account_ownership_form() - Code Metrics - BOINC/boinc - Measure and Improve Code Quality continuously with Scrutinizer

account_ownership_form() B
last analyzed 2025-11-23 23:09 UTC

↳ Parent: Project

Complexity

Conditions	6
Paths	17

Size

Total Lines	45
Code Lines	23

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	6
eloc	23
nc	17
nop	1
dl	0
loc	45
rs	8.9297
c	0
b	0
f	0

<?php
// This file is part of BOINC.
// http://boinc.berkeley.edu
// Copyright (C) 2008 University of California
//
// BOINC is free software; you can redistribute it and/or modify it
// under the terms of the GNU Lesser General Public License
// as published by the Free Software Foundation,
// either version 3 of the License, or (at your option) any later version.
//
// BOINC is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
// See the GNU Lesser General Public License for more details.
//
// You should have received a copy of the GNU Lesser General Public License
// along with BOINC.  If not, see <http://www.gnu.org/licenses/>.

require_once("../inc/boinc_db.inc");
require_once("../inc/user.inc");
require_once("../inc/util.inc");
require_once("../inc/countries.inc");
require_once('../inc/recaptchalib.inc');

check_get_args(array("tnow", "ttok"));

$user = get_logged_in_user();
check_tokens($user->authenticator);

function account_ownership_action($user) {
  // POST request - the user has submitted the form.
  page_head(tra("Proof of account ownership results"), null, null, null, boinc_recaptcha_get_head_extra());

  if (recaptcha_private_key()) {
      // Recaptcha is enabled on the BOINC server
      if (!boinc_recaptcha_isValidated(recaptcha_private_key())) {
          // The user failed to solve the recaptcha prompt - redirect them to an error message!
          error_page(
              tra("Your reCAPTCHA response was not correct. Please try again.")
          );
      }
  }

  // Input is passed in from the openssl_sign_form
  $user_data = htmlentities(post_str("user_data", true), ENT_QUOTES, "UTF-8"); // Convert special characters to html equivelant

  if ((strlen($user_data) > 0) && (strlen($user_data) <= 4096)) {
      require_once("../inc/account_ownership.inc");
      // Check that the private key file exists where specified. If not, redirect to error page.
      if (!file_exists($account_ownership_private_key_file_path)) {

          error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }

      // Check that the public key file exists where specified. If not, redirect to error page.
      if (!file_exists($account_ownership_public_key_file_path)) {

          error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }

      $privkey = fopen($account_ownership_private_key_file_path, "r"); // Opening private key file
      if (!isset($privkey) || empty($privkey)) {
        error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }
      $privkey_contents = fread($privkey, 8192); // Reading contents of private key into var
      fclose($privkey); // Closing private key file

      $userid = $user->id; // Retrieving the user's UserId
      $message_data = "$userid $user_data"; // Create the message which will be signed.

      $private_key_pem = openssl_pkey_get_private($privkey_contents); // Loading the private key into memory
      openssl_sign($message_data, $signature, $private_key_pem, OPENSSL_ALGO_SHA512); // Compute signature using SHA512
      openssl_free_key($private_key_pem); // Free the private key from memory for additional security

      $pubkey = fopen($account_ownership_public_key_file_path, "r"); // Open public key file
      if ((!isset($pubkey)) || empty($pubkey)) {
        error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }
      $pubkey_contents = fread($pubkey, 8192); // Read contents to var
      fclose($pubkey); // Close pub key file

      $base64_sig = base64_encode($signature); // Base64 encode the generated signature to enable safe output to text file.
      $decoded_sig = base64_decode($base64_sig); // Decode base64 sig for use in sig_verification
      $pubkeyid = openssl_pkey_get_public($pubkey_contents); // fetch public key into memory
      $sig_verification = openssl_verify($message_data, $decoded_sig, $pubkeyid, OPENSSL_ALGO_SHA512); // Verify that the generated signature against the original data, using the public key.
      openssl_free_key($pubkeyid); // Free the public key from memory

      // Check if signature was successfully validated
      if ($sig_verification == 1) {
          $url_tokens = url_tokens($user->authenticator);
          // The generated signature has been successfully verified using the public key.
          $master_url = master_url();
          echo "<p>Do not share this information with anyone other than the external system which has requested this proof of account ownership.</p>";
          echo "<textarea rows='13' cols='50' id='result_textbox'><account_ownership_verification>\n<master_url>$master_url</master_url>\n<msg>$message_data</msg>\n<signature>$base64_sig</signature>\n</account_ownership_verification></textarea>";
          echo "<br/><br/><button class='btn btn-success' onclick='copy_result_textbox()'>Copy text</button>";
          echo "<a href='account_ownership.php?$url_tokens'><button class='btn btn-default'>Go back</button></a>";
          echo '<script type="text/javascript">';
          echo 'function copy_result_textbox() {
                var target_textbox = document.getElementById("result_textbox");
                target_textbox.select();
                document.execCommand("copy");
                alert("Copied to clipboard");
              }';
          echo '</script>';
          page_tail();

      } elseif ($sig_verification == 0) {
          // The generated signature has not been verified. The private/public keys do not match.
          error_page(tra("Signature verification failed. Contact the project administrator to resolve the issue."));
      } else {
          // Something has gone wrong & an error has occurred.
          error_page(tra("An error occurred during the signature verification. Contact the project administrator to resolve the issue."));
      }
  } else {
      // User data input invalid
      error_page(tra("Invalid input. User input must have a length > 0 and < 4096. <form><input type='button' value='Go back!'' onclick='history.back()'></form>"));
  }
}

function account_ownership_form($user) {
  // GET request - the user has navigated to the page.
  page_head(tra("Generate proof of account ownership"), null, null, null, boinc_recaptcha_get_head_extra());

  if ($user) { // Verify the user is logged in
      require_once("../inc/account_ownership.inc");

      if (!file_exists($account_ownership_private_key_file_path)) {

          // Check that the private key file exists where specified. If not, redirect to error page.
          error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }

      if (!file_exists($account_ownership_public_key_file_path)) {

          // Check that the public key file exists where specified. If not, redirect to error page.
          error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
      }

      echo "<p>This tool is designed to create a proof of account ownership for external systems.</p>";

      if (recaptcha_public_key()) {
          // Recaptcha configured
          echo "<p>Enter a message with length less than 4096 characters into the input textbox below, solve the captcha then click the 'Generate' button.</p>";
      } else {
          // Recaptcha not configured
          echo "<p>Enter a message with length less than 4096 characters into the input textbox below then click the 'Generate' button.</p>";
      }
      echo "<p>A textbox will then appear which contains your proof of account ownership.";
      echo "<form method=post action=account_ownership.php>";

      echo form_tokens($user->authenticator);
      echo "<textarea rows='4' cols='50' name=user_data type=text size=20 placeholder='Enter text'></textarea><br/><br/>";

      if (recaptcha_public_key()) {
          // Trigger recaptcha!
          form_general("", boinc_recaptcha_get_html(recaptcha_public_key()));
      }

      echo "<input class=\"btn btn-success\" type=submit value='".tra("Generate")."'>";
      echo "</form><br/><hr/>";
  } else {
      // The user is not logged in!
      echo "<p>You need to be logged in to use this functionality.</p>";
  }

  page_tail();
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    account_ownership_action($user);
} else {
    account_ownership_form($user);
}

?>


1			<?php
2			// This file is part of BOINC.
3			// http://boinc.berkeley.edu
4			// Copyright (C) 2008 University of California
5			//
6			// BOINC is free software; you can redistribute it and/or modify it
7			// under the terms of the GNU Lesser General Public License
8			// as published by the Free Software Foundation,
9			// either version 3 of the License, or (at your option) any later version.
10			//
11			// BOINC is distributed in the hope that it will be useful,
12			// but WITHOUT ANY WARRANTY; without even the implied warranty of
13			// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14			// See the GNU Lesser General Public License for more details.
15			//
16			// You should have received a copy of the GNU Lesser General Public License
17			// along with BOINC. If not, see <http://www.gnu.org/licenses/>.
18
19			require_once("../inc/boinc_db.inc");
20			require_once("../inc/user.inc");
21			require_once("../inc/util.inc");
22			require_once("../inc/countries.inc");
23			require_once('../inc/recaptchalib.inc');
24
25			check_get_args(array("tnow", "ttok"));
26
27			$user = get_logged_in_user();
28			check_tokens($user->authenticator);
29
30			function account_ownership_action($user) {
31			// POST request - the user has submitted the form.
32			page_head(tra("Proof of account ownership results"), null, null, null, boinc_recaptcha_get_head_extra());
33
34			if (recaptcha_private_key()) {
35			// Recaptcha is enabled on the BOINC server
36			if (!boinc_recaptcha_isValidated(recaptcha_private_key())) {
37			// The user failed to solve the recaptcha prompt - redirect them to an error message!
38			error_page(
39			tra("Your reCAPTCHA response was not correct. Please try again.")
40			);
41			}
42			}
43
44			// Input is passed in from the openssl_sign_form
45			$user_data = htmlentities(post_str("user_data", true), ENT_QUOTES, "UTF-8"); // Convert special characters to html equivelant
46
47			if ((strlen($user_data) > 0) && (strlen($user_data) <= 4096)) {
48			require_once("../inc/account_ownership.inc");
49			// Check that the private key file exists where specified. If not, redirect to error page.
50			if (!file_exists($account_ownership_private_key_file_path)) {
			0 ignored issues – show Comprehensibility Best Practice introduced 2019-05-10 18:50 UTC by Report Bug Copy Issue Report The variable `$account_ownership_private_key_file_path` seems to be never defined. Loading history...
51			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
52			}
53
54			// Check that the public key file exists where specified. If not, redirect to error page.
55			if (!file_exists($account_ownership_public_key_file_path)) {
			0 ignored issues – show Comprehensibility Best Practice introduced 2019-05-10 18:50 UTC by Report Bug Copy Issue Report The variable `$account_ownership_public_key_file_path` seems to be never defined. Loading history...
56			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
57			}
58
59			$privkey = fopen($account_ownership_private_key_file_path, "r"); // Opening private key file
60			if (!isset($privkey) \|\| empty($privkey)) {
61			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
62			}
63			$privkey_contents = fread($privkey, 8192); // Reading contents of private key into var
64			fclose($privkey); // Closing private key file
65
66			$userid = $user->id; // Retrieving the user's UserId
67			$message_data = "$userid $user_data"; // Create the message which will be signed.
68
69			$private_key_pem = openssl_pkey_get_private($privkey_contents); // Loading the private key into memory
70			openssl_sign($message_data, $signature, $private_key_pem, OPENSSL_ALGO_SHA512); // Compute signature using SHA512
71			openssl_free_key($private_key_pem); // Free the private key from memory for additional security
72
73			$pubkey = fopen($account_ownership_public_key_file_path, "r"); // Open public key file
74			if ((!isset($pubkey)) \|\| empty($pubkey)) {
75			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
76			}
77			$pubkey_contents = fread($pubkey, 8192); // Read contents to var
78			fclose($pubkey); // Close pub key file
79
80			$base64_sig = base64_encode($signature); // Base64 encode the generated signature to enable safe output to text file.
81			$decoded_sig = base64_decode($base64_sig); // Decode base64 sig for use in sig_verification
82			$pubkeyid = openssl_pkey_get_public($pubkey_contents); // fetch public key into memory
83			$sig_verification = openssl_verify($message_data, $decoded_sig, $pubkeyid, OPENSSL_ALGO_SHA512); // Verify that the generated signature against the original data, using the public key.
84			openssl_free_key($pubkeyid); // Free the public key from memory
85
86			// Check if signature was successfully validated
87			if ($sig_verification == 1) {
88			$url_tokens = url_tokens($user->authenticator);
89			// The generated signature has been successfully verified using the public key.
90			$master_url = master_url();
91			echo "<p>Do not share this information with anyone other than the external system which has requested this proof of account ownership.</p>";
92			echo "<textarea rows='13' cols='50' id='result_textbox'><account_ownership_verification>\n<master_url>$master_url</master_url>\n<msg>$message_data</msg>\n<signature>$base64_sig</signature>\n</account_ownership_verification></textarea>";
93			echo "<br/><br/><button class='btn btn-success' onclick='copy_result_textbox()'>Copy text</button>";
94			echo "<a href='account_ownership.php?$url_tokens'><button class='btn btn-default'>Go back</button></a>";
95			echo '<script type="text/javascript">';
96			echo 'function copy_result_textbox() {
97			var target_textbox = document.getElementById("result_textbox");
98			target_textbox.select();
99			document.execCommand("copy");
100			alert("Copied to clipboard");
101			}';
102			echo '</script>';
103			page_tail();
104
105			} elseif ($sig_verification == 0) {
106			// The generated signature has not been verified. The private/public keys do not match.
107			error_page(tra("Signature verification failed. Contact the project administrator to resolve the issue."));
108			} else {
109			// Something has gone wrong & an error has occurred.
110			error_page(tra("An error occurred during the signature verification. Contact the project administrator to resolve the issue."));
111			}
112			} else {
113			// User data input invalid
114			error_page(tra("Invalid input. User input must have a length > 0 and < 4096. <form><input type='button' value='Go back!'' onclick='history.back()'></form>"));
115			}
116			}
117
118			function account_ownership_form($user) {
119			// GET request - the user has navigated to the page.
120			page_head(tra("Generate proof of account ownership"), null, null, null, boinc_recaptcha_get_head_extra());
121
122			if ($user) { // Verify the user is logged in
123			require_once("../inc/account_ownership.inc");
124
125			if (!file_exists($account_ownership_private_key_file_path)) {
			0 ignored issues – show Comprehensibility Best Practice introduced 2019-05-10 18:50 UTC by Report Bug Copy Issue Report The variable `$account_ownership_private_key_file_path` seems to be never defined. Loading history...
126			// Check that the private key file exists where specified. If not, redirect to error page.
127			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
128			}
129
130			if (!file_exists($account_ownership_public_key_file_path)) {
			0 ignored issues – show Comprehensibility Best Practice introduced 2019-05-10 18:50 UTC by Report Bug Copy Issue Report The variable `$account_ownership_public_key_file_path` seems to be never defined. Loading history...
131			// Check that the public key file exists where specified. If not, redirect to error page.
132			error_page(tra("The proof of account ownership feature is not set up properly. Contact the project administrator to resolve the issue."));
133			}
134
135			echo "<p>This tool is designed to create a proof of account ownership for external systems.</p>";
136
137			if (recaptcha_public_key()) {
138			// Recaptcha configured
139			echo "<p>Enter a message with length less than 4096 characters into the input textbox below, solve the captcha then click the 'Generate' button.</p>";
140			} else {
141			// Recaptcha not configured
142			echo "<p>Enter a message with length less than 4096 characters into the input textbox below then click the 'Generate' button.</p>";
143			}
144			echo "<p>A textbox will then appear which contains your proof of account ownership.";
145			echo "<form method=post action=account_ownership.php>";
146
147			echo form_tokens($user->authenticator);
148			echo "<textarea rows='4' cols='50' name=user_data type=text size=20 placeholder='Enter text'></textarea><br/><br/>";
149
150			if (recaptcha_public_key()) {
151			// Trigger recaptcha!
152			form_general("", boinc_recaptcha_get_html(recaptcha_public_key()));
153			}
154
155			echo "<input class=\"btn btn-success\" type=submit value='".tra("Generate")."'>";
156			echo "</form><br/><hr/>";
157			} else {
158			// The user is not logged in!
159			echo "<p>You need to be logged in to use this functionality.</p>";
160			}
161
162			page_tail();
163			}
164
165			if ($_SERVER['REQUEST_METHOD'] === 'POST') {
166			account_ownership_action($user);
167			} else {
168			account_ownership_form($user);
169			}
170
171			?>
172

BOINC / boinc

account_ownership_form() B last analyzed 2025-11-23 23:09 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

account_ownership_form() B
last analyzed 2025-11-23 23:09 UTC