WebSVN – oidplus – Diff – /trunk/plugins/viathinksoft/publicPages/091_forgot_password/OIDplusPagePublicForgotPassword.class.php


<?php
 
/*
 * OIDplus 2.0
 * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 
if (!defined('INSIDE_OIDPLUS')) die();
 
class OIDplusPagePublicForgotPassword extends OIDplusPagePluginPublic {
 
        public function action($actionID, $params) {
                if ($actionID == 'forgot_password') {
                        _CheckParamExists($params, 'email');
                        $email = $params['email'];
 
                        if (!OIDplus::mailUtils()->validMailAddress($email)) {
                                throw new OIDplusException(_L('Invalid email address'));
                        }
 
                        OIDplus::getActiveCaptchaPlugin()->captchaVerify($params, 'captcha');
 
                        OIDplus::logger()->log("[WARN]RA($email)!", "A new password for '$email' was requested (forgot password)");
 
                        $timestamp = time();
                        $activate_url = OIDplus::webpath(null,false) . '?goto='.urlencode('oidplus:reset_password$'.$email.'$'.$timestamp.'$'.OIDplus::authUtils()->makeAuthKey('reset_password;'.$email.';'.$timestamp));
 
                        $message = $this->getForgotPasswordText($params['email']);
                        $message = str_replace('{{ACTIVATE_URL}}', $activate_url, $message);
 
                        OIDplus::mailUtils()->sendMail($email, OIDplus::config()->getValue('system_title').' - Password reset request', $message, OIDplus::config()->getValue('global_cc'));
 
                        return array("status" => 0);
 
                } else if ($actionID == 'reset_password') {
 
                        _CheckParamExists($params, 'password1');
                        _CheckParamExists($params, 'password2');
                        _CheckParamExists($params, 'email');
                        _CheckParamExists($params, 'auth');
                        _CheckParamExists($params, 'timestamp');
 
                        $password1 = $params['password1'];
                        $password2 = $params['password2'];
                        $email = $params['email'];
                        $auth = $params['auth'];
                        $timestamp = $params['timestamp'];
 
                        if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {
                                throw new OIDplusException(_L('Invalid auth key'));
                        }
 
                        if ((OIDplus::config()->getValue('max_ra_pwd_reset_time') > 0) && (time()-$timestamp > OIDplus::config()->getValue('max_ra_pwd_reset_time'))) {
                                throw new OIDplusException(_L('Invitation expired!'));
                        }
 
                        if ($password1 !== $password2) {
                                throw new OIDplusException(_L('Passwords do not match'));
                        }
 
                        if (strlen($password1) < OIDplus::config()->getValue('ra_min_password_length')) {
                                $minlen = OIDplus::config()->getValue('ra_min_password_length');
                                throw new OIDplusException(_L('Password is too short. Need at least %1 characters',$minlen));
                        }
 
                        OIDplus::logger()->log("[INFO]RA($email)!", "RA '$email' has reset his password (forgot passwort)");
 
                        $ra = new OIDplusRA($email);
                        $ra->change_password($password1);
 
                        return array("status" => 0);
                } else {
                        throw new OIDplusException(_L('Unknown action ID'));
                }
        }
 
        public function init($html=true) {
                OIDplus::config()->prepareConfigKey('max_ra_pwd_reset_time', 'Max RA password reset time in seconds (0 = infinite)', '0', OIDplusConfig::PROTECTION_EDITABLE, function($value) {
                        if (!is_numeric($value) || ($value < 0)) {
                                throw new OIDplusException(_L('Please enter a valid value.'));
                        }
                });
        }
 
        public function gui($id, &$out, &$handled) {
                if (explode('$',$id)[0] == 'oidplus:forgot_password') {
                        $handled = true;
 
                        $out['title'] = _L('Forgot password');
                        $out['icon'] = OIDplus::webpath(__DIR__,true).'img/forgot_password_icon.png';
 
                        try {
                                $out['text'] .= '<p>'._L('Please enter the email address of your account, and information about the password reset will be sent to you.').'</p>
                                  <form id="forgotPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.forgotPasswordFormOnSubmit();">
                                    '._L('E-Mail').': <input type="text" id="email" value=""/><br><br>
                                    '.OIDplus::getActiveCaptchaPlugin()->captchaGenerate().'
                                    <br>
                                    <input type="submit" value="'._L('Send recovery information').'">
                                  </form>';
 
                        } catch (Exception $e) {
 
                                $out['icon'] = 'img/error.png';
                                $out['text'] = '<p>'._L('Error: %1',htmlentities($e->getMessage())).'</p>';
 
                        }
                } else if (explode('$',$id)[0] == 'oidplus:reset_password') {
                        $handled = true;
 
                        $email = explode('$',$id)[1];
                        $timestamp = explode('$',$id)[2];
                        $auth = explode('$',$id)[3];
 
                        $out['title'] = _L('Reset password');
                        $out['icon'] = OIDplus::webpath(__DIR__,true).'img/reset_password_icon.png';
 
                        if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {
                                $out['icon'] = 'img/error.png';
                                $out['text'] = _L('Invalid authorization. Is the URL OK?');
                        } else {
                                $out['text'] = '<p>'._L('E-Mail-Address: %1','<b>'.$email.'</b>').'</p>
 
                                  <form id="resetPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.resetPasswordFormOnSubmit();">
                                    <input type="hidden" id="email" value="'.htmlentities($email).'"/>
                                    <input type="hidden" id="timestamp" value="'.htmlentities($timestamp).'"/>
                                    <input type="hidden" id="auth" value="'.htmlentities($auth).'"/>
                                    <div><label class="padding_label">'._L('New password').':</label><input type="password" id="password1" value=""/></div>
                                    <div><label class="padding_label">'._L('Repeat').':</label><input type="password" id="password2" value=""/></div>
                                    <br><input type="submit" value="'._L('Change password').'">
                                  </form>';
                        }
                }
        }
 
        public function publicSitemap(&$out) {
                $out[] = 'oidplus:forgot_password';
        }
 
        public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') {
                return false;
        }
 
        private function getForgotPasswordText($email) {
                $res = OIDplus::db()->query("select * from ###ra where email = ?", array($email));
                if (!$res->any()) {
                        throw new OIDplusException(_L('This RA does not exist.'));
                }
 
                $message = file_get_contents(__DIR__ . '/forgot_password.tpl');
 
                // Resolve stuff
                $message = str_replace('{{SYSTEM_URL}}', OIDplus::webpath(null,false), $message);
                $message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
 
                // {{ACTIVATE_URL}} will be resolved in ajax.php
 
                return $message;
        }
 
        public function tree_search($request) {
                return false;
        }
}
 

Subversion Repositories oidplus

oidplus/trunk/plugins/viathinksoft/publicPages/091_forgot_password/OIDplusPagePublicForgotPassword.class.php – Rev 790 → 800

Rev 790		Rev 800
1	<?php	1	<?php
2		2
3	/*	3	/*
4	* OIDplus 2.0	4	* OIDplus 2.0
5	* Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft	5	* Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
6	*	6	*
7	* Licensed under the Apache License, Version 2.0 (the "License");	7	* Licensed under the Apache License, Version 2.0 (the "License");
8	* you may not use this file except in compliance with the License.	8	* you may not use this file except in compliance with the License.
9	* You may obtain a copy of the License at	9	* You may obtain a copy of the License at
10	*	10	*
11	* http://www.apache.org/licenses/LICENSE-2.0	11	* http://www.apache.org/licenses/LICENSE-2.0
12	*	12	*
13	* Unless required by applicable law or agreed to in writing, software	13	* Unless required by applicable law or agreed to in writing, software
14	* distributed under the License is distributed on an "AS IS" BASIS,	14	* distributed under the License is distributed on an "AS IS" BASIS,
15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.	15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16	* See the License for the specific language governing permissions and	16	* See the License for the specific language governing permissions and
17	* limitations under the License.	17	* limitations under the License.
18	*/	18	*/
19		19
20	if (!defined('INSIDE_OIDPLUS')) die();	20	if (!defined('INSIDE_OIDPLUS')) die();
21		21
22	class OIDplusPagePublicForgotPassword extends OIDplusPagePluginPublic {	22	class OIDplusPagePublicForgotPassword extends OIDplusPagePluginPublic {
23		23
24	public function action($actionID, $params) {	24	public function action($actionID, $params) {
25	if ($actionID == 'forgot_password') {	25	if ($actionID == 'forgot_password') {
26	_CheckParamExists($params, 'email');	26	_CheckParamExists($params, 'email');
27	$email = $params['email'];	27	$email = $params['email'];
28		28
29	if (!OIDplus::mailUtils()->validMailAddress($email)) {	29	if (!OIDplus::mailUtils()->validMailAddress($email)) {
30	throw new OIDplusException(_L('Invalid email address'));	30	throw new OIDplusException(_L('Invalid email address'));
31	}	31	}
32		32
33	OIDplus::getActiveCaptchaPlugin()->captchaVerify($params, 'captcha');	33	OIDplus::getActiveCaptchaPlugin()->captchaVerify($params, 'captcha');
34		34
35	OIDplus::logger()->log("[WARN]RA($email)!", "A new password for '$email' was requested (forgot password)");	35	OIDplus::logger()->log("[WARN]RA($email)!", "A new password for '$email' was requested (forgot password)");
36		36
37	$timestamp = time();	37	$timestamp = time();
38	$activate_url = OIDplus::webpath(null,false) . '?goto='.urlencode('oidplus:reset_password$'.$email.'$'.$timestamp.'$'.OIDplus::authUtils()->makeAuthKey('reset_password;'.$email.';'.$timestamp));	38	$activate_url = OIDplus::webpath(null,false) . '?goto='.urlencode('oidplus:reset_password$'.$email.'$'.$timestamp.'$'.OIDplus::authUtils()->makeAuthKey('reset_password;'.$email.';'.$timestamp));
39		39
40	$message = $this->getForgotPasswordText($params['email']);	40	$message = $this->getForgotPasswordText($params['email']);
41	$message = str_replace('{{ACTIVATE_URL}}', $activate_url, $message);	41	$message = str_replace('{{ACTIVATE_URL}}', $activate_url, $message);
42		42
43	OIDplus::mailUtils()->sendMail($email, OIDplus::config()->getValue('system_title').' - Password reset request', $message, OIDplus::config()->getValue('global_cc'));	43	OIDplus::mailUtils()->sendMail($email, OIDplus::config()->getValue('system_title').' - Password reset request', $message, OIDplus::config()->getValue('global_cc'));
44		44
45	return array("status" => 0);	45	return array("status" => 0);
46		46
47	} else if ($actionID == 'reset_password') {	47	} else if ($actionID == 'reset_password') {
48		48
49	_CheckParamExists($params, 'password1');	49	_CheckParamExists($params, 'password1');
50	_CheckParamExists($params, 'password2');	50	_CheckParamExists($params, 'password2');
51	_CheckParamExists($params, 'email');	51	_CheckParamExists($params, 'email');
52	_CheckParamExists($params, 'auth');	52	_CheckParamExists($params, 'auth');
53	_CheckParamExists($params, 'timestamp');	53	_CheckParamExists($params, 'timestamp');
54		54
55	$password1 = $params['password1'];	55	$password1 = $params['password1'];
56	$password2 = $params['password2'];	56	$password2 = $params['password2'];
57	$email = $params['email'];	57	$email = $params['email'];
58	$auth = $params['auth'];	58	$auth = $params['auth'];
59	$timestamp = $params['timestamp'];	59	$timestamp = $params['timestamp'];
60		60
61	if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {	61	if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {
62	throw new OIDplusException(_L('Invalid auth key'));	62	throw new OIDplusException(_L('Invalid auth key'));
63	}	63	}
64		64
65	if ((OIDplus::config()->getValue('max_ra_pwd_reset_time') > 0) && (time()-$timestamp > OIDplus::config()->getValue('max_ra_pwd_reset_time'))) {	65	if ((OIDplus::config()->getValue('max_ra_pwd_reset_time') > 0) && (time()-$timestamp > OIDplus::config()->getValue('max_ra_pwd_reset_time'))) {
66	throw new OIDplusException(_L('Invitation expired!'));	66	throw new OIDplusException(_L('Invitation expired!'));
67	}	67	}
68		68
69	if ($password1 !== $password2) {	69	if ($password1 !== $password2) {
70	throw new OIDplusException(_L('Passwords do not match'));	70	throw new OIDplusException(_L('Passwords do not match'));
71	}	71	}
72		72
73	if (strlen($password1) < OIDplus::config()->getValue('ra_min_password_length')) {	73	if (strlen($password1) < OIDplus::config()->getValue('ra_min_password_length')) {
74	$minlen = OIDplus::config()->getValue('ra_min_password_length');	74	$minlen = OIDplus::config()->getValue('ra_min_password_length');
75	throw new OIDplusException(_L('Password is too short. Need at least %1 characters',$minlen));	75	throw new OIDplusException(_L('Password is too short. Need at least %1 characters',$minlen));
76	}	76	}
77		77
78	OIDplus::logger()->log("[INFO]RA($email)!", "RA '$email' has reset his password (forgot passwort)");	78	OIDplus::logger()->log("[INFO]RA($email)!", "RA '$email' has reset his password (forgot passwort)");
79		79
80	$ra = new OIDplusRA($email);	80	$ra = new OIDplusRA($email);
81	$ra->change_password($password1);	81	$ra->change_password($password1);
82		82
83	return array("status" => 0);	83	return array("status" => 0);
84	} else {	84	} else {
85	throw new OIDplusException(_L('Unknown action ID'));	85	throw new OIDplusException(_L('Unknown action ID'));
86	}	86	}
87	}	87	}
88		88
89	public function init($html=true) {	89	public function init($html=true) {
90	OIDplus::config()->prepareConfigKey('max_ra_pwd_reset_time', 'Max RA password reset time in seconds (0 = infinite)', '0', OIDplusConfig::PROTECTION_EDITABLE, function($value) {	90	OIDplus::config()->prepareConfigKey('max_ra_pwd_reset_time', 'Max RA password reset time in seconds (0 = infinite)', '0', OIDplusConfig::PROTECTION_EDITABLE, function($value) {
91	if (!is_numeric($value) \|\| ($value < 0)) {	91	if (!is_numeric($value) \|\| ($value < 0)) {
92	throw new OIDplusException(_L('Please enter a valid value.'));	92	throw new OIDplusException(_L('Please enter a valid value.'));
93	}	93	}
94	});	94	});
95	}	95	}
96		96
97	public function gui($id, &$out, &$handled) {	97	public function gui($id, &$out, &$handled) {
98	if (explode('$',$id)[0] == 'oidplus:forgot_password') {	98	if (explode('$',$id)[0] == 'oidplus:forgot_password') {
99	$handled = true;	99	$handled = true;
100		100
101	$out['title'] = _L('Forgot password');	101	$out['title'] = _L('Forgot password');
102	$out['icon'] = OIDplus::webpath(__DIR__).'forgot_password_big.png';	102	$out['icon'] = OIDplus::webpath(__DIR__,true).'img/forgot_password_icon.png';
103		103
104	try {	104	try {
105	$out['text'] .= '<p>'._L('Please enter the email address of your account, and information about the password reset will be sent to you.').'</p>	105	$out['text'] .= '<p>'._L('Please enter the email address of your account, and information about the password reset will be sent to you.').'</p>
106	<form id="forgotPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.forgotPasswordFormOnSubmit();">	106	<form id="forgotPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.forgotPasswordFormOnSubmit();">
107	'._L('E-Mail').': <input type="text" id="email" value=""/><br><br>	107	'._L('E-Mail').': <input type="text" id="email" value=""/><br><br>
108	'.OIDplus::getActiveCaptchaPlugin()->captchaGenerate().'	108	'.OIDplus::getActiveCaptchaPlugin()->captchaGenerate().'
109	<br>	109	<br>
110	<input type="submit" value="'._L('Send recovery information').'">	110	<input type="submit" value="'._L('Send recovery information').'">
111	</form>';	111	</form>';
112		112
113	} catch (Exception $e) {	113	} catch (Exception $e) {
114		114
115	$out['icon'] = 'img/error_big.png';	115	$out['icon'] = 'img/error.png';
116	$out['text'] = '<p>'._L('Error: %1',htmlentities($e->getMessage())).'</p>';	116	$out['text'] = '<p>'._L('Error: %1',htmlentities($e->getMessage())).'</p>';
117		117
118	}	118	}
119	} else if (explode('$',$id)[0] == 'oidplus:reset_password') {	119	} else if (explode('$',$id)[0] == 'oidplus:reset_password') {
120	$handled = true;	120	$handled = true;
121		121
122	$email = explode('$',$id)[1];	122	$email = explode('$',$id)[1];
123	$timestamp = explode('$',$id)[2];	123	$timestamp = explode('$',$id)[2];
124	$auth = explode('$',$id)[3];	124	$auth = explode('$',$id)[3];
125		125
126	$out['title'] = _L('Reset password');	126	$out['title'] = _L('Reset password');
127	$out['icon'] = OIDplus::webpath(__DIR__).'reset_password_big.png';	127	$out['icon'] = OIDplus::webpath(__DIR__,true).'img/reset_password_icon.png';
128		128
129	if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {	129	if (!OIDplus::authUtils()->validateAuthKey('reset_password;'.$email.';'.$timestamp, $auth)) {
130	$out['icon'] = 'img/error_big.png';	130	$out['icon'] = 'img/error.png';
131	$out['text'] = _L('Invalid authorization. Is the URL OK?');	131	$out['text'] = _L('Invalid authorization. Is the URL OK?');
132	} else {	132	} else {
133	$out['text'] = '<p>'._L('E-Mail-Address: %1','<b>'.$email.'</b>').'</p>	133	$out['text'] = '<p>'._L('E-Mail-Address: %1','<b>'.$email.'</b>').'</p>
134		134
135	<form id="resetPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.resetPasswordFormOnSubmit();">	135	<form id="resetPasswordForm" action="javascript:void(0);" onsubmit="return OIDplusPagePublicForgotPassword.resetPasswordFormOnSubmit();">
136	<input type="hidden" id="email" value="'.htmlentities($email).'"/>	136	<input type="hidden" id="email" value="'.htmlentities($email).'"/>
137	<input type="hidden" id="timestamp" value="'.htmlentities($timestamp).'"/>	137	<input type="hidden" id="timestamp" value="'.htmlentities($timestamp).'"/>
138	<input type="hidden" id="auth" value="'.htmlentities($auth).'"/>	138	<input type="hidden" id="auth" value="'.htmlentities($auth).'"/>
139	<div><label class="padding_label">'._L('New password').':</label><input type="password" id="password1" value=""/></div>	139	<div><label class="padding_label">'._L('New password').':</label><input type="password" id="password1" value=""/></div>
140	<div><label class="padding_label">'._L('Repeat').':</label><input type="password" id="password2" value=""/></div>	140	<div><label class="padding_label">'._L('Repeat').':</label><input type="password" id="password2" value=""/></div>
141	<br><input type="submit" value="'._L('Change password').'">	141	<br><input type="submit" value="'._L('Change password').'">
142	</form>';	142	</form>';
143	}	143	}
144	}	144	}
145	}	145	}
146		146
147	public function publicSitemap(&$out) {	147	public function publicSitemap(&$out) {
148	$out[] = 'oidplus:forgot_password';	148	$out[] = 'oidplus:forgot_password';
149	}	149	}
150		150
151	public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') {	151	public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') {
152	return false;	152	return false;
153	}	153	}
154		154
155	private function getForgotPasswordText($email) {	155	private function getForgotPasswordText($email) {
156	$res = OIDplus::db()->query("select * from ###ra where email = ?", array($email));	156	$res = OIDplus::db()->query("select * from ###ra where email = ?", array($email));
157	if (!$res->any()) {	157	if (!$res->any()) {
158	throw new OIDplusException(_L('This RA does not exist.'));	158	throw new OIDplusException(_L('This RA does not exist.'));
159	}	159	}
160		160
161	$message = file_get_contents(__DIR__ . '/forgot_password.tpl');	161	$message = file_get_contents(__DIR__ . '/forgot_password.tpl');
162		162
163	// Resolve stuff	163	// Resolve stuff
164	$message = str_replace('{{SYSTEM_URL}}', OIDplus::webpath(null,false), $message);	164	$message = str_replace('{{SYSTEM_URL}}', OIDplus::webpath(null,false), $message);
165	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);	165	$message = str_replace('{{ADMIN_EMAIL}}', OIDplus::config()->getValue('admin_email'), $message);
166		166
167	// {{ACTIVATE_URL}} will be resolved in ajax.php	167	// {{ACTIVATE_URL}} will be resolved in ajax.php
168		168
169	return $message;	169	return $message;
170	}	170	}
171		171
172	public function tree_search($request) {	172	public function tree_search($request) {
173	return false;	173	return false;
174	}	174	}
175	}	175	}
176		176