|
1
|
|
|
<?php |
|
|
|
|
|
|
2
|
|
|
|
|
3
|
|
|
use BZIon\Composer\ConfigHandler; |
|
4
|
|
|
use Symfony\Component\HttpFoundation\RedirectResponse; |
|
5
|
|
|
use Symfony\Component\HttpFoundation\Request; |
|
6
|
|
|
use Symfony\Component\HttpFoundation\Session\Session; |
|
7
|
|
|
use Symfony\Component\Yaml\Yaml; |
|
8
|
|
|
|
|
9
|
1 |
|
require_once __DIR__ . '/../includes/checkToken.php'; |
|
10
|
|
|
|
|
11
|
|
|
class LoginController extends HTMLController |
|
12
|
|
|
{ |
|
13
|
1 |
|
public function loginAction(Request $request, Player $me) |
|
14
|
|
|
{ |
|
15
|
1 |
|
if ($me->isValid()) { |
|
16
|
1 |
|
throw new ForbiddenException("You are already logged in!"); |
|
17
|
|
|
} |
|
18
|
|
|
|
|
19
|
1 |
|
$query = $request->query; |
|
20
|
1 |
|
$session = $request->getSession(); |
|
21
|
|
|
|
|
22
|
1 |
|
$token = $query->get("token"); |
|
23
|
1 |
|
$username = $query->get("username"); |
|
24
|
|
|
|
|
25
|
1 |
|
if (!$token || !$username) { |
|
26
|
1 |
|
throw new BadRequestException(); |
|
27
|
|
|
} |
|
28
|
|
|
|
|
29
|
|
|
// Don't check whether IPs match if we're on a development environment |
|
30
|
|
|
$checkIP = !$this->isDebug(); |
|
31
|
|
|
$info = validate_token($token, $username, array(), $checkIP); |
|
32
|
|
|
|
|
33
|
|
|
if (!isset($info)) { |
|
34
|
|
|
throw new ForbiddenException("There was an error processing your login. Please go back and try again."); |
|
35
|
|
|
} |
|
36
|
|
|
|
|
37
|
|
|
$session->set("username", $info['username']); |
|
38
|
|
|
$session->set("groups", $info['groups']); |
|
39
|
|
|
|
|
40
|
|
|
$redirectToProfile = false; |
|
41
|
|
|
|
|
42
|
|
|
if (!Player::playerBZIDExists($info['bzid'])) { |
|
43
|
|
|
// If they're new, redirect to their profile page so they can add some info |
|
44
|
|
|
$player = Player::newPlayer($info['bzid'], $info['username']); |
|
45
|
|
|
$redirectToProfile = true; |
|
46
|
|
|
} else { |
|
47
|
|
|
$player = Player::getFromBZID($info['bzid']); |
|
48
|
|
|
|
|
49
|
|
|
if ($player->isDeleted()) { |
|
50
|
|
|
$player->setStatus('active'); |
|
51
|
|
|
} |
|
52
|
|
|
} |
|
53
|
|
|
|
|
54
|
|
|
$session->set("playerId", $player->getId()); |
|
55
|
|
|
$player->updateLastLogin(); |
|
56
|
|
|
|
|
57
|
|
|
$player->setUsername($info['username']); |
|
58
|
|
|
Visit::enterVisit($player->getId(), |
|
59
|
|
|
$request->getClientIp(), |
|
60
|
|
|
gethostbyaddr($request->getClientIp()), |
|
61
|
|
|
$request->server->get('HTTP_USER_AGENT'), |
|
62
|
|
|
$request->server->get('HTTP_REFERER')); |
|
63
|
|
|
$this->configPromoteAdmin($player); |
|
64
|
|
|
|
|
65
|
|
|
if ($redirectToProfile) { |
|
66
|
|
|
$profile = Service::getGenerator()->generate('profile_show'); |
|
67
|
|
|
|
|
68
|
|
|
return new RedirectResponse($profile); |
|
69
|
|
|
} else { |
|
70
|
|
|
return $this->goBack(); |
|
71
|
|
|
} |
|
72
|
|
|
} |
|
73
|
|
|
|
|
74
|
1 |
|
public function logoutAction(Session $session) |
|
75
|
|
|
{ |
|
76
|
1 |
|
$session->invalidate(); |
|
77
|
1 |
|
$session->getFlashBag()->add('success', "You logged out successfully"); |
|
78
|
|
|
|
|
79
|
|
|
// Don't redirect back but prefer going home, to prevent visiting |
|
80
|
|
|
// the login page (and logging in again, thus preventing the logout) |
|
81
|
|
|
// or other pages where authentication is required |
|
82
|
1 |
|
return $this->goHome(); |
|
83
|
|
|
} |
|
84
|
|
|
|
|
85
|
1 |
|
public function loginAsTestUserAction(Session $session, Player $user) |
|
86
|
|
|
{ |
|
87
|
1 |
|
if (!$this->isDebug() && !Service::getEnvironment() === 'test') { |
|
88
|
|
|
throw new Exception("You are not allowed to login as a test user."); |
|
89
|
|
|
} |
|
90
|
|
|
|
|
91
|
1 |
|
if (!$user->isTestUser()) { |
|
92
|
|
|
throw new Exception("The player you specified is not a test user!"); |
|
93
|
|
|
} |
|
94
|
|
|
|
|
95
|
1 |
|
$session->set("playerId", $user->getId()); |
|
96
|
1 |
|
$session->set("username", $user->getUsername()); |
|
97
|
|
|
|
|
98
|
1 |
|
return $this->goHome(); |
|
99
|
|
|
} |
|
100
|
|
|
|
|
101
|
|
|
/** |
|
102
|
|
|
* Promote a player to an admin if the configuration file specifies so |
|
103
|
|
|
* |
|
104
|
|
|
* @param Player $player The player in question |
|
105
|
|
|
*/ |
|
106
|
|
|
private function configPromoteAdmin(Player $player) |
|
107
|
|
|
{ |
|
108
|
|
|
$adminUsername = $this->container->getParameter('bzion.miscellaneous.admin'); |
|
109
|
|
|
|
|
110
|
|
|
if (!$adminUsername) { |
|
111
|
|
|
return; |
|
112
|
|
|
} |
|
113
|
|
|
|
|
114
|
|
|
if (strtolower($player->getUsername()) === strtolower($adminUsername)) { |
|
115
|
|
|
$player->addRole(Player::DEVELOPER); |
|
116
|
|
|
|
|
117
|
|
|
// Remove the username from the configuration file so that we don't |
|
118
|
|
|
// give admin permissions to the wrong person in case callsign |
|
119
|
|
|
// changes take place. This is supposed to happen only once, so we |
|
120
|
|
|
// don't need to worry about the performance overhead due to the |
|
121
|
|
|
// parsing and dumping of the YML file |
|
122
|
|
|
$path = ConfigHandler::getConfigurationPath(); |
|
123
|
|
|
$config = Yaml::parse($path); |
|
124
|
|
|
$config['bzion']['miscellaneous']['admin'] = null; |
|
125
|
|
|
file_put_contents($path, Yaml::dump($config, 4)); |
|
126
|
|
|
|
|
127
|
|
|
$this->getLogger()->notice(sprintf( |
|
128
|
|
|
"User %s with BZID %s is now an administrator, as instructed by the configuration file", |
|
129
|
|
|
$adminUsername, |
|
130
|
|
|
$player->getBZID() |
|
131
|
|
|
)); |
|
132
|
|
|
} |
|
133
|
|
|
} |
|
134
|
|
|
} |
|
135
|
|
|
|
allejo /
bzion
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.