIL}}', $new_email, $message);
		67	$message = str_replace('{{ACTIVATE_URL}}', $activate_url, $message);
		68	my_mail($new_email, OIDplus::config()->systemTitle().' - Change email request', $message);
		69
		70	die('OK');
		71	} else if ($_POST["action"] == "activate_new_ra_email") {
		72	$handled = true;
		73
		74	if (!OIDplus::config()->getValue('allow_ra_email_change')) {
		75	die('This functionality has been disabled by the administrator.');
		76	}
		77
		78	$old_email = $_POST['old_email'];
		79	$new_email = $_POST['new_email'];
		80	$password = $_POST['password'];
		81
		82	$auth = $_POST['auth'];
		83	$timestamp = $_POST['timestamp'];
		84
		85	if (!OIDplus::authUtils()::validateAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp, $auth)) {
		86	die('Invalid auth key');
		87	}
		88
		89	if ((OIDplus::config()->getValue('max_ra_email_change_time') > 0) && (time()-$timestamp > OIDplus::config()->maxEmailChangeTime())) {
		90	die('Activation link expired!');
		91	}
		92
		93	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($old_email)."'");
		94	if (OIDplus::db()->num_rows($res) == 0) {
		95	die('eMail address does not exist anymore. It was probably already changed.');
		96	}
		97
		98	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($new_email)."'");
		99	if (OIDplus::db()->num_rows($res) > 0) {
		100	die('eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.');
		101	}
		102
		103	$ra = new OIDplusRA($old_email);
		104	if (!$ra->checkPassword($password)) {
		105	die('Wrong password');
		106	}
		107
		108	$ra->change_email($new_email);
		109
		110	if (!OIDplus::db()->query("update ".OIDPLUS_TABLENAME_PREFIX."objects set ra_email = '".OIDplus::db()->real_escape_string($new_email)."' where ra_email = '".OIDplus::db()->real_escape_string($old_email)."'")) {
		111	throw new Exception(OIDplus::db()->error());
		112	}
		113
		114	OIDplus::authUtils()->raLogout($old_email);
		115	OIDplus::authUtils()->raLogin($new_email);
		116
		117	$message = file_get_contents(__DIR__ . '/email_change_confirmation.tpl');
		118	$message = str_replace('{{SYSTEM_URL}}', OIDplus::system_url(), $message);
		119	$message = str_replace('{{SYSTEM_TITLE}}', OIDplus::config()->systemTitle(), $message);
76	daniel-mar	120	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
61	daniel-mar	121	$message = str_replace('{{OLD_EMAIL}}', $old_email, $message);
		122	$message = str_replace('{{NEW_EMAIL}}', $new_email, $message);
		123	my_mail($old_email, OIDplus::config()->systemTitle().' - eMail address changed', $message);
		124
		125	die('OK');
		126	}
		127	}
		128
75	daniel-mar	129	public function init($html=true) {
		130	OIDplus::config()->prepareConfigKey('max_ra_email_change_time', 'Max RA email change time in seconds (0 = infinite)', '0', 0, 1);
		131	OIDplus::config()->prepareConfigKey('allow_ra_email_change', 'Allow that RAs change their email address (0/1)', '1', 0, 1);
61	daniel-mar	132	}
		133
		134	public function cfgSetValue($name, $value) {
		135	if ($name == 'allow_ra_email_change') {
		136	if (($value != '0') && ($value != '1')) {
		137	throw new Exception("Please enter either 0 or 1.");
		138	}
		139	}
		140	if (($name == 'max_ra_invite_time') \|\| ($name == 'max_ra_pwd_reset_time') \|\| ($name == 'max_ra_email_change_time')) {
		141	if (!is_numeric($value) \|\| ($value < 0)) {
		142	throw new Exception("Please enter a valid value.");
		143	}
		144	}
		145	}
		146
		147	public function gui($id, &$out, &$handled) {
		148	if (explode('$',$id)[0] == 'oidplus:change_ra_email') {
		149	$handled = true;
		150	$out['title'] = 'Change RA email';
		151	$out['icon'] = file_exists(__DIR__.'/icon_big.png') ? 'plugins/raPages/'.basename(__DIR__).'/icon_big.png' : '';
		152
		153	$ra_email = explode('$',$id)[1];
		154
		155	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($ra_email)."'");
		156	if (OIDplus::db()->num_rows($res) == 0) {
		157	$out['icon'] = 'img/error_big.png';
		158	$out['text'] = 'RA <b>'.htmlentities($ra_email).'</b> does not exist';
		159	} else if (!OIDplus::config()->getValue('allow_ra_email_change')) {
		160	$out['icon'] = 'img/error_big.png';
		161	$out['text'] .= '<p>This functionality has been disabled by the administrator.</p>';
		162	} else if (!OIDplus::authUtils()::isRaLoggedIn($ra_email) && !OIDplus::authUtils()::isAdminLoggedIn()) {
		163	$out['icon'] = 'img/error_big.png';
		164	$out['text'] .= '<p>You need to <a href="?goto=oidplus:login">log in</a> as the requested RA <b>'.htmlentities($ra_email).'</b>.</p>';
		165	} else {
		166	$out['text'] .= '<form id="changeRaEmailForm" onsubmit="return changeRaEmailFormOnSubmit();">';
		167	$out['text'] .= '<input type="hidden" id="old_email" value="'.htmlentities($ra_email).'"/><br>';
		168	$out['text'] .= '<label class="padding_label">Old address:</label><b>'.htmlentities($ra_email).'</b><br><br>';
		169	$out['text'] .= '<label class="padding_label">New address:</label><input type="text" id="new_email" value=""/><br><br>';
		170	$out['text'] .= '<input type="submit" value="Send new activation email"></form>';
		171	}
		172	} else if (explode('$',$id)[0] == 'oidplus:activate_new_ra_email') {
		173	$handled = true;
		174
		175	$old_email = explode('$',$id)[1];
		176	$new_email = explode('$',$id)[2];
		177	$timestamp = explode('$',$id)[3];
		178	$auth = explode('$',$id)[4];
		179
		180	if (!OIDplus::config()->getValue('allow_ra_email_change')) {
		181	$out['icon'] = 'img/error_big.png';
		182	$out['text'] .= '<p>This functionality has been disabled by the administrator.</p>';
		183	} else {
		184	$out['title'] = 'Perform email address change';
		185	$out['icon'] = file_exists(__DIR__.'/icon_big.png') ? 'plugins/raPages/'.basename(__DIR__).'/icon_big.png' : '';
		186
		187	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($old_email)."'");
		188	if (OIDplus::db()->num_rows($res) == 0) {
		189	$out['icon'] = 'img/error_big.png';
		190	$out['text'] = 'eMail address does not exist anymore. It was probably already changed.';
		191	} else {
		192	$res = OIDplus::db()->query("select * from ".OIDPLUS_TABLENAME_PREFIX."ra where email = '".OIDplus::db()->real_escape_string($new_email)."'");
		193	if (OIDplus::db()->num_rows($res) > 0) {
		194	$out['icon'] = 'img/error_big.png';
		195	$out['text'] = 'eMail address is already used by another RA. To merge accounts, please contact the superior RA of your objects and request an owner change of your objects.';
		196	} else {
		197	if (!OIDplus::authUtils()::validateAuthKey('activate_new_ra_email;'.$old_email.';'.$new_email.';'.$timestamp, $auth)) {
		198	$out['icon'] = 'img/error_big.png';
		199	$out['text'] = 'Invalid authorization. Is the URL OK?';
		200	} else {
		201	$out['text'] = '<p>Old eMail-Address: <b>'.$old_email.'</b></p>
		202	<p>New eMail-Address: <b>'.$new_email.'</b></p>
		203
		204	<form id="activateNewRaEmailForm" onsubmit="return activateNewRaEmailFormOnSubmit();">
		205	<input type="hidden" id="old_email" value="'.htmlentities($old_email).'"/>
		206	<input type="hidden" id="new_email" value="'.htmlentities($new_email).'"/>
		207	<input type="hidden" id="timestamp" value="'.htmlentities($timestamp).'"/>
		208	<input type="hidden" id="auth" value="'.htmlentities($auth).'"/>
		209
		210	<label class="padding_label">Please verify your password:</label><input type="password" id="password" value=""/><br><br>
		211	<input type="submit" value="Change email address">
		212	</form>';
		213	}
		214	}
		215	}
		216	}
		217	}
		218	}
		219
106	daniel-mar	220	public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') {
61	daniel-mar	221	if (file_exists(__DIR__.'/treeicon.png')) {
		222	$tree_icon = 'plugins/raPages/'.basename(__DIR__).'/treeicon.png';
		223	} else {
		224	$tree_icon = null; // default icon (folder)
		225	}
		226
		227	$json[] = array(
		228	'id' => 'oidplus:change_ra_email$'.$ra_email,
		229	'icon' => $tree_icon,
		230	'text' => 'Change email address'
		231	);
104	daniel-mar	232
		233	return true;
61	daniel-mar	234	}
		235	}
		236
		237	OIDplus::registerPagePlugin(new OIDplusPageRaChangeEMail());

Subversion Repositories oidplus

oidplus/trunk/plugins/raPages/102_change_email/plugin.inc.php – Rev 106