@@ -17,134 +17,134 @@ |
||
17 | 17 | |
18 | 18 | class PageOAuth extends InternalPageBase |
19 | 19 | { |
20 | - /** |
|
21 | - * Attach entry point |
|
22 | - * |
|
23 | - * must be posted, or will redirect to preferences |
|
24 | - */ |
|
25 | - protected function attach() |
|
26 | - { |
|
27 | - if (!WebRequest::wasPosted()) { |
|
28 | - $this->redirect('preferences'); |
|
29 | - |
|
30 | - return; |
|
31 | - } |
|
32 | - |
|
33 | - $this->validateCSRFToken(); |
|
34 | - |
|
35 | - $oauthHelper = $this->getOAuthHelper(); |
|
36 | - $user = User::getCurrent($this->getDatabase()); |
|
37 | - |
|
38 | - $requestToken = $oauthHelper->getRequestToken(); |
|
39 | - |
|
40 | - $user->setOAuthRequestToken($requestToken->key); |
|
41 | - $user->setOAuthRequestSecret($requestToken->secret); |
|
42 | - $user->save(); |
|
43 | - |
|
44 | - $this->redirectUrl($oauthHelper->getAuthoriseUrl($requestToken->key)); |
|
45 | - } |
|
46 | - |
|
47 | - /** |
|
48 | - * Detach account entry point |
|
49 | - */ |
|
50 | - protected function detach() |
|
51 | - { |
|
52 | - if ($this->getSiteConfiguration()->getEnforceOAuth()) { |
|
53 | - throw new AccessDeniedException($this->getSecurityManager()); |
|
54 | - } |
|
55 | - |
|
56 | - $user = User::getCurrent($this->getDatabase()); |
|
57 | - |
|
58 | - $user->setOnWikiName($user->getOnWikiName()); |
|
59 | - $user->setOAuthAccessSecret(null); |
|
60 | - $user->setOAuthAccessToken(null); |
|
61 | - $user->setOAuthRequestSecret(null); |
|
62 | - $user->setOAuthRequestToken(null); |
|
63 | - |
|
64 | - $user->clearOAuthData(); |
|
65 | - |
|
66 | - $user->setForcelogout(true); |
|
67 | - |
|
68 | - $user->save(); |
|
69 | - |
|
70 | - // force the user to log out |
|
71 | - Session::destroy(); |
|
72 | - |
|
73 | - $this->redirect('login'); |
|
74 | - } |
|
75 | - |
|
76 | - /** |
|
77 | - * Callback entry point |
|
78 | - */ |
|
79 | - protected function callback() |
|
80 | - { |
|
81 | - $oauthToken = WebRequest::getString('oauth_token'); |
|
82 | - $oauthVerifier = WebRequest::getString('oauth_verifier'); |
|
83 | - |
|
84 | - $this->doCallbackValidation($oauthToken, $oauthVerifier); |
|
85 | - |
|
86 | - $user = User::getByRequestToken($oauthToken, $this->getDatabase()); |
|
87 | - if ($user === false) { |
|
88 | - throw new ApplicationLogicException('Token not found in store, please try again'); |
|
89 | - } |
|
90 | - |
|
91 | - $accessToken = $this->getOAuthHelper()->callbackCompleted( |
|
92 | - $user->getOAuthRequestToken(), |
|
93 | - $user->getOAuthRequestSecret(), |
|
94 | - $oauthVerifier); |
|
95 | - |
|
96 | - $user->setOAuthRequestSecret(null); |
|
97 | - $user->setOAuthRequestToken(null); |
|
98 | - $user->setOAuthAccessToken($accessToken->key); |
|
99 | - $user->setOAuthAccessSecret($accessToken->secret); |
|
100 | - |
|
101 | - // @todo we really should stop doing this kind of thing... it adds performance bottlenecks and breaks 3NF |
|
102 | - $user->setOnWikiName('##OAUTH##'); |
|
103 | - |
|
104 | - $user->save(); |
|
105 | - |
|
106 | - // OK, we're the same session that just did a partial login that was redirected to OAuth. Let's upgrade the |
|
107 | - // login to a full login |
|
108 | - if (WebRequest::getPartialLogin() === $user->getId()) { |
|
109 | - WebRequest::setLoggedInUser($user); |
|
110 | - } |
|
111 | - |
|
112 | - // My thinking is there are three cases here: |
|
113 | - // a) new user => redirect to prefs - it's the only thing they can access other than stats |
|
114 | - // b) existing user hit the connect button in prefs => redirect to prefs since it's where they were |
|
115 | - // c) existing user logging in => redirect to wherever they came from |
|
116 | - $redirectDestination = WebRequest::clearPostLoginRedirect(); |
|
117 | - if ($redirectDestination !== null && !$user->isNewUser()) { |
|
118 | - $this->redirectUrl($redirectDestination); |
|
119 | - } |
|
120 | - else { |
|
121 | - $this->redirect('preferences', null, null, 'internal.php'); |
|
122 | - } |
|
123 | - } |
|
124 | - |
|
125 | - /** |
|
126 | - * Main function for this page, when no specific actions are called. |
|
127 | - * @return void |
|
128 | - */ |
|
129 | - protected function main() |
|
130 | - { |
|
131 | - $this->redirect('preferences'); |
|
132 | - } |
|
133 | - |
|
134 | - /** |
|
135 | - * @param string $oauthToken |
|
136 | - * @param string $oauthVerifier |
|
137 | - * |
|
138 | - * @throws ApplicationLogicException |
|
139 | - */ |
|
140 | - protected function doCallbackValidation($oauthToken, $oauthVerifier) |
|
141 | - { |
|
142 | - if ($oauthToken === null) { |
|
143 | - throw new ApplicationLogicException('No token provided'); |
|
144 | - } |
|
145 | - |
|
146 | - if ($oauthVerifier === null) { |
|
147 | - throw new ApplicationLogicException('No oauth verifier provided.'); |
|
148 | - } |
|
149 | - } |
|
20 | + /** |
|
21 | + * Attach entry point |
|
22 | + * |
|
23 | + * must be posted, or will redirect to preferences |
|
24 | + */ |
|
25 | + protected function attach() |
|
26 | + { |
|
27 | + if (!WebRequest::wasPosted()) { |
|
28 | + $this->redirect('preferences'); |
|
29 | + |
|
30 | + return; |
|
31 | + } |
|
32 | + |
|
33 | + $this->validateCSRFToken(); |
|
34 | + |
|
35 | + $oauthHelper = $this->getOAuthHelper(); |
|
36 | + $user = User::getCurrent($this->getDatabase()); |
|
37 | + |
|
38 | + $requestToken = $oauthHelper->getRequestToken(); |
|
39 | + |
|
40 | + $user->setOAuthRequestToken($requestToken->key); |
|
41 | + $user->setOAuthRequestSecret($requestToken->secret); |
|
42 | + $user->save(); |
|
43 | + |
|
44 | + $this->redirectUrl($oauthHelper->getAuthoriseUrl($requestToken->key)); |
|
45 | + } |
|
46 | + |
|
47 | + /** |
|
48 | + * Detach account entry point |
|
49 | + */ |
|
50 | + protected function detach() |
|
51 | + { |
|
52 | + if ($this->getSiteConfiguration()->getEnforceOAuth()) { |
|
53 | + throw new AccessDeniedException($this->getSecurityManager()); |
|
54 | + } |
|
55 | + |
|
56 | + $user = User::getCurrent($this->getDatabase()); |
|
57 | + |
|
58 | + $user->setOnWikiName($user->getOnWikiName()); |
|
59 | + $user->setOAuthAccessSecret(null); |
|
60 | + $user->setOAuthAccessToken(null); |
|
61 | + $user->setOAuthRequestSecret(null); |
|
62 | + $user->setOAuthRequestToken(null); |
|
63 | + |
|
64 | + $user->clearOAuthData(); |
|
65 | + |
|
66 | + $user->setForcelogout(true); |
|
67 | + |
|
68 | + $user->save(); |
|
69 | + |
|
70 | + // force the user to log out |
|
71 | + Session::destroy(); |
|
72 | + |
|
73 | + $this->redirect('login'); |
|
74 | + } |
|
75 | + |
|
76 | + /** |
|
77 | + * Callback entry point |
|
78 | + */ |
|
79 | + protected function callback() |
|
80 | + { |
|
81 | + $oauthToken = WebRequest::getString('oauth_token'); |
|
82 | + $oauthVerifier = WebRequest::getString('oauth_verifier'); |
|
83 | + |
|
84 | + $this->doCallbackValidation($oauthToken, $oauthVerifier); |
|
85 | + |
|
86 | + $user = User::getByRequestToken($oauthToken, $this->getDatabase()); |
|
87 | + if ($user === false) { |
|
88 | + throw new ApplicationLogicException('Token not found in store, please try again'); |
|
89 | + } |
|
90 | + |
|
91 | + $accessToken = $this->getOAuthHelper()->callbackCompleted( |
|
92 | + $user->getOAuthRequestToken(), |
|
93 | + $user->getOAuthRequestSecret(), |
|
94 | + $oauthVerifier); |
|
95 | + |
|
96 | + $user->setOAuthRequestSecret(null); |
|
97 | + $user->setOAuthRequestToken(null); |
|
98 | + $user->setOAuthAccessToken($accessToken->key); |
|
99 | + $user->setOAuthAccessSecret($accessToken->secret); |
|
100 | + |
|
101 | + // @todo we really should stop doing this kind of thing... it adds performance bottlenecks and breaks 3NF |
|
102 | + $user->setOnWikiName('##OAUTH##'); |
|
103 | + |
|
104 | + $user->save(); |
|
105 | + |
|
106 | + // OK, we're the same session that just did a partial login that was redirected to OAuth. Let's upgrade the |
|
107 | + // login to a full login |
|
108 | + if (WebRequest::getPartialLogin() === $user->getId()) { |
|
109 | + WebRequest::setLoggedInUser($user); |
|
110 | + } |
|
111 | + |
|
112 | + // My thinking is there are three cases here: |
|
113 | + // a) new user => redirect to prefs - it's the only thing they can access other than stats |
|
114 | + // b) existing user hit the connect button in prefs => redirect to prefs since it's where they were |
|
115 | + // c) existing user logging in => redirect to wherever they came from |
|
116 | + $redirectDestination = WebRequest::clearPostLoginRedirect(); |
|
117 | + if ($redirectDestination !== null && !$user->isNewUser()) { |
|
118 | + $this->redirectUrl($redirectDestination); |
|
119 | + } |
|
120 | + else { |
|
121 | + $this->redirect('preferences', null, null, 'internal.php'); |
|
122 | + } |
|
123 | + } |
|
124 | + |
|
125 | + /** |
|
126 | + * Main function for this page, when no specific actions are called. |
|
127 | + * @return void |
|
128 | + */ |
|
129 | + protected function main() |
|
130 | + { |
|
131 | + $this->redirect('preferences'); |
|
132 | + } |
|
133 | + |
|
134 | + /** |
|
135 | + * @param string $oauthToken |
|
136 | + * @param string $oauthVerifier |
|
137 | + * |
|
138 | + * @throws ApplicationLogicException |
|
139 | + */ |
|
140 | + protected function doCallbackValidation($oauthToken, $oauthVerifier) |
|
141 | + { |
|
142 | + if ($oauthToken === null) { |
|
143 | + throw new ApplicationLogicException('No token provided'); |
|
144 | + } |
|
145 | + |
|
146 | + if ($oauthVerifier === null) { |
|
147 | + throw new ApplicationLogicException('No oauth verifier provided.'); |
|
148 | + } |
|
149 | + } |
|
150 | 150 | } |
@@ -13,17 +13,17 @@ |
||
13 | 13 | |
14 | 14 | class PageLogout extends InternalPageBase |
15 | 15 | { |
16 | - /** |
|
17 | - * Main function for this page, when no specific actions are called. |
|
18 | - */ |
|
19 | - protected function main() |
|
20 | - { |
|
21 | - Session::destroy(); |
|
22 | - $this->redirect("login"); |
|
23 | - } |
|
16 | + /** |
|
17 | + * Main function for this page, when no specific actions are called. |
|
18 | + */ |
|
19 | + protected function main() |
|
20 | + { |
|
21 | + Session::destroy(); |
|
22 | + $this->redirect("login"); |
|
23 | + } |
|
24 | 24 | |
25 | - protected function isProtectedPage() |
|
26 | - { |
|
27 | - return false; |
|
28 | - } |
|
25 | + protected function isProtectedPage() |
|
26 | + { |
|
27 | + return false; |
|
28 | + } |
|
29 | 29 | } |
@@ -12,17 +12,17 @@ |
||
12 | 12 | |
13 | 13 | class PageRegisterOption extends InternalPageBase |
14 | 14 | { |
15 | - /** |
|
16 | - * Main function for this page, when no specific actions are called. |
|
17 | - * @return void |
|
18 | - */ |
|
19 | - protected function main() |
|
20 | - { |
|
21 | - $this->setTemplate('registration/option.tpl'); |
|
22 | - } |
|
15 | + /** |
|
16 | + * Main function for this page, when no specific actions are called. |
|
17 | + * @return void |
|
18 | + */ |
|
19 | + protected function main() |
|
20 | + { |
|
21 | + $this->setTemplate('registration/option.tpl'); |
|
22 | + } |
|
23 | 23 | |
24 | - protected function isProtectedPage() |
|
25 | - { |
|
26 | - return false; |
|
27 | - } |
|
24 | + protected function isProtectedPage() |
|
25 | + { |
|
26 | + return false; |
|
27 | + } |
|
28 | 28 | } |
@@ -10,19 +10,19 @@ |
||
10 | 10 | |
11 | 11 | class PageRegisterStandard extends PageRegisterBase |
12 | 12 | { |
13 | - /** |
|
14 | - * @return string |
|
15 | - */ |
|
16 | - protected function getRegistrationTemplate() |
|
17 | - { |
|
18 | - return "registration/register.tpl"; |
|
19 | - } |
|
13 | + /** |
|
14 | + * @return string |
|
15 | + */ |
|
16 | + protected function getRegistrationTemplate() |
|
17 | + { |
|
18 | + return "registration/register.tpl"; |
|
19 | + } |
|
20 | 20 | |
21 | - /** |
|
22 | - * @return string |
|
23 | - */ |
|
24 | - protected function getDefaultRole() |
|
25 | - { |
|
26 | - return 'user'; |
|
27 | - } |
|
21 | + /** |
|
22 | + * @return string |
|
23 | + */ |
|
24 | + protected function getDefaultRole() |
|
25 | + { |
|
26 | + return 'user'; |
|
27 | + } |
|
28 | 28 | } |
@@ -15,37 +15,37 @@ |
||
15 | 15 | |
16 | 16 | class PageSiteNotice extends InternalPageBase |
17 | 17 | { |
18 | - /** |
|
19 | - * Main function for this page, when no specific actions are called. |
|
20 | - * @return void |
|
21 | - */ |
|
22 | - protected function main() |
|
23 | - { |
|
24 | - $this->setHtmlTitle('Site Notice'); |
|
25 | - |
|
26 | - $database = $this->getDatabase(); |
|
27 | - |
|
28 | - /** @var SiteNotice $siteNoticeMessage */ |
|
29 | - $siteNoticeMessage = SiteNotice::getById(1, $database); |
|
30 | - |
|
31 | - // Dual-mode |
|
32 | - if (WebRequest::wasPosted()) { |
|
33 | - $this->validateCSRFToken(); |
|
34 | - |
|
35 | - $siteNoticeMessage->setContent(WebRequest::postString('mailtext')); |
|
36 | - $siteNoticeMessage->setUpdateVersion(WebRequest::postInt('updateversion')); |
|
37 | - $siteNoticeMessage->save(); |
|
38 | - |
|
39 | - Logger::siteNoticeEdited($database, $siteNoticeMessage); |
|
40 | - $this->getNotificationHelper()->siteNoticeEdited(); |
|
41 | - |
|
42 | - $this->redirect(); |
|
43 | - } |
|
44 | - else { |
|
45 | - $this->assignCSRFToken(); |
|
46 | - |
|
47 | - $this->setTemplate('site-notice/edit-form.tpl'); |
|
48 | - $this->assign('message', $siteNoticeMessage); |
|
49 | - } |
|
50 | - } |
|
18 | + /** |
|
19 | + * Main function for this page, when no specific actions are called. |
|
20 | + * @return void |
|
21 | + */ |
|
22 | + protected function main() |
|
23 | + { |
|
24 | + $this->setHtmlTitle('Site Notice'); |
|
25 | + |
|
26 | + $database = $this->getDatabase(); |
|
27 | + |
|
28 | + /** @var SiteNotice $siteNoticeMessage */ |
|
29 | + $siteNoticeMessage = SiteNotice::getById(1, $database); |
|
30 | + |
|
31 | + // Dual-mode |
|
32 | + if (WebRequest::wasPosted()) { |
|
33 | + $this->validateCSRFToken(); |
|
34 | + |
|
35 | + $siteNoticeMessage->setContent(WebRequest::postString('mailtext')); |
|
36 | + $siteNoticeMessage->setUpdateVersion(WebRequest::postInt('updateversion')); |
|
37 | + $siteNoticeMessage->save(); |
|
38 | + |
|
39 | + Logger::siteNoticeEdited($database, $siteNoticeMessage); |
|
40 | + $this->getNotificationHelper()->siteNoticeEdited(); |
|
41 | + |
|
42 | + $this->redirect(); |
|
43 | + } |
|
44 | + else { |
|
45 | + $this->assignCSRFToken(); |
|
46 | + |
|
47 | + $this->setTemplate('site-notice/edit-form.tpl'); |
|
48 | + $this->assign('message', $siteNoticeMessage); |
|
49 | + } |
|
50 | + } |
|
51 | 51 | } |
@@ -12,20 +12,20 @@ |
||
12 | 12 | |
13 | 13 | class Page404 extends InternalPageBase |
14 | 14 | { |
15 | - /** |
|
16 | - * Main function for this page, when no actions are called. |
|
17 | - */ |
|
18 | - protected function main() |
|
19 | - { |
|
20 | - if (!headers_sent()) { |
|
21 | - header("HTTP/1.1 404 Not Found"); |
|
22 | - } |
|
15 | + /** |
|
16 | + * Main function for this page, when no actions are called. |
|
17 | + */ |
|
18 | + protected function main() |
|
19 | + { |
|
20 | + if (!headers_sent()) { |
|
21 | + header("HTTP/1.1 404 Not Found"); |
|
22 | + } |
|
23 | 23 | |
24 | - $this->setTemplate("404.tpl"); |
|
25 | - } |
|
24 | + $this->setTemplate("404.tpl"); |
|
25 | + } |
|
26 | 26 | |
27 | - protected function isProtectedPage() |
|
28 | - { |
|
29 | - return false; |
|
30 | - } |
|
27 | + protected function isProtectedPage() |
|
28 | + { |
|
29 | + return false; |
|
30 | + } |
|
31 | 31 | } |
@@ -16,99 +16,99 @@ |
||
16 | 16 | |
17 | 17 | class PagePreferences extends InternalPageBase |
18 | 18 | { |
19 | - /** |
|
20 | - * Main function for this page, when no specific actions are called. |
|
21 | - * @return void |
|
22 | - */ |
|
23 | - protected function main() |
|
24 | - { |
|
25 | - $this->setHtmlTitle('Preferences'); |
|
26 | - |
|
27 | - $enforceOAuth = $this->getSiteConfiguration()->getEnforceOAuth(); |
|
28 | - |
|
29 | - // Dual mode |
|
30 | - if (WebRequest::wasPosted()) { |
|
31 | - $this->validateCSRFToken(); |
|
32 | - $user = User::getCurrent($this->getDatabase()); |
|
33 | - $user->setWelcomeSig(WebRequest::postString('sig')); |
|
34 | - $user->setEmailSig(WebRequest::postString('emailsig')); |
|
35 | - $user->setAbortPref(WebRequest::getBoolean('sig') ? 1 : 0); |
|
36 | - |
|
37 | - $email = WebRequest::postEmail('email'); |
|
38 | - if ($email !== null) { |
|
39 | - $user->setEmail($email); |
|
40 | - } |
|
41 | - |
|
42 | - $user->save(); |
|
43 | - SessionAlert::success("Preferences updated!"); |
|
44 | - |
|
45 | - $this->redirect(''); |
|
46 | - } |
|
47 | - else { |
|
48 | - $this->assignCSRFToken(); |
|
49 | - $this->setTemplate('preferences/prefs.tpl'); |
|
50 | - $this->assign("enforceOAuth", $enforceOAuth); |
|
51 | - } |
|
52 | - } |
|
53 | - |
|
54 | - protected function changePassword() |
|
55 | - { |
|
56 | - $this->setHtmlTitle('Change Password'); |
|
57 | - |
|
58 | - if (WebRequest::wasPosted()) { |
|
59 | - $this->validateCSRFToken(); |
|
60 | - try { |
|
61 | - $oldPassword = WebRequest::postString('oldpassword'); |
|
62 | - $newPassword = WebRequest::postString('newpassword'); |
|
63 | - $newPasswordConfirmation = WebRequest::postString('newpasswordconfirm'); |
|
64 | - |
|
65 | - $user = User::getCurrent($this->getDatabase()); |
|
66 | - if (!$user instanceof User) { |
|
67 | - throw new ApplicationLogicException('User not found'); |
|
68 | - } |
|
69 | - |
|
70 | - $this->validateNewPassword($oldPassword, $newPassword, $newPasswordConfirmation, $user); |
|
71 | - } |
|
72 | - catch (ApplicationLogicException $ex) { |
|
73 | - SessionAlert::error($ex->getMessage()); |
|
74 | - $this->redirect('preferences', 'changePassword'); |
|
75 | - |
|
76 | - return; |
|
77 | - } |
|
78 | - |
|
79 | - $user->setPassword($newPassword); |
|
80 | - $user->save(); |
|
81 | - |
|
82 | - SessionAlert::success('Password changed successfully!'); |
|
83 | - |
|
84 | - $this->redirect('preferences'); |
|
85 | - } |
|
86 | - else { |
|
87 | - // not allowed to GET this. |
|
88 | - $this->redirect('preferences'); |
|
89 | - } |
|
90 | - } |
|
91 | - |
|
92 | - /** |
|
93 | - * @param string $oldPassword |
|
94 | - * @param string $newPassword |
|
95 | - * @param string $newPasswordConfirmation |
|
96 | - * @param User $user |
|
97 | - * |
|
98 | - * @throws ApplicationLogicException |
|
99 | - */ |
|
100 | - protected function validateNewPassword($oldPassword, $newPassword, $newPasswordConfirmation, User $user) |
|
101 | - { |
|
102 | - if ($oldPassword === null || $newPassword === null || $newPasswordConfirmation === null) { |
|
103 | - throw new ApplicationLogicException('All three fields must be completed to change your password'); |
|
104 | - } |
|
105 | - |
|
106 | - if ($newPassword !== $newPasswordConfirmation) { |
|
107 | - throw new ApplicationLogicException('Your new passwords did not match!'); |
|
108 | - } |
|
109 | - |
|
110 | - if (!$user->authenticate($oldPassword)) { |
|
111 | - throw new ApplicationLogicException('The password you entered was incorrect.'); |
|
112 | - } |
|
113 | - } |
|
19 | + /** |
|
20 | + * Main function for this page, when no specific actions are called. |
|
21 | + * @return void |
|
22 | + */ |
|
23 | + protected function main() |
|
24 | + { |
|
25 | + $this->setHtmlTitle('Preferences'); |
|
26 | + |
|
27 | + $enforceOAuth = $this->getSiteConfiguration()->getEnforceOAuth(); |
|
28 | + |
|
29 | + // Dual mode |
|
30 | + if (WebRequest::wasPosted()) { |
|
31 | + $this->validateCSRFToken(); |
|
32 | + $user = User::getCurrent($this->getDatabase()); |
|
33 | + $user->setWelcomeSig(WebRequest::postString('sig')); |
|
34 | + $user->setEmailSig(WebRequest::postString('emailsig')); |
|
35 | + $user->setAbortPref(WebRequest::getBoolean('sig') ? 1 : 0); |
|
36 | + |
|
37 | + $email = WebRequest::postEmail('email'); |
|
38 | + if ($email !== null) { |
|
39 | + $user->setEmail($email); |
|
40 | + } |
|
41 | + |
|
42 | + $user->save(); |
|
43 | + SessionAlert::success("Preferences updated!"); |
|
44 | + |
|
45 | + $this->redirect(''); |
|
46 | + } |
|
47 | + else { |
|
48 | + $this->assignCSRFToken(); |
|
49 | + $this->setTemplate('preferences/prefs.tpl'); |
|
50 | + $this->assign("enforceOAuth", $enforceOAuth); |
|
51 | + } |
|
52 | + } |
|
53 | + |
|
54 | + protected function changePassword() |
|
55 | + { |
|
56 | + $this->setHtmlTitle('Change Password'); |
|
57 | + |
|
58 | + if (WebRequest::wasPosted()) { |
|
59 | + $this->validateCSRFToken(); |
|
60 | + try { |
|
61 | + $oldPassword = WebRequest::postString('oldpassword'); |
|
62 | + $newPassword = WebRequest::postString('newpassword'); |
|
63 | + $newPasswordConfirmation = WebRequest::postString('newpasswordconfirm'); |
|
64 | + |
|
65 | + $user = User::getCurrent($this->getDatabase()); |
|
66 | + if (!$user instanceof User) { |
|
67 | + throw new ApplicationLogicException('User not found'); |
|
68 | + } |
|
69 | + |
|
70 | + $this->validateNewPassword($oldPassword, $newPassword, $newPasswordConfirmation, $user); |
|
71 | + } |
|
72 | + catch (ApplicationLogicException $ex) { |
|
73 | + SessionAlert::error($ex->getMessage()); |
|
74 | + $this->redirect('preferences', 'changePassword'); |
|
75 | + |
|
76 | + return; |
|
77 | + } |
|
78 | + |
|
79 | + $user->setPassword($newPassword); |
|
80 | + $user->save(); |
|
81 | + |
|
82 | + SessionAlert::success('Password changed successfully!'); |
|
83 | + |
|
84 | + $this->redirect('preferences'); |
|
85 | + } |
|
86 | + else { |
|
87 | + // not allowed to GET this. |
|
88 | + $this->redirect('preferences'); |
|
89 | + } |
|
90 | + } |
|
91 | + |
|
92 | + /** |
|
93 | + * @param string $oldPassword |
|
94 | + * @param string $newPassword |
|
95 | + * @param string $newPasswordConfirmation |
|
96 | + * @param User $user |
|
97 | + * |
|
98 | + * @throws ApplicationLogicException |
|
99 | + */ |
|
100 | + protected function validateNewPassword($oldPassword, $newPassword, $newPasswordConfirmation, User $user) |
|
101 | + { |
|
102 | + if ($oldPassword === null || $newPassword === null || $newPasswordConfirmation === null) { |
|
103 | + throw new ApplicationLogicException('All three fields must be completed to change your password'); |
|
104 | + } |
|
105 | + |
|
106 | + if ($newPassword !== $newPasswordConfirmation) { |
|
107 | + throw new ApplicationLogicException('Your new passwords did not match!'); |
|
108 | + } |
|
109 | + |
|
110 | + if (!$user->authenticate($oldPassword)) { |
|
111 | + throw new ApplicationLogicException('The password you entered was incorrect.'); |
|
112 | + } |
|
113 | + } |
|
114 | 114 | } |
@@ -17,71 +17,71 @@ discard block |
||
17 | 17 | |
18 | 18 | class PageMain extends InternalPageBase |
19 | 19 | { |
20 | - /** |
|
21 | - * Main function for this page, when no actions are called. |
|
22 | - */ |
|
23 | - protected function main() |
|
24 | - { |
|
25 | - $this->assignCSRFToken(); |
|
26 | - |
|
27 | - $config = $this->getSiteConfiguration(); |
|
28 | - |
|
29 | - $database = $this->getDatabase(); |
|
30 | - |
|
31 | - $requestSectionData = array(); |
|
32 | - |
|
33 | - if ($config->getEmailConfirmationEnabled()) { |
|
34 | - $query = "SELECT * FROM request WHERE status = :type AND emailconfirm = 'Confirmed' LIMIT :lim;"; |
|
35 | - $totalQuery = "SELECT COUNT(id) FROM request WHERE status = :type AND emailconfirm = 'Confirmed';"; |
|
36 | - } |
|
37 | - else { |
|
38 | - $query = "SELECT * FROM request WHERE status = :type LIMIT :lim;"; |
|
39 | - $totalQuery = "SELECT COUNT(id) FROM request WHERE status = :type;"; |
|
40 | - } |
|
41 | - |
|
42 | - $statement = $database->prepare($query); |
|
43 | - $statement->bindValue(':lim', $config->getMiserModeLimit(), PDO::PARAM_INT); |
|
44 | - |
|
45 | - $totalRequestsStatement = $database->prepare($totalQuery); |
|
46 | - |
|
47 | - $this->assign('defaultRequestState', $config->getDefaultRequestStateKey()); |
|
48 | - |
|
49 | - foreach ($config->getRequestStates() as $type => $v) { |
|
50 | - $statement->bindValue(":type", $type); |
|
51 | - $statement->execute(); |
|
52 | - |
|
53 | - $requests = $statement->fetchAll(PDO::FETCH_CLASS, Request::class); |
|
54 | - |
|
55 | - /** @var Request $req */ |
|
56 | - foreach ($requests as $req) { |
|
57 | - $req->setDatabase($database); |
|
58 | - } |
|
59 | - |
|
60 | - $totalRequestsStatement->bindValue(':type', $type); |
|
61 | - $totalRequestsStatement->execute(); |
|
62 | - $totalRequests = $totalRequestsStatement->fetchColumn(); |
|
63 | - $totalRequestsStatement->closeCursor(); |
|
64 | - |
|
65 | - $userIds = array_map( |
|
66 | - function(Request $entry) { |
|
67 | - return $entry->getReserved(); |
|
68 | - }, |
|
69 | - $requests); |
|
70 | - $userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username'); |
|
71 | - $this->assign('userlist', $userList); |
|
72 | - |
|
73 | - $requestSectionData[$v['header']] = array( |
|
74 | - 'requests' => $requests, |
|
75 | - 'total' => $totalRequests, |
|
76 | - 'api' => $v['api'], |
|
77 | - 'type' => $type, |
|
78 | - 'userlist' => $userList, |
|
79 | - ); |
|
80 | - } |
|
81 | - |
|
82 | - $this->assign('requestLimitShowOnly', $config->getMiserModeLimit()); |
|
83 | - |
|
84 | - $query = <<<SQL |
|
20 | + /** |
|
21 | + * Main function for this page, when no actions are called. |
|
22 | + */ |
|
23 | + protected function main() |
|
24 | + { |
|
25 | + $this->assignCSRFToken(); |
|
26 | + |
|
27 | + $config = $this->getSiteConfiguration(); |
|
28 | + |
|
29 | + $database = $this->getDatabase(); |
|
30 | + |
|
31 | + $requestSectionData = array(); |
|
32 | + |
|
33 | + if ($config->getEmailConfirmationEnabled()) { |
|
34 | + $query = "SELECT * FROM request WHERE status = :type AND emailconfirm = 'Confirmed' LIMIT :lim;"; |
|
35 | + $totalQuery = "SELECT COUNT(id) FROM request WHERE status = :type AND emailconfirm = 'Confirmed';"; |
|
36 | + } |
|
37 | + else { |
|
38 | + $query = "SELECT * FROM request WHERE status = :type LIMIT :lim;"; |
|
39 | + $totalQuery = "SELECT COUNT(id) FROM request WHERE status = :type;"; |
|
40 | + } |
|
41 | + |
|
42 | + $statement = $database->prepare($query); |
|
43 | + $statement->bindValue(':lim', $config->getMiserModeLimit(), PDO::PARAM_INT); |
|
44 | + |
|
45 | + $totalRequestsStatement = $database->prepare($totalQuery); |
|
46 | + |
|
47 | + $this->assign('defaultRequestState', $config->getDefaultRequestStateKey()); |
|
48 | + |
|
49 | + foreach ($config->getRequestStates() as $type => $v) { |
|
50 | + $statement->bindValue(":type", $type); |
|
51 | + $statement->execute(); |
|
52 | + |
|
53 | + $requests = $statement->fetchAll(PDO::FETCH_CLASS, Request::class); |
|
54 | + |
|
55 | + /** @var Request $req */ |
|
56 | + foreach ($requests as $req) { |
|
57 | + $req->setDatabase($database); |
|
58 | + } |
|
59 | + |
|
60 | + $totalRequestsStatement->bindValue(':type', $type); |
|
61 | + $totalRequestsStatement->execute(); |
|
62 | + $totalRequests = $totalRequestsStatement->fetchColumn(); |
|
63 | + $totalRequestsStatement->closeCursor(); |
|
64 | + |
|
65 | + $userIds = array_map( |
|
66 | + function(Request $entry) { |
|
67 | + return $entry->getReserved(); |
|
68 | + }, |
|
69 | + $requests); |
|
70 | + $userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username'); |
|
71 | + $this->assign('userlist', $userList); |
|
72 | + |
|
73 | + $requestSectionData[$v['header']] = array( |
|
74 | + 'requests' => $requests, |
|
75 | + 'total' => $totalRequests, |
|
76 | + 'api' => $v['api'], |
|
77 | + 'type' => $type, |
|
78 | + 'userlist' => $userList, |
|
79 | + ); |
|
80 | + } |
|
81 | + |
|
82 | + $this->assign('requestLimitShowOnly', $config->getMiserModeLimit()); |
|
83 | + |
|
84 | + $query = <<<SQL |
|
85 | 85 | SELECT request.id, request.name, request.updateversion |
86 | 86 | FROM request /* PageMain::main() */ |
87 | 87 | JOIN log ON log.objectid = request.id AND log.objecttype = 'Request' |
@@ -90,18 +90,18 @@ discard block |
||
90 | 90 | LIMIT 5; |
91 | 91 | SQL; |
92 | 92 | |
93 | - $statement = $database->prepare($query); |
|
94 | - $statement->execute(); |
|
93 | + $statement = $database->prepare($query); |
|
94 | + $statement->execute(); |
|
95 | 95 | |
96 | - $last5result = $statement->fetchAll(PDO::FETCH_ASSOC); |
|
96 | + $last5result = $statement->fetchAll(PDO::FETCH_ASSOC); |
|
97 | 97 | |
98 | - $this->assign('lastFive', $last5result); |
|
99 | - $this->assign('requestSectionData', $requestSectionData); |
|
98 | + $this->assign('lastFive', $last5result); |
|
99 | + $this->assign('requestSectionData', $requestSectionData); |
|
100 | 100 | |
101 | - $currentUser = User::getCurrent($database); |
|
102 | - $this->assign('canBan', $this->barrierTest('set', $currentUser, PageBan::class)); |
|
103 | - $this->assign('canBreakReservation', $this->barrierTest('force', $currentUser, PageBreakReservation::class)); |
|
101 | + $currentUser = User::getCurrent($database); |
|
102 | + $this->assign('canBan', $this->barrierTest('set', $currentUser, PageBan::class)); |
|
103 | + $this->assign('canBreakReservation', $this->barrierTest('force', $currentUser, PageBreakReservation::class)); |
|
104 | 104 | |
105 | - $this->setTemplate('mainpage/mainpage.tpl'); |
|
106 | - } |
|
105 | + $this->setTemplate('mainpage/mainpage.tpl'); |
|
106 | + } |
|
107 | 107 | } |
@@ -20,156 +20,156 @@ |
||
20 | 20 | |
21 | 21 | class PageSearch extends InternalPageBase |
22 | 22 | { |
23 | - /** |
|
24 | - * Main function for this page, when no specific actions are called. |
|
25 | - */ |
|
26 | - protected function main() |
|
27 | - { |
|
28 | - $this->setHtmlTitle('Search'); |
|
29 | - |
|
30 | - // Dual-mode page |
|
31 | - if (WebRequest::wasPosted()) { |
|
32 | - $this->validateCSRFToken(); |
|
33 | - |
|
34 | - $searchType = WebRequest::postString('type'); |
|
35 | - $searchTerm = WebRequest::postString('term'); |
|
36 | - |
|
37 | - $validationError = ""; |
|
38 | - if (!$this->validateSearchParameters($searchType, $searchTerm, $validationError)) { |
|
39 | - SessionAlert::error($validationError, "Search error"); |
|
40 | - $this->redirect("search"); |
|
41 | - |
|
42 | - return; |
|
43 | - } |
|
44 | - |
|
45 | - $results = array(); |
|
46 | - |
|
47 | - switch ($searchType) { |
|
48 | - case 'name': |
|
49 | - $results = $this->getNameSearchResults($searchTerm); |
|
50 | - break; |
|
51 | - case 'email': |
|
52 | - $results = $this->getEmailSearchResults($searchTerm); |
|
53 | - break; |
|
54 | - case 'ip': |
|
55 | - $results = $this->getIpSearchResults($searchTerm); |
|
56 | - break; |
|
57 | - } |
|
58 | - |
|
59 | - // deal with results |
|
60 | - $this->assign('requests', $results); |
|
61 | - $this->assign('term', $searchTerm); |
|
62 | - $this->assign('target', $searchType); |
|
63 | - |
|
64 | - $userIds = array_map( |
|
65 | - function(Request $entry) { |
|
66 | - return $entry->getReserved(); |
|
67 | - }, |
|
68 | - $results); |
|
69 | - $userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username'); |
|
70 | - $this->assign('userlist', $userList); |
|
71 | - |
|
72 | - $currentUser = User::getCurrent($this->getDatabase()); |
|
73 | - $this->assign('canBan', $this->barrierTest('set', $currentUser, PageBan::class)); |
|
74 | - $this->assign('canBreakReservation', $this->barrierTest('force', $currentUser, PageBreakReservation::class)); |
|
75 | - |
|
76 | - $this->assignCSRFToken(); |
|
77 | - $this->setTemplate('search/searchResult.tpl'); |
|
78 | - } |
|
79 | - else { |
|
80 | - $this->assignCSRFToken(); |
|
81 | - $this->setTemplate('search/searchForm.tpl'); |
|
82 | - } |
|
83 | - } |
|
84 | - |
|
85 | - /** |
|
86 | - * Gets search results by name |
|
87 | - * |
|
88 | - * @param string $searchTerm |
|
89 | - * |
|
90 | - * @returns Request[] |
|
91 | - */ |
|
92 | - private function getNameSearchResults($searchTerm) |
|
93 | - { |
|
94 | - $padded = '%' . $searchTerm . '%'; |
|
95 | - |
|
96 | - /** @var Request[] $requests */ |
|
97 | - $requests = RequestSearchHelper::get($this->getDatabase()) |
|
98 | - ->byName($padded) |
|
99 | - ->excludingPurgedData($this->getSiteConfiguration()) |
|
100 | - ->fetch(); |
|
101 | - |
|
102 | - return $requests; |
|
103 | - } |
|
104 | - |
|
105 | - /** |
|
106 | - * Gets search results by email |
|
107 | - * |
|
108 | - * @param string $searchTerm |
|
109 | - * |
|
110 | - * @return Request[] |
|
111 | - * @throws ApplicationLogicException |
|
112 | - */ |
|
113 | - private function getEmailSearchResults($searchTerm) |
|
114 | - { |
|
115 | - if ($searchTerm === "@") { |
|
116 | - throw new ApplicationLogicException('The search term "@" is not valid for email address searches!'); |
|
117 | - } |
|
118 | - |
|
119 | - $padded = '%' . $searchTerm . '%'; |
|
120 | - |
|
121 | - /** @var Request[] $requests */ |
|
122 | - $requests = RequestSearchHelper::get($this->getDatabase()) |
|
123 | - ->byEmailAddress($padded) |
|
124 | - ->excludingPurgedData($this->getSiteConfiguration()) |
|
125 | - ->fetch(); |
|
126 | - |
|
127 | - return $requests; |
|
128 | - } |
|
129 | - |
|
130 | - /** |
|
131 | - * Gets search results by IP address or XFF IP address |
|
132 | - * |
|
133 | - * @param string $searchTerm |
|
134 | - * |
|
135 | - * @returns Request[] |
|
136 | - */ |
|
137 | - private function getIpSearchResults($searchTerm) |
|
138 | - { |
|
139 | - /** @var Request[] $requests */ |
|
140 | - $requests = RequestSearchHelper::get($this->getDatabase()) |
|
141 | - ->byIp($searchTerm) |
|
142 | - ->excludingPurgedData($this->getSiteConfiguration()) |
|
143 | - ->fetch(); |
|
144 | - |
|
145 | - return $requests; |
|
146 | - } |
|
147 | - |
|
148 | - /** |
|
149 | - * @param string $searchType |
|
150 | - * @param string $searchTerm |
|
151 | - * |
|
152 | - * @param string $errorMessage |
|
153 | - * |
|
154 | - * @return bool true if parameters are valid |
|
155 | - * @throws ApplicationLogicException |
|
156 | - */ |
|
157 | - protected function validateSearchParameters($searchType, $searchTerm, &$errorMessage) |
|
158 | - { |
|
159 | - if (!in_array($searchType, array('name', 'email', 'ip'))) { |
|
160 | - $errorMessage = 'Unknown search type'; |
|
161 | - |
|
162 | - return false; |
|
163 | - } |
|
164 | - |
|
165 | - if ($searchTerm === '%' || $searchTerm === '' || $searchTerm === null) { |
|
166 | - $errorMessage = 'No search term specified entered'; |
|
167 | - |
|
168 | - return false; |
|
169 | - } |
|
170 | - |
|
171 | - $errorMessage = ""; |
|
172 | - |
|
173 | - return true; |
|
174 | - } |
|
23 | + /** |
|
24 | + * Main function for this page, when no specific actions are called. |
|
25 | + */ |
|
26 | + protected function main() |
|
27 | + { |
|
28 | + $this->setHtmlTitle('Search'); |
|
29 | + |
|
30 | + // Dual-mode page |
|
31 | + if (WebRequest::wasPosted()) { |
|
32 | + $this->validateCSRFToken(); |
|
33 | + |
|
34 | + $searchType = WebRequest::postString('type'); |
|
35 | + $searchTerm = WebRequest::postString('term'); |
|
36 | + |
|
37 | + $validationError = ""; |
|
38 | + if (!$this->validateSearchParameters($searchType, $searchTerm, $validationError)) { |
|
39 | + SessionAlert::error($validationError, "Search error"); |
|
40 | + $this->redirect("search"); |
|
41 | + |
|
42 | + return; |
|
43 | + } |
|
44 | + |
|
45 | + $results = array(); |
|
46 | + |
|
47 | + switch ($searchType) { |
|
48 | + case 'name': |
|
49 | + $results = $this->getNameSearchResults($searchTerm); |
|
50 | + break; |
|
51 | + case 'email': |
|
52 | + $results = $this->getEmailSearchResults($searchTerm); |
|
53 | + break; |
|
54 | + case 'ip': |
|
55 | + $results = $this->getIpSearchResults($searchTerm); |
|
56 | + break; |
|
57 | + } |
|
58 | + |
|
59 | + // deal with results |
|
60 | + $this->assign('requests', $results); |
|
61 | + $this->assign('term', $searchTerm); |
|
62 | + $this->assign('target', $searchType); |
|
63 | + |
|
64 | + $userIds = array_map( |
|
65 | + function(Request $entry) { |
|
66 | + return $entry->getReserved(); |
|
67 | + }, |
|
68 | + $results); |
|
69 | + $userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username'); |
|
70 | + $this->assign('userlist', $userList); |
|
71 | + |
|
72 | + $currentUser = User::getCurrent($this->getDatabase()); |
|
73 | + $this->assign('canBan', $this->barrierTest('set', $currentUser, PageBan::class)); |
|
74 | + $this->assign('canBreakReservation', $this->barrierTest('force', $currentUser, PageBreakReservation::class)); |
|
75 | + |
|
76 | + $this->assignCSRFToken(); |
|
77 | + $this->setTemplate('search/searchResult.tpl'); |
|
78 | + } |
|
79 | + else { |
|
80 | + $this->assignCSRFToken(); |
|
81 | + $this->setTemplate('search/searchForm.tpl'); |
|
82 | + } |
|
83 | + } |
|
84 | + |
|
85 | + /** |
|
86 | + * Gets search results by name |
|
87 | + * |
|
88 | + * @param string $searchTerm |
|
89 | + * |
|
90 | + * @returns Request[] |
|
91 | + */ |
|
92 | + private function getNameSearchResults($searchTerm) |
|
93 | + { |
|
94 | + $padded = '%' . $searchTerm . '%'; |
|
95 | + |
|
96 | + /** @var Request[] $requests */ |
|
97 | + $requests = RequestSearchHelper::get($this->getDatabase()) |
|
98 | + ->byName($padded) |
|
99 | + ->excludingPurgedData($this->getSiteConfiguration()) |
|
100 | + ->fetch(); |
|
101 | + |
|
102 | + return $requests; |
|
103 | + } |
|
104 | + |
|
105 | + /** |
|
106 | + * Gets search results by email |
|
107 | + * |
|
108 | + * @param string $searchTerm |
|
109 | + * |
|
110 | + * @return Request[] |
|
111 | + * @throws ApplicationLogicException |
|
112 | + */ |
|
113 | + private function getEmailSearchResults($searchTerm) |
|
114 | + { |
|
115 | + if ($searchTerm === "@") { |
|
116 | + throw new ApplicationLogicException('The search term "@" is not valid for email address searches!'); |
|
117 | + } |
|
118 | + |
|
119 | + $padded = '%' . $searchTerm . '%'; |
|
120 | + |
|
121 | + /** @var Request[] $requests */ |
|
122 | + $requests = RequestSearchHelper::get($this->getDatabase()) |
|
123 | + ->byEmailAddress($padded) |
|
124 | + ->excludingPurgedData($this->getSiteConfiguration()) |
|
125 | + ->fetch(); |
|
126 | + |
|
127 | + return $requests; |
|
128 | + } |
|
129 | + |
|
130 | + /** |
|
131 | + * Gets search results by IP address or XFF IP address |
|
132 | + * |
|
133 | + * @param string $searchTerm |
|
134 | + * |
|
135 | + * @returns Request[] |
|
136 | + */ |
|
137 | + private function getIpSearchResults($searchTerm) |
|
138 | + { |
|
139 | + /** @var Request[] $requests */ |
|
140 | + $requests = RequestSearchHelper::get($this->getDatabase()) |
|
141 | + ->byIp($searchTerm) |
|
142 | + ->excludingPurgedData($this->getSiteConfiguration()) |
|
143 | + ->fetch(); |
|
144 | + |
|
145 | + return $requests; |
|
146 | + } |
|
147 | + |
|
148 | + /** |
|
149 | + * @param string $searchType |
|
150 | + * @param string $searchTerm |
|
151 | + * |
|
152 | + * @param string $errorMessage |
|
153 | + * |
|
154 | + * @return bool true if parameters are valid |
|
155 | + * @throws ApplicationLogicException |
|
156 | + */ |
|
157 | + protected function validateSearchParameters($searchType, $searchTerm, &$errorMessage) |
|
158 | + { |
|
159 | + if (!in_array($searchType, array('name', 'email', 'ip'))) { |
|
160 | + $errorMessage = 'Unknown search type'; |
|
161 | + |
|
162 | + return false; |
|
163 | + } |
|
164 | + |
|
165 | + if ($searchTerm === '%' || $searchTerm === '' || $searchTerm === null) { |
|
166 | + $errorMessage = 'No search term specified entered'; |
|
167 | + |
|
168 | + return false; |
|
169 | + } |
|
170 | + |
|
171 | + $errorMessage = ""; |
|
172 | + |
|
173 | + return true; |
|
174 | + } |
|
175 | 175 | } |
@@ -91,7 +91,7 @@ discard block |
||
91 | 91 | */ |
92 | 92 | private function getNameSearchResults($searchTerm) |
93 | 93 | { |
94 | - $padded = '%' . $searchTerm . '%'; |
|
94 | + $padded = '%'.$searchTerm.'%'; |
|
95 | 95 | |
96 | 96 | /** @var Request[] $requests */ |
97 | 97 | $requests = RequestSearchHelper::get($this->getDatabase()) |
@@ -116,7 +116,7 @@ discard block |
||
116 | 116 | throw new ApplicationLogicException('The search term "@" is not valid for email address searches!'); |
117 | 117 | } |
118 | 118 | |
119 | - $padded = '%' . $searchTerm . '%'; |
|
119 | + $padded = '%'.$searchTerm.'%'; |
|
120 | 120 | |
121 | 121 | /** @var Request[] $requests */ |
122 | 122 | $requests = RequestSearchHelper::get($this->getDatabase()) |