enwikipedia-acc / waca

includes/ConsoleTasks/RegenerateStylesheetsTask.php

Indentation +18 added lines, -18 removed lines

@@ -15,26 +15,26 @@
 
 class RegenerateStylesheetsTask extends ConsoleTaskBase
 {
-    const RESOURCES_GENERATED = 'resources/generated';
+	const RESOURCES_GENERATED = 'resources/generated';
 
-    public function execute()
-    {
-        $scss = new Compiler();
-        $scss->setImportPaths('resources/scss');
+	public function execute()
+	{
+		$scss = new Compiler();
+		$scss->setImportPaths('resources/scss');
 
-        if (!$this->getSiteConfiguration()->getDebuggingTraceEnabled()) {
-            $scss->setFormatter('ScssPhp\\ScssPhp\\Formatter\\Compressed');
-            $scss->setSourceMap(Compiler::SOURCE_MAP_INLINE);
-        }
+		if (!$this->getSiteConfiguration()->getDebuggingTraceEnabled()) {
+			$scss->setFormatter('ScssPhp\\ScssPhp\\Formatter\\Compressed');
+			$scss->setSourceMap(Compiler::SOURCE_MAP_INLINE);
+		}
 
-        if (!is_dir(self::RESOURCES_GENERATED)) {
-            mkdir(self::RESOURCES_GENERATED);
-        }
+		if (!is_dir(self::RESOURCES_GENERATED)) {
+			mkdir(self::RESOURCES_GENERATED);
+		}
 
-        foreach (['bootstrap-main', 'bootstrap-alt'] as $file) {
-            file_put_contents(
-                self::RESOURCES_GENERATED . '/' . $file . '.css',
-                $scss->compile('/*! Do not edit this auto-generated file! */ @import "' . $file . '";'));
-        }
-    }
+		foreach (['bootstrap-main', 'bootstrap-alt'] as $file) {
+			file_put_contents(
+				self::RESOURCES_GENERATED . '/' . $file . '.css',
+				$scss->compile('/*! Do not edit this auto-generated file! */ @import "' . $file . '";'));
+		}
+	}
 }

Spacing +2 added lines, -2 removed lines

@@ -33,8 +33,8 @@
 
         foreach (['bootstrap-main', 'bootstrap-alt'] as $file) {
             file_put_contents(
-                self::RESOURCES_GENERATED . '/' . $file . '.css',
-                $scss->compile('/*! Do not edit this auto-generated file! */ @import "' . $file . '";'));
+                self::RESOURCES_GENERATED.'/'.$file.'.css',
+                $scss->compile('/*! Do not edit this auto-generated file! */ @import "'.$file.'";'));
         }
     }
 }

includes/Security/CredentialProviders/ScratchTokenCredentialProvider.php

Spacing +3 added lines, -3 removed lines

@@ -62,15 +62,15 @@
 
         $usedToken = null;
         foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
+            if (password_verify($data, $scratchToken)) {
                 $usedToken = $scratchToken;
                 SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
-                WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
+                WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl()."/internal.php/multiFactor");
                 break;
             }
         }
 
-        if($usedToken === null) {
+        if ($usedToken === null) {
             return false;
         }
 

Braces +1 added lines, -1 removed lines

@@ -62,7 +62,7 @@
 
         $usedToken = null;
         foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
+            if (password_verify($data, $scratchToken)) {
                 $usedToken = $scratchToken;
                 SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
                 WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");

Indentation +132 added lines, -132 removed lines

@@ -20,136 +20,136 @@
 
 class ScratchTokenCredentialProvider extends CredentialProviderBase
 {
-    /** @var EncryptionHelper */
-    private $encryptionHelper;
-    /** @var array the tokens generated in the last generation round. */
-    private $generatedTokens;
-
-    /**
-     * ScratchTokenCredentialProvider constructor.
-     *
-     * @param PdoDatabase       $database
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
-    {
-        parent::__construct($database, $configuration, 'scratch');
-        $this->encryptionHelper = new EncryptionHelper($configuration);
-    }
-
-    /**
-     * Validates a user-provided credential
-     *
-     * @param User   $user The user to test the authentication against
-     * @param string $data The raw credential data to be validated
-     *
-     * @return bool
-     * @throws ApplicationLogicException|OptimisticLockFailedException
-     */
-    public function authenticate(User $user, $data)
-    {
-        if (is_array($data)) {
-            return false;
-        }
-
-        $storedData = $this->getCredentialData($user->getId());
-
-        if ($storedData === null) {
-            throw new ApplicationLogicException('Credential data not found');
-        }
-
-        $scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
-
-        $usedToken = null;
-        foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
-                $usedToken = $scratchToken;
-                SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
-                WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
-                break;
-            }
-        }
-
-        if($usedToken === null) {
-            return false;
-        }
-
-        $scratchTokens = array_diff($scratchTokens, [$usedToken]);
-
-        $storedData->setData($this->encryptionHelper->encryptData(serialize($scratchTokens)));
-        $storedData->save();
-
-        return true;
-    }
-
-    /**
-     * @param User   $user   The user the credential belongs to
-     * @param int    $factor The factor this credential provides
-     * @param string $data   Unused.
-     *
-     * @throws OptimisticLockFailedException
-     */
-    public function setCredential(User $user, $factor, $data)
-    {
-        $plaintextScratch = array();
-        $storedScratch = array();
-        for ($i = 0; $i < 5; $i++) {
-            $token = Base32::encodeUpper(openssl_random_pseudo_bytes(10));
-            $plaintextScratch[] = $token;
-
-            $storedScratch[] = password_hash(
-                $token,
-                PasswordCredentialProvider::PASSWORD_ALGO,
-                array('cost' => PasswordCredentialProvider::PASSWORD_COST)
-            );
-        }
-
-        $storedData = $this->getCredentialData($user->getId(), null);
-
-        if ($storedData !== null) {
-            $storedData->delete();
-        }
-
-        $storedData = $this->createNewCredential($user);
-
-        $storedData->setData($this->encryptionHelper->encryptData(serialize($storedScratch)));
-        $storedData->setFactor($factor);
-        $storedData->setVersion(1);
-        $storedData->setPriority(9);
-
-        $storedData->save();
-        $this->generatedTokens = $plaintextScratch;
-    }
-
-    /**
-     * Gets the count of remaining valid tokens
-     *
-     * @param int $userId
-     *
-     * @return int
-     */
-    public function getRemaining($userId)
-    {
-        $storedData = $this->getCredentialData($userId);
-
-        if ($storedData === null) {
-            return 0;
-        }
-
-        $scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
-
-        return count($scratchTokens);
-    }
-
-    /**
-     * @return array
-     */
-    public function getTokens()
-    {
-        if ($this->generatedTokens != null) {
-            return $this->generatedTokens;
-        }
-
-        return array();
-    }
+	/** @var EncryptionHelper */
+	private $encryptionHelper;
+	/** @var array the tokens generated in the last generation round. */
+	private $generatedTokens;
+
+	/**
+	 * ScratchTokenCredentialProvider constructor.
+	 *
+	 * @param PdoDatabase       $database
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
+	{
+		parent::__construct($database, $configuration, 'scratch');
+		$this->encryptionHelper = new EncryptionHelper($configuration);
+	}
+
+	/**
+	 * Validates a user-provided credential
+	 *
+	 * @param User   $user The user to test the authentication against
+	 * @param string $data The raw credential data to be validated
+	 *
+	 * @return bool
+	 * @throws ApplicationLogicException|OptimisticLockFailedException
+	 */
+	public function authenticate(User $user, $data)
+	{
+		if (is_array($data)) {
+			return false;
+		}
+
+		$storedData = $this->getCredentialData($user->getId());
+
+		if ($storedData === null) {
+			throw new ApplicationLogicException('Credential data not found');
+		}
+
+		$scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
+
+		$usedToken = null;
+		foreach ($scratchTokens as $scratchToken) {
+			if (password_verify($data, $scratchToken)){
+				$usedToken = $scratchToken;
+				SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
+				WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
+				break;
+			}
+		}
+
+		if($usedToken === null) {
+			return false;
+		}
+
+		$scratchTokens = array_diff($scratchTokens, [$usedToken]);
+
+		$storedData->setData($this->encryptionHelper->encryptData(serialize($scratchTokens)));
+		$storedData->save();
+
+		return true;
+	}
+
+	/**
+	 * @param User   $user   The user the credential belongs to
+	 * @param int    $factor The factor this credential provides
+	 * @param string $data   Unused.
+	 *
+	 * @throws OptimisticLockFailedException
+	 */
+	public function setCredential(User $user, $factor, $data)
+	{
+		$plaintextScratch = array();
+		$storedScratch = array();
+		for ($i = 0; $i < 5; $i++) {
+			$token = Base32::encodeUpper(openssl_random_pseudo_bytes(10));
+			$plaintextScratch[] = $token;
+
+			$storedScratch[] = password_hash(
+				$token,
+				PasswordCredentialProvider::PASSWORD_ALGO,
+				array('cost' => PasswordCredentialProvider::PASSWORD_COST)
+			);
+		}
+
+		$storedData = $this->getCredentialData($user->getId(), null);
+
+		if ($storedData !== null) {
+			$storedData->delete();
+		}
+
+		$storedData = $this->createNewCredential($user);
+
+		$storedData->setData($this->encryptionHelper->encryptData(serialize($storedScratch)));
+		$storedData->setFactor($factor);
+		$storedData->setVersion(1);
+		$storedData->setPriority(9);
+
+		$storedData->save();
+		$this->generatedTokens = $plaintextScratch;
+	}
+
+	/**
+	 * Gets the count of remaining valid tokens
+	 *
+	 * @param int $userId
+	 *
+	 * @return int
+	 */
+	public function getRemaining($userId)
+	{
+		$storedData = $this->getCredentialData($userId);
+
+		if ($storedData === null) {
+			return 0;
+		}
+
+		$scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
+
+		return count($scratchTokens);
+	}
+
+	/**
+	 * @return array
+	 */
+	public function getTokens()
+	{
+		if ($this->generatedTokens != null) {
+			return $this->generatedTokens;
+		}
+
+		return array();
+	}
 }

includes/WebRequest.php

Indentation +563 added lines, -563 removed lines

@@ -22,567 +22,567 @@
  */
 class WebRequest
 {
-    /**
-     * @var \Waca\Providers\GlobalState\IGlobalStateProvider Provides access to the global state.
-     */
-    private static $globalStateProvider;
-
-    /**
-     * Returns a boolean value if the request was submitted with the HTTP POST method.
-     * @return bool
-     */
-    public static function wasPosted()
-    {
-        return self::method() === 'POST';
-    }
-
-    /**
-     * Gets the HTTP Method used
-     * @return string|null
-     */
-    public static function method()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['REQUEST_METHOD'])) {
-            return $server['REQUEST_METHOD'];
-        }
-
-        return null;
-    }
-
-    /**
-     * Gets a boolean value stating whether the request was served over HTTPS or not.
-     * @return bool
-     */
-    public static function isHttps()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['HTTP_X_FORWARDED_PROTO'])) {
-            if ($server['HTTP_X_FORWARDED_PROTO'] === 'https') {
-                // Client <=> Proxy is encrypted
-                return true;
-            }
-            else {
-                // Proxy <=> Server link unknown, Client <=> Proxy is not encrypted.
-                return false;
-            }
-        }
-
-        if (isset($server['HTTPS'])) {
-            if ($server['HTTPS'] === 'off') {
-                // ISAPI on IIS breaks the spec. :(
-                return false;
-            }
-
-            if ($server['HTTPS'] !== '') {
-                // Set to a non-empty value
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    /**
-     * Gets the path info
-     *
-     * @return array Array of path info segments
-     */
-    public static function pathInfo()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-        if (!isset($server['PATH_INFO'])) {
-            return array();
-        }
-
-        $exploded = explode('/', $server['PATH_INFO']);
-
-        // filter out empty values, and reindex from zero. Notably, the first element is always zero, since it starts
-        // with a /
-        return array_values(array_filter($exploded));
-    }
-
-    /**
-     * Gets the remote address of the web request
-     * @return null|string
-     */
-    public static function remoteAddress()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['REMOTE_ADDR'])) {
-            return $server['REMOTE_ADDR'];
-        }
-
-        return null;
-    }
-
-    /**
-     * Gets the remote address of the web request
-     * @return null|string
-     */
-    public static function httpHost()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['HTTP_HOST'])) {
-            return $server['HTTP_HOST'];
-        }
-
-        return null;
-    }
-
-    /**
-     * Gets the XFF header contents for the web request
-     * @return null|string
-     */
-    public static function forwardedAddress()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['HTTP_X_FORWARDED_FOR'])) {
-            return $server['HTTP_X_FORWARDED_FOR'];
-        }
-
-        return null;
-    }
-
-    /**
-     * Sets the global state provider.
-     *
-     * Almost guaranteed this is not the method you want in production code.
-     *
-     * @param \Waca\Providers\GlobalState\IGlobalStateProvider $globalState
-     */
-    public static function setGlobalStateProvider($globalState)
-    {
-        self::$globalStateProvider = $globalState;
-    }
-
-    #region POST variables
-
-    /**
-     * @param string $key
-     *
-     * @return null|string
-     */
-    public static function postString($key)
-    {
-        $post = &self::$globalStateProvider->getPostSuperGlobal();
-        if (!array_key_exists($key, $post)) {
-            return null;
-        }
-
-        if ($post[$key] === "") {
-            return null;
-        }
-
-        return (string)$post[$key];
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return null|string
-     */
-    public static function postEmail($key)
-    {
-        $post = &self::$globalStateProvider->getPostSuperGlobal();
-        if (!array_key_exists($key, $post)) {
-            return null;
-        }
-
-        $filteredValue = filter_var($post[$key], FILTER_SANITIZE_EMAIL);
-
-        if ($filteredValue === false) {
-            return null;
-        }
-
-        return (string)$filteredValue;
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return int|null
-     */
-    public static function postInt($key)
-    {
-        $post = &self::$globalStateProvider->getPostSuperGlobal();
-        if (!array_key_exists($key, $post)) {
-            return null;
-        }
-
-        $filteredValue = filter_var($post[$key], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
-
-        if ($filteredValue === null) {
-            return null;
-        }
-
-        return (int)$filteredValue;
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return bool
-     */
-    public static function postBoolean($key)
-    {
-        $get = &self::$globalStateProvider->getPostSuperGlobal();
-        if (!array_key_exists($key, $get)) {
-            return false;
-        }
-
-        // presence of parameter only
-        if ($get[$key] === "") {
-            return true;
-        }
-
-        if (in_array($get[$key], array(false, 'no', 'off', 0, 'false'), true)) {
-            return false;
-        }
-
-        return true;
-    }
-
-    #endregion
-
-    #region GET variables
-
-    /**
-     * @param string $key
-     *
-     * @return bool
-     */
-    public static function getBoolean($key)
-    {
-        $get = &self::$globalStateProvider->getGetSuperGlobal();
-        if (!array_key_exists($key, $get)) {
-            return false;
-        }
-
-        // presence of parameter only
-        if ($get[$key] === "") {
-            return true;
-        }
-
-        if (in_array($get[$key], array(false, 'no', 'off', 0, 'false'), true)) {
-            return false;
-        }
-
-        return true;
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return int|null
-     */
-    public static function getInt($key)
-    {
-        $get = &self::$globalStateProvider->getGetSuperGlobal();
-        if (!array_key_exists($key, $get)) {
-            return null;
-        }
-
-        $filteredValue = filter_var($get[$key], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
-
-        if ($filteredValue === null) {
-            return null;
-        }
-
-        return (int)$filteredValue;
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return null|string
-     */
-    public static function getString($key)
-    {
-        $get = &self::$globalStateProvider->getGetSuperGlobal();
-        if (!array_key_exists($key, $get)) {
-            return null;
-        }
-
-        if ($get[$key] === "") {
-            return null;
-        }
-
-        return (string)$get[$key];
-    }
-
-    #endregion
-
-    /**
-     * Sets the logged-in user to the specified user.
-     *
-     * @param User $user
-     */
-    public static function setLoggedInUser(User $user)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        $session['userID'] = $user->getId();
-        unset($session['partialLogin']);
-    }
-
-    /**
-     * Sets the post-login redirect
-     *
-     * @param string|null $uri The URI to redirect to
-     */
-    public static function setPostLoginRedirect($uri = null)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        if ($uri === null) {
-            $uri = self::requestUri();
-        }
-
-        $session['returnTo'] = $uri;
-    }
-
-    /**
-     * @return string|null
-     */
-    public static function requestUri()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['REQUEST_URI'])) {
-            return $server['REQUEST_URI'];
-        }
-
-        return null;
-    }
-
-    /**
-     * Clears the post-login redirect
-     * @return string
-     */
-    public static function clearPostLoginRedirect()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        if (array_key_exists('returnTo', $session)) {
-            $path = $session['returnTo'];
-            unset($session['returnTo']);
-
-            return $path;
-        }
-
-        return null;
-    }
-
-    /**
-     * @return string|null
-     */
-    public static function serverName()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['SERVER_NAME'])) {
-            return $server['SERVER_NAME'];
-        }
-
-        return null;
-    }
-
-    /**
-     * You probably only want to deal with this through SessionAlert.
-     * @return void
-     */
-    public static function clearSessionAlertData()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        if (array_key_exists('alerts', $session)) {
-            unset($session['alerts']);
-        }
-    }
-
-    /**
-     * You probably only want to deal with this through SessionAlert.
-     *
-     * @return string[]
-     */
-    public static function getSessionAlertData()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        if (array_key_exists('alerts', $session)) {
-            return $session['alerts'];
-        }
-
-        return array();
-    }
-
-    /**
-     * You probably only want to deal with this through SessionAlert.
-     *
-     * @param string[] $data
-     */
-    public static function setSessionAlertData($data)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        $session['alerts'] = $data;
-    }
-
-    /**
-     * You probably only want to deal with this through TokenManager.
-     *
-     * @return string[]
-     */
-    public static function getSessionTokenData()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        if (array_key_exists('tokens', $session)) {
-            return $session['tokens'];
-        }
-
-        return array();
-    }
-
-    /**
-     * You probably only want to deal with this through TokenManager.
-     *
-     * @param string[] $data
-     */
-    public static function setSessionTokenData($data)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        $session['tokens'] = $data;
-    }
-
-    /**
-     * @param string $key
-     *
-     * @return mixed
-     */
-    public static function getSessionContext($key)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        if (!isset($session['context'])) {
-            $session['context'] = array();
-        }
-
-        if (!isset($session['context'][$key])) {
-            return null;
-        }
-
-        return $session['context'][$key];
-    }
-
-    /**
-     * @param string $key
-     * @param mixed  $data
-     */
-    public static function setSessionContext($key, $data)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        if (!isset($session['context'])) {
-            $session['context'] = array();
-        }
-
-        $session['context'][$key] = $data;
-    }
-
-    /**
-     * @return int|null
-     */
-    public static function getSessionUserId()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        return isset($session['userID']) ? (int)$session['userID'] : null;
-    }
-
-    /**
-     * @param User $user
-     */
-    public static function setOAuthPartialLogin(User $user)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        $session['oauthPartialLogin'] = $user->getId();
-    }
-
-    /**
-     * @return int|null
-     */
-    public static function getOAuthPartialLogin()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        return isset($session['oauthPartialLogin']) ? (int)$session['oauthPartialLogin'] : null;
-    }
-
-    public static function setAuthPartialLogin($userId, $stage)
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        $session['authPartialLoginId'] = $userId;
-        $session['authPartialLoginStage'] = $stage;
-    }
-
-    public static function getAuthPartialLogin()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-
-        $userId = isset($session['authPartialLoginId']) ? (int)$session['authPartialLoginId'] : null;
-        $stage = isset($session['authPartialLoginStage']) ? (int)$session['authPartialLoginStage'] : null;
-
-        return array($userId, $stage);
-    }
-
-    public static function clearAuthPartialLogin()
-    {
-        $session = &self::$globalStateProvider->getSessionSuperGlobal();
-        unset($session['authPartialLoginId']);
-        unset($session['authPartialLoginStage']);
-    }
-
-    /**
-     * @return null|string
-     */
-    public static function userAgent()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['HTTP_USER_AGENT'])) {
-            return $server['HTTP_USER_AGENT'];
-        }
-
-        return null;
-    }
-
-    /**
-     * @return null|string
-     */
-    public static function scriptName()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['SCRIPT_NAME'])) {
-            return $server['SCRIPT_NAME'];
-        }
-
-        return null;
-    }
-
-    /**
-     * @return null|string
-     */
-    public static function origin()
-    {
-        $server = &self::$globalStateProvider->getServerSuperGlobal();
-
-        if (isset($server['HTTP_ORIGIN'])) {
-            return $server['HTTP_ORIGIN'];
-        }
-
-        return null;
-    }
+	/**
+	 * @var \Waca\Providers\GlobalState\IGlobalStateProvider Provides access to the global state.
+	 */
+	private static $globalStateProvider;
+
+	/**
+	 * Returns a boolean value if the request was submitted with the HTTP POST method.
+	 * @return bool
+	 */
+	public static function wasPosted()
+	{
+		return self::method() === 'POST';
+	}
+
+	/**
+	 * Gets the HTTP Method used
+	 * @return string|null
+	 */
+	public static function method()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['REQUEST_METHOD'])) {
+			return $server['REQUEST_METHOD'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * Gets a boolean value stating whether the request was served over HTTPS or not.
+	 * @return bool
+	 */
+	public static function isHttps()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['HTTP_X_FORWARDED_PROTO'])) {
+			if ($server['HTTP_X_FORWARDED_PROTO'] === 'https') {
+				// Client <=> Proxy is encrypted
+				return true;
+			}
+			else {
+				// Proxy <=> Server link unknown, Client <=> Proxy is not encrypted.
+				return false;
+			}
+		}
+
+		if (isset($server['HTTPS'])) {
+			if ($server['HTTPS'] === 'off') {
+				// ISAPI on IIS breaks the spec. :(
+				return false;
+			}
+
+			if ($server['HTTPS'] !== '') {
+				// Set to a non-empty value
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Gets the path info
+	 *
+	 * @return array Array of path info segments
+	 */
+	public static function pathInfo()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+		if (!isset($server['PATH_INFO'])) {
+			return array();
+		}
+
+		$exploded = explode('/', $server['PATH_INFO']);
+
+		// filter out empty values, and reindex from zero. Notably, the first element is always zero, since it starts
+		// with a /
+		return array_values(array_filter($exploded));
+	}
+
+	/**
+	 * Gets the remote address of the web request
+	 * @return null|string
+	 */
+	public static function remoteAddress()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['REMOTE_ADDR'])) {
+			return $server['REMOTE_ADDR'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * Gets the remote address of the web request
+	 * @return null|string
+	 */
+	public static function httpHost()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['HTTP_HOST'])) {
+			return $server['HTTP_HOST'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * Gets the XFF header contents for the web request
+	 * @return null|string
+	 */
+	public static function forwardedAddress()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['HTTP_X_FORWARDED_FOR'])) {
+			return $server['HTTP_X_FORWARDED_FOR'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * Sets the global state provider.
+	 *
+	 * Almost guaranteed this is not the method you want in production code.
+	 *
+	 * @param \Waca\Providers\GlobalState\IGlobalStateProvider $globalState
+	 */
+	public static function setGlobalStateProvider($globalState)
+	{
+		self::$globalStateProvider = $globalState;
+	}
+
+	#region POST variables
+
+	/**
+	 * @param string $key
+	 *
+	 * @return null|string
+	 */
+	public static function postString($key)
+	{
+		$post = &self::$globalStateProvider->getPostSuperGlobal();
+		if (!array_key_exists($key, $post)) {
+			return null;
+		}
+
+		if ($post[$key] === "") {
+			return null;
+		}
+
+		return (string)$post[$key];
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return null|string
+	 */
+	public static function postEmail($key)
+	{
+		$post = &self::$globalStateProvider->getPostSuperGlobal();
+		if (!array_key_exists($key, $post)) {
+			return null;
+		}
+
+		$filteredValue = filter_var($post[$key], FILTER_SANITIZE_EMAIL);
+
+		if ($filteredValue === false) {
+			return null;
+		}
+
+		return (string)$filteredValue;
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return int|null
+	 */
+	public static function postInt($key)
+	{
+		$post = &self::$globalStateProvider->getPostSuperGlobal();
+		if (!array_key_exists($key, $post)) {
+			return null;
+		}
+
+		$filteredValue = filter_var($post[$key], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+		if ($filteredValue === null) {
+			return null;
+		}
+
+		return (int)$filteredValue;
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return bool
+	 */
+	public static function postBoolean($key)
+	{
+		$get = &self::$globalStateProvider->getPostSuperGlobal();
+		if (!array_key_exists($key, $get)) {
+			return false;
+		}
+
+		// presence of parameter only
+		if ($get[$key] === "") {
+			return true;
+		}
+
+		if (in_array($get[$key], array(false, 'no', 'off', 0, 'false'), true)) {
+			return false;
+		}
+
+		return true;
+	}
+
+	#endregion
+
+	#region GET variables
+
+	/**
+	 * @param string $key
+	 *
+	 * @return bool
+	 */
+	public static function getBoolean($key)
+	{
+		$get = &self::$globalStateProvider->getGetSuperGlobal();
+		if (!array_key_exists($key, $get)) {
+			return false;
+		}
+
+		// presence of parameter only
+		if ($get[$key] === "") {
+			return true;
+		}
+
+		if (in_array($get[$key], array(false, 'no', 'off', 0, 'false'), true)) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return int|null
+	 */
+	public static function getInt($key)
+	{
+		$get = &self::$globalStateProvider->getGetSuperGlobal();
+		if (!array_key_exists($key, $get)) {
+			return null;
+		}
+
+		$filteredValue = filter_var($get[$key], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+		if ($filteredValue === null) {
+			return null;
+		}
+
+		return (int)$filteredValue;
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return null|string
+	 */
+	public static function getString($key)
+	{
+		$get = &self::$globalStateProvider->getGetSuperGlobal();
+		if (!array_key_exists($key, $get)) {
+			return null;
+		}
+
+		if ($get[$key] === "") {
+			return null;
+		}
+
+		return (string)$get[$key];
+	}
+
+	#endregion
+
+	/**
+	 * Sets the logged-in user to the specified user.
+	 *
+	 * @param User $user
+	 */
+	public static function setLoggedInUser(User $user)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		$session['userID'] = $user->getId();
+		unset($session['partialLogin']);
+	}
+
+	/**
+	 * Sets the post-login redirect
+	 *
+	 * @param string|null $uri The URI to redirect to
+	 */
+	public static function setPostLoginRedirect($uri = null)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		if ($uri === null) {
+			$uri = self::requestUri();
+		}
+
+		$session['returnTo'] = $uri;
+	}
+
+	/**
+	 * @return string|null
+	 */
+	public static function requestUri()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['REQUEST_URI'])) {
+			return $server['REQUEST_URI'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * Clears the post-login redirect
+	 * @return string
+	 */
+	public static function clearPostLoginRedirect()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		if (array_key_exists('returnTo', $session)) {
+			$path = $session['returnTo'];
+			unset($session['returnTo']);
+
+			return $path;
+		}
+
+		return null;
+	}
+
+	/**
+	 * @return string|null
+	 */
+	public static function serverName()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['SERVER_NAME'])) {
+			return $server['SERVER_NAME'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * You probably only want to deal with this through SessionAlert.
+	 * @return void
+	 */
+	public static function clearSessionAlertData()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		if (array_key_exists('alerts', $session)) {
+			unset($session['alerts']);
+		}
+	}
+
+	/**
+	 * You probably only want to deal with this through SessionAlert.
+	 *
+	 * @return string[]
+	 */
+	public static function getSessionAlertData()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		if (array_key_exists('alerts', $session)) {
+			return $session['alerts'];
+		}
+
+		return array();
+	}
+
+	/**
+	 * You probably only want to deal with this through SessionAlert.
+	 *
+	 * @param string[] $data
+	 */
+	public static function setSessionAlertData($data)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		$session['alerts'] = $data;
+	}
+
+	/**
+	 * You probably only want to deal with this through TokenManager.
+	 *
+	 * @return string[]
+	 */
+	public static function getSessionTokenData()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		if (array_key_exists('tokens', $session)) {
+			return $session['tokens'];
+		}
+
+		return array();
+	}
+
+	/**
+	 * You probably only want to deal with this through TokenManager.
+	 *
+	 * @param string[] $data
+	 */
+	public static function setSessionTokenData($data)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		$session['tokens'] = $data;
+	}
+
+	/**
+	 * @param string $key
+	 *
+	 * @return mixed
+	 */
+	public static function getSessionContext($key)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		if (!isset($session['context'])) {
+			$session['context'] = array();
+		}
+
+		if (!isset($session['context'][$key])) {
+			return null;
+		}
+
+		return $session['context'][$key];
+	}
+
+	/**
+	 * @param string $key
+	 * @param mixed  $data
+	 */
+	public static function setSessionContext($key, $data)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		if (!isset($session['context'])) {
+			$session['context'] = array();
+		}
+
+		$session['context'][$key] = $data;
+	}
+
+	/**
+	 * @return int|null
+	 */
+	public static function getSessionUserId()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		return isset($session['userID']) ? (int)$session['userID'] : null;
+	}
+
+	/**
+	 * @param User $user
+	 */
+	public static function setOAuthPartialLogin(User $user)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		$session['oauthPartialLogin'] = $user->getId();
+	}
+
+	/**
+	 * @return int|null
+	 */
+	public static function getOAuthPartialLogin()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		return isset($session['oauthPartialLogin']) ? (int)$session['oauthPartialLogin'] : null;
+	}
+
+	public static function setAuthPartialLogin($userId, $stage)
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		$session['authPartialLoginId'] = $userId;
+		$session['authPartialLoginStage'] = $stage;
+	}
+
+	public static function getAuthPartialLogin()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+
+		$userId = isset($session['authPartialLoginId']) ? (int)$session['authPartialLoginId'] : null;
+		$stage = isset($session['authPartialLoginStage']) ? (int)$session['authPartialLoginStage'] : null;
+
+		return array($userId, $stage);
+	}
+
+	public static function clearAuthPartialLogin()
+	{
+		$session = &self::$globalStateProvider->getSessionSuperGlobal();
+		unset($session['authPartialLoginId']);
+		unset($session['authPartialLoginStage']);
+	}
+
+	/**
+	 * @return null|string
+	 */
+	public static function userAgent()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['HTTP_USER_AGENT'])) {
+			return $server['HTTP_USER_AGENT'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * @return null|string
+	 */
+	public static function scriptName()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['SCRIPT_NAME'])) {
+			return $server['SCRIPT_NAME'];
+		}
+
+		return null;
+	}
+
+	/**
+	 * @return null|string
+	 */
+	public static function origin()
+	{
+		$server = &self::$globalStateProvider->getServerSuperGlobal();
+
+		if (isset($server['HTTP_ORIGIN'])) {
+			return $server['HTTP_ORIGIN'];
+		}
+
+		return null;
+	}
 }

includes/Pages/PageUserManagement.php

Spacing +6 added lines, -6 removed lines

@@ -40,7 +40,7 @@ 
         $userSearchRequest = WebRequest::getString('usersearch');
         if ($userSearchRequest !== null) {
             $searchedUser = User::getByUsername($userSearchRequest, $database);
-            if($searchedUser !== false) {
+            if ($searchedUser !== false) {
                 $this->redirect('statistics/users', 'detail', ['user' => $searchedUser->getId()]);
                 return;
             }
@@ -134,7 +134,7 @@ 
                     continue;
                 }
 
-                $newValue = WebRequest::postBoolean('role-' . $name) ? 1 : 0;
+                $newValue = WebRequest::postBoolean('role-'.$name) ? 1 : 0;
                 if ($newValue !== $r['active']) {
                     if ($newValue === 0) {
                         $delete[] = $r['object'];
@@ -177,7 +177,7 @@ 
             $user->save();
 
             $this->getNotificationHelper()->userRolesEdited($user, $reason);
-            SessionAlert::quick('Roles changed for user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+            SessionAlert::quick('Roles changed for user '.htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
 
             $this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
 
@@ -230,7 +230,7 @@ 
             Logger::suspendedUser($database, $user, $reason);
 
             $this->getNotificationHelper()->userSuspended($user, $reason);
-            SessionAlert::quick('Suspended user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+            SessionAlert::quick('Suspended user '.htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
 
             // send email
             $this->sendStatusChangeEmail(
@@ -291,7 +291,7 @@ 
             Logger::declinedUser($database, $user, $reason);
 
             $this->getNotificationHelper()->userDeclined($user, $reason);
-            SessionAlert::quick('Declined user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+            SessionAlert::quick('Declined user '.htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
 
             // send email
             $this->sendStatusChangeEmail(
@@ -346,7 +346,7 @@ 
             Logger::approvedUser($database, $user);
 
             $this->getNotificationHelper()->userApproved($user);
-            SessionAlert::quick('Approved user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+            SessionAlert::quick('Approved user '.htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
 
             // send email
             $this->sendStatusChangeEmail(

Indentation +552 added lines, -552 removed lines

@@ -24,556 +24,556 @@
  */
 class PageUserManagement extends InternalPageBase
 {
-    /** @var string */
-    private $adminMailingList = 'enwiki-acc-admins@googlegroups.com';
-
-    /**
-     * Main function for this page, when no specific actions are called.
-     */
-    protected function main()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $userSearchRequest = WebRequest::getString('usersearch');
-        if ($userSearchRequest !== null) {
-            $searchedUser = User::getByUsername($userSearchRequest, $database);
-            if($searchedUser !== false) {
-                $this->redirect('statistics/users', 'detail', ['user' => $searchedUser->getId()]);
-                return;
-            }
-        }
-
-        // A bit hacky, but it's better than my last solution of creating an object for each user and passing that to
-        // the template. I still don't have a particularly good way of handling this.
-        OAuthUserHelper::prepareTokenCountStatement($database);
-
-        if (WebRequest::getBoolean("showAll")) {
-            $this->assign("showAll", true);
-
-            $suspendedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_SUSPENDED)->fetch();
-            $this->assign("suspendedUsers", $suspendedUsers);
-
-            $declinedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_DECLINED)->fetch();
-            $this->assign("declinedUsers", $declinedUsers);
-
-            UserSearchHelper::get($database)->getRoleMap($roleMap);
-        }
-        else {
-            $this->assign("showAll", false);
-            $this->assign("suspendedUsers", array());
-            $this->assign("declinedUsers", array());
-
-            UserSearchHelper::get($database)->statusIn(array('New', 'Active'))->getRoleMap($roleMap);
-        }
-
-        $newUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_NEW)->fetch();
-        $normalUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('user')->fetch();
-        $adminUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('admin')->fetch();
-        $checkUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('checkuser')->fetch();
-        $toolRoots = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('toolRoot')->fetch();
-        $this->assign('newUsers', $newUsers);
-        $this->assign('normalUsers', $normalUsers);
-        $this->assign('adminUsers', $adminUsers);
-        $this->assign('checkUsers', $checkUsers);
-        $this->assign('toolRoots', $toolRoots);
-
-        $this->assign('roles', $roleMap);
-
-        $this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
-
-        $this->assign('canApprove', $this->barrierTest('approve', $currentUser));
-        $this->assign('canDecline', $this->barrierTest('decline', $currentUser));
-        $this->assign('canRename', $this->barrierTest('rename', $currentUser));
-        $this->assign('canEditUser', $this->barrierTest('editUser', $currentUser));
-        $this->assign('canSuspend', $this->barrierTest('suspend', $currentUser));
-        $this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser));
-
-        $this->setTemplate("usermanagement/main.tpl");
-    }
-
-    #region Access control
-
-    /**
-     * Action target for editing the roles assigned to a user
-     */
-    protected function editRoles()
-    {
-        $this->setHtmlTitle('User Management');
-        $database = $this->getDatabase();
-        $userId = WebRequest::getInt('user');
-
-        /** @var User $user */
-        $user = User::getById($userId, $database);
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
-        }
-
-        $roleData = $this->getRoleData(UserRole::getForUser($user->getId(), $database));
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-
-            $reason = WebRequest::postString('reason');
-            if ($reason === false || trim($reason) === '') {
-                throw new ApplicationLogicException('No reason specified for roles change');
-            }
-
-            /** @var UserRole[] $delete */
-            $delete = array();
-            /** @var string[] $delete */
-            $add = array();
-
-            foreach ($roleData as $name => $r) {
-                if ($r['allowEdit'] !== 1) {
-                    // not allowed, to touch this, so ignore it
-                    continue;
-                }
-
-                $newValue = WebRequest::postBoolean('role-' . $name) ? 1 : 0;
-                if ($newValue !== $r['active']) {
-                    if ($newValue === 0) {
-                        $delete[] = $r['object'];
-                    }
-
-                    if ($newValue === 1) {
-                        $add[] = $name;
-                    }
-                }
-            }
-
-            // Check there's something to do
-            if ((count($add) + count($delete)) === 0) {
-                $this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
-                SessionAlert::warning('No changes made to roles.');
-
-                return;
-            }
-
-            $removed = array();
-
-            /** @var UserRole $d */
-            foreach ($delete as $d) {
-                $removed[] = $d->getRole();
-                $d->delete();
-            }
-
-            foreach ($add as $x) {
-                $a = new UserRole();
-                $a->setUser($user->getId());
-                $a->setRole($x);
-                $a->setDatabase($database);
-                $a->save();
-            }
-
-            Logger::userRolesEdited($database, $user, $reason, $add, $removed);
-
-            // dummy save for optimistic locking. If this fails, the entire txn will roll back.
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-
-            $this->getNotificationHelper()->userRolesEdited($user, $reason);
-            SessionAlert::quick('Roles changed for user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            $this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/roleedit.tpl');
-            $this->assign('user', $user);
-            $this->assign('roleData', $roleData);
-        }
-    }
-
-    /**
-     * Action target for suspending users
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function suspend()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-
-        /** @var User $user */
-        $user = User::getById($userId, $database);
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to suspend could not be found.');
-        }
-
-        if ($user->isSuspended()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to suspend is already suspended.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $reason = WebRequest::postString('reason');
-
-            if ($reason === null || trim($reason) === "") {
-                throw new ApplicationLogicException('No reason provided');
-            }
-
-            $user->setStatus(User::STATUS_SUSPENDED);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::suspendedUser($database, $user, $reason);
-
-            $this->getNotificationHelper()->userSuspended($user, $reason);
-            SessionAlert::quick('Suspended user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been suspended',
-                'usermanagement/emails/suspended.tpl',
-                $reason,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect('userManagement');
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/changelevel-reason.tpl');
-            $this->assign('user', $user);
-            $this->assign('status', 'Suspended');
-            $this->assign("showReason", true);
-
-            if (WebRequest::getString('preload')) {
-                $this->assign('preload', WebRequest::getString('preload'));
-            }
-        }
-    }
-
-    /**
-     * Entry point for the decline action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function decline()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to decline could not be found.');
-        }
-
-        if (!$user->isNewUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to decline is not new.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $reason = WebRequest::postString('reason');
-
-            if ($reason === null || trim($reason) === "") {
-                throw new ApplicationLogicException('No reason provided');
-            }
-
-            $user->setStatus(User::STATUS_DECLINED);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::declinedUser($database, $user, $reason);
-
-            $this->getNotificationHelper()->userDeclined($user, $reason);
-            SessionAlert::quick('Declined user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been declined',
-                'usermanagement/emails/declined.tpl',
-                $reason,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect('userManagement');
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/changelevel-reason.tpl');
-            $this->assign('user', $user);
-            $this->assign('status', 'Declined');
-            $this->assign("showReason", true);
-        }
-    }
-
-    /**
-     * Entry point for the approve action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function approve()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to approve could not be found.');
-        }
-
-        if ($user->isActive()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to approve is already an active user.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $user->setStatus(User::STATUS_ACTIVE);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::approvedUser($database, $user);
-
-            $this->getNotificationHelper()->userApproved($user);
-            SessionAlert::quick('Approved user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been approved',
-                'usermanagement/emails/approved.tpl',
-                null,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate("usermanagement/changelevel-reason.tpl");
-            $this->assign("user", $user);
-            $this->assign("status", "Active");
-            $this->assign("showReason", false);
-        }
-    }
-
-    #endregion
-
-    #region Renaming / Editing
-
-    /**
-     * Entry point for the rename action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function rename()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to rename could not be found.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $newUsername = WebRequest::postString('newname');
-
-            if ($newUsername === null || trim($newUsername) === "") {
-                throw new ApplicationLogicException('The new username cannot be empty');
-            }
-
-            if (User::getByUsername($newUsername, $database) != false) {
-                throw new ApplicationLogicException('The new username already exists');
-            }
-
-            $oldUsername = $user->getUsername();
-            $user->setUsername($newUsername);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-
-            $user->save();
-
-            $logEntryData = serialize(array(
-                'old' => $oldUsername,
-                'new' => $newUsername,
-            ));
-
-            Logger::renamedUser($database, $user, $logEntryData);
-
-            SessionAlert::quick("Changed User "
-                . htmlentities($oldUsername, ENT_COMPAT, 'UTF-8')
-                . " name to "
-                . htmlentities($newUsername, ENT_COMPAT, 'UTF-8'));
-
-            $this->getNotificationHelper()->userRenamed($user, $oldUsername);
-
-            // send an email to the user.
-            $this->assign('targetUsername', $user->getUsername());
-            $this->assign('toolAdmin', User::getCurrent($database)->getUsername());
-            $this->assign('oldUsername', $oldUsername);
-            $this->assign('mailingList', $this->adminMailingList);
-
-            $this->getEmailHelper()->sendMail(
-                $user->getEmail(),
-                'Your username on WP:ACC has been changed',
-                $this->fetchTemplate('usermanagement/emails/renamed.tpl'),
-                array('Reply-To' => $this->adminMailingList)
-            );
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/renameuser.tpl');
-            $this->assign('user', $user);
-        }
-    }
-
-    /**
-     * Entry point for the edit action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function editUser()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-        $oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $newEmail = WebRequest::postEmail('user_email');
-            $newOnWikiName = WebRequest::postString('user_onwikiname');
-
-            if ($newEmail === null) {
-                throw new ApplicationLogicException('Invalid email address');
-            }
-
-            if (!$oauth->isFullyLinked()) {
-                if (trim($newOnWikiName) == "") {
-                    throw new ApplicationLogicException('New on-wiki username cannot be blank');
-                }
-
-                $user->setOnWikiName($newOnWikiName);
-            }
-
-            $user->setEmail($newEmail);
-
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-
-            $user->save();
-
-            Logger::userPreferencesChange($database, $user);
-            $this->getNotificationHelper()->userPrefChange($user);
-            SessionAlert::quick('Changes to user\'s preferences have been saved');
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(),
-                $this->getSiteConfiguration());
-            $this->setTemplate('usermanagement/edituser.tpl');
-            $this->assign('user', $user);
-            $this->assign('oauth', $oauth);
-        }
-    }
-
-    #endregion
-
-    /**
-     * Sends a status change email to the user.
-     *
-     * @param string      $subject           The subject of the email
-     * @param string      $template          The smarty template to use
-     * @param string|null $reason            The reason for performing the status change
-     * @param User        $user              The user affected
-     * @param string      $toolAdminUsername The tool admin's username who is making the edit
-     */
-    private function sendStatusChangeEmail($subject, $template, $reason, $user, $toolAdminUsername)
-    {
-        $this->assign('targetUsername', $user->getUsername());
-        $this->assign('toolAdmin', $toolAdminUsername);
-        $this->assign('actionReason', $reason);
-        $this->assign('mailingList', $this->adminMailingList);
-
-        $this->getEmailHelper()->sendMail(
-            $user->getEmail(),
-            $subject,
-            $this->fetchTemplate($template),
-            array('Reply-To' => $this->adminMailingList)
-        );
-    }
-
-    /**
-     * @param UserRole[] $activeRoles
-     *
-     * @return array
-     */
-    private function getRoleData($activeRoles)
-    {
-        $availableRoles = $this->getSecurityManager()->getRoleConfiguration()->getAvailableRoles();
-
-        $currentUser = User::getCurrent($this->getDatabase());
-        $this->getSecurityManager()->getActiveRoles($currentUser, $userRoles, $inactiveRoles);
-
-        $initialValue = array('active' => 0, 'allowEdit' => 0, 'description' => '???', 'object' => null);
-
-        $roleData = array();
-        foreach ($availableRoles as $role => $data) {
-            $intersection = array_intersect($data['editableBy'], $userRoles);
-
-            $roleData[$role] = $initialValue;
-            $roleData[$role]['allowEdit'] = count($intersection) > 0 ? 1 : 0;
-            $roleData[$role]['description'] = $data['description'];
-        }
-
-        foreach ($activeRoles as $role) {
-            if (!isset($roleData[$role->getRole()])) {
-                // This value is no longer available in the configuration, allow changing (aka removing) it.
-                $roleData[$role->getRole()] = $initialValue;
-                $roleData[$role->getRole()]['allowEdit'] = 1;
-            }
-
-            $roleData[$role->getRole()]['object'] = $role;
-            $roleData[$role->getRole()]['active'] = 1;
-        }
-
-        return $roleData;
-    }
+	/** @var string */
+	private $adminMailingList = 'enwiki-acc-admins@googlegroups.com';
+
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 */
+	protected function main()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$userSearchRequest = WebRequest::getString('usersearch');
+		if ($userSearchRequest !== null) {
+			$searchedUser = User::getByUsername($userSearchRequest, $database);
+			if($searchedUser !== false) {
+				$this->redirect('statistics/users', 'detail', ['user' => $searchedUser->getId()]);
+				return;
+			}
+		}
+
+		// A bit hacky, but it's better than my last solution of creating an object for each user and passing that to
+		// the template. I still don't have a particularly good way of handling this.
+		OAuthUserHelper::prepareTokenCountStatement($database);
+
+		if (WebRequest::getBoolean("showAll")) {
+			$this->assign("showAll", true);
+
+			$suspendedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_SUSPENDED)->fetch();
+			$this->assign("suspendedUsers", $suspendedUsers);
+
+			$declinedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_DECLINED)->fetch();
+			$this->assign("declinedUsers", $declinedUsers);
+
+			UserSearchHelper::get($database)->getRoleMap($roleMap);
+		}
+		else {
+			$this->assign("showAll", false);
+			$this->assign("suspendedUsers", array());
+			$this->assign("declinedUsers", array());
+
+			UserSearchHelper::get($database)->statusIn(array('New', 'Active'))->getRoleMap($roleMap);
+		}
+
+		$newUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_NEW)->fetch();
+		$normalUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('user')->fetch();
+		$adminUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('admin')->fetch();
+		$checkUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('checkuser')->fetch();
+		$toolRoots = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('toolRoot')->fetch();
+		$this->assign('newUsers', $newUsers);
+		$this->assign('normalUsers', $normalUsers);
+		$this->assign('adminUsers', $adminUsers);
+		$this->assign('checkUsers', $checkUsers);
+		$this->assign('toolRoots', $toolRoots);
+
+		$this->assign('roles', $roleMap);
+
+		$this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
+
+		$this->assign('canApprove', $this->barrierTest('approve', $currentUser));
+		$this->assign('canDecline', $this->barrierTest('decline', $currentUser));
+		$this->assign('canRename', $this->barrierTest('rename', $currentUser));
+		$this->assign('canEditUser', $this->barrierTest('editUser', $currentUser));
+		$this->assign('canSuspend', $this->barrierTest('suspend', $currentUser));
+		$this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser));
+
+		$this->setTemplate("usermanagement/main.tpl");
+	}
+
+	#region Access control
+
+	/**
+	 * Action target for editing the roles assigned to a user
+	 */
+	protected function editRoles()
+	{
+		$this->setHtmlTitle('User Management');
+		$database = $this->getDatabase();
+		$userId = WebRequest::getInt('user');
+
+		/** @var User $user */
+		$user = User::getById($userId, $database);
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
+		}
+
+		$roleData = $this->getRoleData(UserRole::getForUser($user->getId(), $database));
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+
+			$reason = WebRequest::postString('reason');
+			if ($reason === false || trim($reason) === '') {
+				throw new ApplicationLogicException('No reason specified for roles change');
+			}
+
+			/** @var UserRole[] $delete */
+			$delete = array();
+			/** @var string[] $delete */
+			$add = array();
+
+			foreach ($roleData as $name => $r) {
+				if ($r['allowEdit'] !== 1) {
+					// not allowed, to touch this, so ignore it
+					continue;
+				}
+
+				$newValue = WebRequest::postBoolean('role-' . $name) ? 1 : 0;
+				if ($newValue !== $r['active']) {
+					if ($newValue === 0) {
+						$delete[] = $r['object'];
+					}
+
+					if ($newValue === 1) {
+						$add[] = $name;
+					}
+				}
+			}
+
+			// Check there's something to do
+			if ((count($add) + count($delete)) === 0) {
+				$this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
+				SessionAlert::warning('No changes made to roles.');
+
+				return;
+			}
+
+			$removed = array();
+
+			/** @var UserRole $d */
+			foreach ($delete as $d) {
+				$removed[] = $d->getRole();
+				$d->delete();
+			}
+
+			foreach ($add as $x) {
+				$a = new UserRole();
+				$a->setUser($user->getId());
+				$a->setRole($x);
+				$a->setDatabase($database);
+				$a->save();
+			}
+
+			Logger::userRolesEdited($database, $user, $reason, $add, $removed);
+
+			// dummy save for optimistic locking. If this fails, the entire txn will roll back.
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+
+			$this->getNotificationHelper()->userRolesEdited($user, $reason);
+			SessionAlert::quick('Roles changed for user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			$this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/roleedit.tpl');
+			$this->assign('user', $user);
+			$this->assign('roleData', $roleData);
+		}
+	}
+
+	/**
+	 * Action target for suspending users
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function suspend()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+
+		/** @var User $user */
+		$user = User::getById($userId, $database);
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to suspend could not be found.');
+		}
+
+		if ($user->isSuspended()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to suspend is already suspended.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$reason = WebRequest::postString('reason');
+
+			if ($reason === null || trim($reason) === "") {
+				throw new ApplicationLogicException('No reason provided');
+			}
+
+			$user->setStatus(User::STATUS_SUSPENDED);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::suspendedUser($database, $user, $reason);
+
+			$this->getNotificationHelper()->userSuspended($user, $reason);
+			SessionAlert::quick('Suspended user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been suspended',
+				'usermanagement/emails/suspended.tpl',
+				$reason,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect('userManagement');
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/changelevel-reason.tpl');
+			$this->assign('user', $user);
+			$this->assign('status', 'Suspended');
+			$this->assign("showReason", true);
+
+			if (WebRequest::getString('preload')) {
+				$this->assign('preload', WebRequest::getString('preload'));
+			}
+		}
+	}
+
+	/**
+	 * Entry point for the decline action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function decline()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to decline could not be found.');
+		}
+
+		if (!$user->isNewUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to decline is not new.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$reason = WebRequest::postString('reason');
+
+			if ($reason === null || trim($reason) === "") {
+				throw new ApplicationLogicException('No reason provided');
+			}
+
+			$user->setStatus(User::STATUS_DECLINED);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::declinedUser($database, $user, $reason);
+
+			$this->getNotificationHelper()->userDeclined($user, $reason);
+			SessionAlert::quick('Declined user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been declined',
+				'usermanagement/emails/declined.tpl',
+				$reason,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect('userManagement');
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/changelevel-reason.tpl');
+			$this->assign('user', $user);
+			$this->assign('status', 'Declined');
+			$this->assign("showReason", true);
+		}
+	}
+
+	/**
+	 * Entry point for the approve action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function approve()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to approve could not be found.');
+		}
+
+		if ($user->isActive()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to approve is already an active user.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$user->setStatus(User::STATUS_ACTIVE);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::approvedUser($database, $user);
+
+			$this->getNotificationHelper()->userApproved($user);
+			SessionAlert::quick('Approved user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been approved',
+				'usermanagement/emails/approved.tpl',
+				null,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate("usermanagement/changelevel-reason.tpl");
+			$this->assign("user", $user);
+			$this->assign("status", "Active");
+			$this->assign("showReason", false);
+		}
+	}
+
+	#endregion
+
+	#region Renaming / Editing
+
+	/**
+	 * Entry point for the rename action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function rename()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to rename could not be found.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$newUsername = WebRequest::postString('newname');
+
+			if ($newUsername === null || trim($newUsername) === "") {
+				throw new ApplicationLogicException('The new username cannot be empty');
+			}
+
+			if (User::getByUsername($newUsername, $database) != false) {
+				throw new ApplicationLogicException('The new username already exists');
+			}
+
+			$oldUsername = $user->getUsername();
+			$user->setUsername($newUsername);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+
+			$user->save();
+
+			$logEntryData = serialize(array(
+				'old' => $oldUsername,
+				'new' => $newUsername,
+			));
+
+			Logger::renamedUser($database, $user, $logEntryData);
+
+			SessionAlert::quick("Changed User "
+				. htmlentities($oldUsername, ENT_COMPAT, 'UTF-8')
+				. " name to "
+				. htmlentities($newUsername, ENT_COMPAT, 'UTF-8'));
+
+			$this->getNotificationHelper()->userRenamed($user, $oldUsername);
+
+			// send an email to the user.
+			$this->assign('targetUsername', $user->getUsername());
+			$this->assign('toolAdmin', User::getCurrent($database)->getUsername());
+			$this->assign('oldUsername', $oldUsername);
+			$this->assign('mailingList', $this->adminMailingList);
+
+			$this->getEmailHelper()->sendMail(
+				$user->getEmail(),
+				'Your username on WP:ACC has been changed',
+				$this->fetchTemplate('usermanagement/emails/renamed.tpl'),
+				array('Reply-To' => $this->adminMailingList)
+			);
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/renameuser.tpl');
+			$this->assign('user', $user);
+		}
+	}
+
+	/**
+	 * Entry point for the edit action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function editUser()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+		$oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$newEmail = WebRequest::postEmail('user_email');
+			$newOnWikiName = WebRequest::postString('user_onwikiname');
+
+			if ($newEmail === null) {
+				throw new ApplicationLogicException('Invalid email address');
+			}
+
+			if (!$oauth->isFullyLinked()) {
+				if (trim($newOnWikiName) == "") {
+					throw new ApplicationLogicException('New on-wiki username cannot be blank');
+				}
+
+				$user->setOnWikiName($newOnWikiName);
+			}
+
+			$user->setEmail($newEmail);
+
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+
+			$user->save();
+
+			Logger::userPreferencesChange($database, $user);
+			$this->getNotificationHelper()->userPrefChange($user);
+			SessionAlert::quick('Changes to user\'s preferences have been saved');
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(),
+				$this->getSiteConfiguration());
+			$this->setTemplate('usermanagement/edituser.tpl');
+			$this->assign('user', $user);
+			$this->assign('oauth', $oauth);
+		}
+	}
+
+	#endregion
+
+	/**
+	 * Sends a status change email to the user.
+	 *
+	 * @param string      $subject           The subject of the email
+	 * @param string      $template          The smarty template to use
+	 * @param string|null $reason            The reason for performing the status change
+	 * @param User        $user              The user affected
+	 * @param string      $toolAdminUsername The tool admin's username who is making the edit
+	 */
+	private function sendStatusChangeEmail($subject, $template, $reason, $user, $toolAdminUsername)
+	{
+		$this->assign('targetUsername', $user->getUsername());
+		$this->assign('toolAdmin', $toolAdminUsername);
+		$this->assign('actionReason', $reason);
+		$this->assign('mailingList', $this->adminMailingList);
+
+		$this->getEmailHelper()->sendMail(
+			$user->getEmail(),
+			$subject,
+			$this->fetchTemplate($template),
+			array('Reply-To' => $this->adminMailingList)
+		);
+	}
+
+	/**
+	 * @param UserRole[] $activeRoles
+	 *
+	 * @return array
+	 */
+	private function getRoleData($activeRoles)
+	{
+		$availableRoles = $this->getSecurityManager()->getRoleConfiguration()->getAvailableRoles();
+
+		$currentUser = User::getCurrent($this->getDatabase());
+		$this->getSecurityManager()->getActiveRoles($currentUser, $userRoles, $inactiveRoles);
+
+		$initialValue = array('active' => 0, 'allowEdit' => 0, 'description' => '???', 'object' => null);
+
+		$roleData = array();
+		foreach ($availableRoles as $role => $data) {
+			$intersection = array_intersect($data['editableBy'], $userRoles);
+
+			$roleData[$role] = $initialValue;
+			$roleData[$role]['allowEdit'] = count($intersection) > 0 ? 1 : 0;
+			$roleData[$role]['description'] = $data['description'];
+		}
+
+		foreach ($activeRoles as $role) {
+			if (!isset($roleData[$role->getRole()])) {
+				// This value is no longer available in the configuration, allow changing (aka removing) it.
+				$roleData[$role->getRole()] = $initialValue;
+				$roleData[$role->getRole()]['allowEdit'] = 1;
+			}
+
+			$roleData[$role->getRole()]['object'] = $role;
+			$roleData[$role->getRole()]['active'] = 1;
+		}
+
+		return $roleData;
+	}
 }

includes/Pages/PageXffDemo.php

Indentation +132 added lines, -132 removed lines

@@ -13,136 +13,136 @@
 
 class PageXffDemo extends InternalPageBase
 {
-    use RequestData;
-
-    /**
-     * @inheritDoc
-     */
-    protected function main()
-    {
-        $this->setTemplate('xffdemo.tpl');
-
-        // requestHasForwardedIp == false
-        // requestProxyData
-        // requestRealIp == proxy
-        // requestForwardedIp == xff header
-        // forwardedOrigin  == top of the chain, assuming xff is trusted
-
-
-        $this->assign('demo2', [
-            [
-                'trust' => true,
-                'trustedlink' => true,
-                'ip' => '172.16.0.164',
-                'routable' => false,
-
-            ],[
-                'trust' => true,
-                'ip' => '198.51.100.123',
-                'routable' => true,
-                'rdns' => 'trustedproxy.example.com',
-
-            ],[
-                'trust' => true,
-                'ip' => '192.0.2.1',
-                'routable' => true,
-                'rdns' => 'client.users.example.org',
-                'location' => [
-                    'cityName' => 'San Francisco',
-                    'regionName' => 'California',
-                    'countryName' => 'United States'
-                ],
-                'showlinks' => true
-            ]
-        ]);
-
-        $this->assign('demo3', [
-            [
-                'trust' => true,
-                'trustedlink' => true,
-                'ip' => '172.16.0.164',
-                'routable' => false,
-
-            ],[
-                'trust' => false,
-                'ip' => '198.51.100.234',
-                'routable' => true,
-                'rdns' => 'sketchyproxy.example.com',
-                'showlinks' => true
-
-            ],[
-                'trust' => false,
-                'ip' => '192.0.2.1',
-                'routable' => true,
-                'rdns' => 'client.users.example.org',
-                'location' => [
-                    'cityName' => 'San Francisco',
-                    'regionName' => 'California',
-                    'countryName' => 'United States'
-                ],
-                'showlinks' => true
-            ]
-        ]);
-
-        $this->assign('demo4', [
-            [
-                'trust' => true,
-                'trustedlink' => true,
-                'ip' => '172.16.0.164',
-                'routable' => false,
-
-            ],[
-                'trust' => true,
-                'ip' => '198.51.100.123',
-                'routable' => true,
-                'rdns' => 'trustedproxy.example.com',
-            ],[
-                'trust' => false,
-                'ip' => '198.51.100.234',
-                'routable' => true,
-                'rdns' => 'sketchyproxy.example.com',
-                'showlinks' => true
-            ], [
-                'trust' => false,
-                'trustedlink' => true,
-                'ip' => '198.51.100.124',
-                'routable' => true,
-                'rdns' => 'trustedproxy2.example.com',
-                'showlinks' => true
-            ],[
-                'trust' => false,
-                'ip' => '192.0.2.1',
-                'routable' => true,
-                'rdns' => 'client.users.example.org',
-                'location' => [
-                    'cityName' => 'San Francisco',
-                    'regionName' => 'California',
-                    'countryName' => 'United States'
-                ],
-                'showlinks' => true
-            ]
-        ]);
-
-        $this->assign('demo1', [
-            [
-                'trust' => true,
-                'trustedlink' => true,
-                'ip' => '172.16.0.164',
-                'routable' => false,
-
-            ], [
-                'trust' => true,
-                'trustedlink' => true,
-                'ip' => '192.0.2.1',
-                'routable' => true,
-                'rdns' => 'client.users.example.org',
-                'location' => [
-                    'cityName' => 'San Francisco',
-                    'regionName' => 'California',
-                    'countryName' => 'United States'
-                ],
-                'showlinks' => true
-            ]
-        ]);
-    }
+	use RequestData;
+
+	/**
+	 * @inheritDoc
+	 */
+	protected function main()
+	{
+		$this->setTemplate('xffdemo.tpl');
+
+		// requestHasForwardedIp == false
+		// requestProxyData
+		// requestRealIp == proxy
+		// requestForwardedIp == xff header
+		// forwardedOrigin  == top of the chain, assuming xff is trusted
+
+
+		$this->assign('demo2', [
+			[
+				'trust' => true,
+				'trustedlink' => true,
+				'ip' => '172.16.0.164',
+				'routable' => false,
+
+			],[
+				'trust' => true,
+				'ip' => '198.51.100.123',
+				'routable' => true,
+				'rdns' => 'trustedproxy.example.com',
+
+			],[
+				'trust' => true,
+				'ip' => '192.0.2.1',
+				'routable' => true,
+				'rdns' => 'client.users.example.org',
+				'location' => [
+					'cityName' => 'San Francisco',
+					'regionName' => 'California',
+					'countryName' => 'United States'
+				],
+				'showlinks' => true
+			]
+		]);
+
+		$this->assign('demo3', [
+			[
+				'trust' => true,
+				'trustedlink' => true,
+				'ip' => '172.16.0.164',
+				'routable' => false,
+
+			],[
+				'trust' => false,
+				'ip' => '198.51.100.234',
+				'routable' => true,
+				'rdns' => 'sketchyproxy.example.com',
+				'showlinks' => true
+
+			],[
+				'trust' => false,
+				'ip' => '192.0.2.1',
+				'routable' => true,
+				'rdns' => 'client.users.example.org',
+				'location' => [
+					'cityName' => 'San Francisco',
+					'regionName' => 'California',
+					'countryName' => 'United States'
+				],
+				'showlinks' => true
+			]
+		]);
+
+		$this->assign('demo4', [
+			[
+				'trust' => true,
+				'trustedlink' => true,
+				'ip' => '172.16.0.164',
+				'routable' => false,
+
+			],[
+				'trust' => true,
+				'ip' => '198.51.100.123',
+				'routable' => true,
+				'rdns' => 'trustedproxy.example.com',
+			],[
+				'trust' => false,
+				'ip' => '198.51.100.234',
+				'routable' => true,
+				'rdns' => 'sketchyproxy.example.com',
+				'showlinks' => true
+			], [
+				'trust' => false,
+				'trustedlink' => true,
+				'ip' => '198.51.100.124',
+				'routable' => true,
+				'rdns' => 'trustedproxy2.example.com',
+				'showlinks' => true
+			],[
+				'trust' => false,
+				'ip' => '192.0.2.1',
+				'routable' => true,
+				'rdns' => 'client.users.example.org',
+				'location' => [
+					'cityName' => 'San Francisco',
+					'regionName' => 'California',
+					'countryName' => 'United States'
+				],
+				'showlinks' => true
+			]
+		]);
+
+		$this->assign('demo1', [
+			[
+				'trust' => true,
+				'trustedlink' => true,
+				'ip' => '172.16.0.164',
+				'routable' => false,
+
+			], [
+				'trust' => true,
+				'trustedlink' => true,
+				'ip' => '192.0.2.1',
+				'routable' => true,
+				'rdns' => 'client.users.example.org',
+				'location' => [
+					'cityName' => 'San Francisco',
+					'regionName' => 'California',
+					'countryName' => 'United States'
+				],
+				'showlinks' => true
+			]
+		]);
+	}
 }

Spacing +7 added lines, -7 removed lines

@@ -36,13 +36,13 @@ 
                 'ip' => '172.16.0.164',
                 'routable' => false,
 
-            ],[
+            ], [
                 'trust' => true,
                 'ip' => '198.51.100.123',
                 'routable' => true,
                 'rdns' => 'trustedproxy.example.com',
 
-            ],[
+            ], [
                 'trust' => true,
                 'ip' => '192.0.2.1',
                 'routable' => true,
@@ -63,14 +63,14 @@ 
                 'ip' => '172.16.0.164',
                 'routable' => false,
 
-            ],[
+            ], [
                 'trust' => false,
                 'ip' => '198.51.100.234',
                 'routable' => true,
                 'rdns' => 'sketchyproxy.example.com',
                 'showlinks' => true
 
-            ],[
+            ], [
                 'trust' => false,
                 'ip' => '192.0.2.1',
                 'routable' => true,
@@ -91,12 +91,12 @@ 
                 'ip' => '172.16.0.164',
                 'routable' => false,
 
-            ],[
+            ], [
                 'trust' => true,
                 'ip' => '198.51.100.123',
                 'routable' => true,
                 'rdns' => 'trustedproxy.example.com',
-            ],[
+            ], [
                 'trust' => false,
                 'ip' => '198.51.100.234',
                 'routable' => true,
@@ -109,7 +109,7 @@ 
                 'routable' => true,
                 'rdns' => 'trustedproxy2.example.com',
                 'showlinks' => true
-            ],[
+            ], [
                 'trust' => false,
                 'ip' => '192.0.2.1',
                 'routable' => true,

includes/Pages/UserAuth/PageForgotPassword.php

Spacing +1 added lines, -1 removed lines

@@ -152,7 +152,7 @@
     {
         $user = User::getById($id, $database);
 
-        if ($user === false ||  $user->isCommunityUser()) {
+        if ($user === false || $user->isCommunityUser()) {
             throw new ApplicationLogicException("Password reset failed. Please try again.");
         }
 

Indentation +204 added lines, -204 removed lines

@@ -22,208 +22,208 @@
 
 class PageForgotPassword extends InternalPageBase
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     *
-     * This is the forgotten password reset form
-     * @category Security-Critical
-     */
-    protected function main()
-    {
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $username = WebRequest::postString('username');
-            $email = WebRequest::postEmail('email');
-            $database = $this->getDatabase();
-
-            if ($username === null || trim($username) === "" || $email === null || trim($email) === "") {
-                throw new ApplicationLogicException("Both username and email address must be specified!");
-            }
-
-            $user = User::getByUsername($username, $database);
-            $this->sendResetMail($user, $email);
-
-            SessionAlert::success('<strong>Your password reset request has been completed.</strong> If the details you have provided match our records, you should receive an email shortly.');
-
-            $this->redirect('login');
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('forgot-password/forgotpw.tpl');
-        }
-    }
-
-    /**
-     * Sends a reset email if the user is authenticated
-     *
-     * @param User|boolean $user  The user located from the database, or false. Doesn't really matter, since we do the
-     *                            check anyway within this method and silently skip if we don't have a user.
-     * @param string       $email The provided email address
-     */
-    private function sendResetMail($user, $email)
-    {
-        // If the user isn't found, or the email address is wrong, skip sending the details silently.
-        if (!$user instanceof User) {
-            return;
-        }
-
-        if (strtolower($user->getEmail()) === strtolower($email)) {
-            $clientIp = $this->getXffTrustProvider()
-                ->getTrustedClientIp(WebRequest::remoteAddress(), WebRequest::forwardedAddress());
-
-            $this->cleanExistingTokens($user);
-
-            $hash = Base32::encodeUpper(openssl_random_pseudo_bytes(30));
-
-            $encryptionHelper = new EncryptionHelper($this->getSiteConfiguration());
-
-            $cred = new Credential();
-            $cred->setDatabase($this->getDatabase());
-            $cred->setFactor(-1);
-            $cred->setUserId($user->getId());
-            $cred->setType('reset');
-            $cred->setData($encryptionHelper->encryptData($hash));
-            $cred->setVersion(0);
-            $cred->setDisabled(0);
-            $cred->setTimeout(new DateTimeImmutable('+ 1 hour'));
-            $cred->setPriority(9);
-            $cred->save();
-
-            $this->assign("user", $user);
-            $this->assign("hash", $hash);
-            $this->assign("remoteAddress", $clientIp);
-
-            $emailContent = $this->fetchTemplate('forgot-password/reset-mail.tpl');
-
-            $this->getEmailHelper()->sendMail($user->getEmail(), "WP:ACC password reset", $emailContent);
-        }
-    }
-
-    /**
-     * Entry point for the reset action
-     *
-     * This is the reset password part of the form.
-     * @category Security-Critical
-     */
-    protected function reset()
-    {
-        $si = WebRequest::getString('si');
-        $id = WebRequest::getString('id');
-
-        if ($si === null || trim($si) === "" || $id === null || trim($id) === "") {
-            throw new ApplicationLogicException("Link not valid, please ensure it has copied correctly");
-        }
-
-        $database = $this->getDatabase();
-        $user = $this->getResettingUser($id, $database, $si);
-
-        // Dual mode
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            try {
-                $this->doReset($user);
-                $this->cleanExistingTokens($user);
-            }
-            catch (ApplicationLogicException $ex) {
-                SessionAlert::error($ex->getMessage());
-                $this->redirect('forgotPassword', 'reset', array('si' => $si, 'id' => $id));
-
-                return;
-            }
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->assign('user', $user);
-            $this->setTemplate('forgot-password/forgotpwreset.tpl');
-        }
-    }
-
-    /**
-     * Gets the user resetting their password from the database, or throwing an exception if that is not possible.
-     *
-     * @param integer     $id       The ID of the user to retrieve
-     * @param PdoDatabase $database The database object to use
-     * @param string      $si       The reset hash provided
-     *
-     * @return User
-     * @throws ApplicationLogicException
-     */
-    private function getResettingUser($id, $database, $si)
-    {
-        $user = User::getById($id, $database);
-
-        if ($user === false ||  $user->isCommunityUser()) {
-            throw new ApplicationLogicException("Password reset failed. Please try again.");
-        }
-
-        $statement = $database->prepare("SELECT * FROM credential WHERE type = 'reset' AND user = :user;");
-        $statement->execute([':user' => $user->getId()]);
-
-        /** @var Credential $credential */
-        $credential = $statement->fetchObject(Credential::class);
-
-        $statement->closeCursor();
-
-        if ($credential === false) {
-            throw new ApplicationLogicException("Password reset failed. Please try again.");
-        }
-
-        $credential->setDatabase($database);
-
-        $encryptionHelper = new EncryptionHelper($this->getSiteConfiguration());
-        if ($encryptionHelper->decryptData($credential->getData()) != $si) {
-            throw new ApplicationLogicException("Password reset failed. Please try again.");
-        }
-
-        if ($credential->getTimeout() < new DateTimeImmutable()) {
-            $credential->delete();
-            throw new ApplicationLogicException("Password reset token expired. Please try again.");
-        }
-
-        return $user;
-    }
-
-    /**
-     * Performs the setting of the new password
-     *
-     * @param User $user The user to set the password for
-     *
-     * @throws ApplicationLogicException
-     */
-    private function doReset(User $user)
-    {
-        $pw = WebRequest::postString('pw');
-        $pw2 = WebRequest::postString('pw2');
-
-        if ($pw !== $pw2) {
-            throw new ApplicationLogicException('Passwords do not match!');
-        }
-
-        $passwordCredentialProvider = new PasswordCredentialProvider($user->getDatabase(), $this->getSiteConfiguration());
-        $passwordCredentialProvider->setCredential($user, 1, $pw);
-
-        SessionAlert::success('You may now log in!');
-        $this->redirect('login');
-    }
-
-    protected function isProtectedPage()
-    {
-        return false;
-    }
-
-    /**
-     * @param $user
-     */
-    private function cleanExistingTokens($user): void
-    {
-        // clean out existing reset tokens
-        $statement = $this->getDatabase()->prepare("SELECT * FROM credential WHERE type = 'reset' AND user = :user;");
-        $statement->execute([':user' => $user->getId()]);
-        $existing = $statement->fetchAll(PdoDatabase::FETCH_CLASS, Credential::class);
-
-        foreach ($existing as $c) {
-            $c->setDatabase($this->getDatabase());
-            $c->delete();
-        }
-    }
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 *
+	 * This is the forgotten password reset form
+	 * @category Security-Critical
+	 */
+	protected function main()
+	{
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$username = WebRequest::postString('username');
+			$email = WebRequest::postEmail('email');
+			$database = $this->getDatabase();
+
+			if ($username === null || trim($username) === "" || $email === null || trim($email) === "") {
+				throw new ApplicationLogicException("Both username and email address must be specified!");
+			}
+
+			$user = User::getByUsername($username, $database);
+			$this->sendResetMail($user, $email);
+
+			SessionAlert::success('<strong>Your password reset request has been completed.</strong> If the details you have provided match our records, you should receive an email shortly.');
+
+			$this->redirect('login');
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('forgot-password/forgotpw.tpl');
+		}
+	}
+
+	/**
+	 * Sends a reset email if the user is authenticated
+	 *
+	 * @param User|boolean $user  The user located from the database, or false. Doesn't really matter, since we do the
+	 *                            check anyway within this method and silently skip if we don't have a user.
+	 * @param string       $email The provided email address
+	 */
+	private function sendResetMail($user, $email)
+	{
+		// If the user isn't found, or the email address is wrong, skip sending the details silently.
+		if (!$user instanceof User) {
+			return;
+		}
+
+		if (strtolower($user->getEmail()) === strtolower($email)) {
+			$clientIp = $this->getXffTrustProvider()
+				->getTrustedClientIp(WebRequest::remoteAddress(), WebRequest::forwardedAddress());
+
+			$this->cleanExistingTokens($user);
+
+			$hash = Base32::encodeUpper(openssl_random_pseudo_bytes(30));
+
+			$encryptionHelper = new EncryptionHelper($this->getSiteConfiguration());
+
+			$cred = new Credential();
+			$cred->setDatabase($this->getDatabase());
+			$cred->setFactor(-1);
+			$cred->setUserId($user->getId());
+			$cred->setType('reset');
+			$cred->setData($encryptionHelper->encryptData($hash));
+			$cred->setVersion(0);
+			$cred->setDisabled(0);
+			$cred->setTimeout(new DateTimeImmutable('+ 1 hour'));
+			$cred->setPriority(9);
+			$cred->save();
+
+			$this->assign("user", $user);
+			$this->assign("hash", $hash);
+			$this->assign("remoteAddress", $clientIp);
+
+			$emailContent = $this->fetchTemplate('forgot-password/reset-mail.tpl');
+
+			$this->getEmailHelper()->sendMail($user->getEmail(), "WP:ACC password reset", $emailContent);
+		}
+	}
+
+	/**
+	 * Entry point for the reset action
+	 *
+	 * This is the reset password part of the form.
+	 * @category Security-Critical
+	 */
+	protected function reset()
+	{
+		$si = WebRequest::getString('si');
+		$id = WebRequest::getString('id');
+
+		if ($si === null || trim($si) === "" || $id === null || trim($id) === "") {
+			throw new ApplicationLogicException("Link not valid, please ensure it has copied correctly");
+		}
+
+		$database = $this->getDatabase();
+		$user = $this->getResettingUser($id, $database, $si);
+
+		// Dual mode
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			try {
+				$this->doReset($user);
+				$this->cleanExistingTokens($user);
+			}
+			catch (ApplicationLogicException $ex) {
+				SessionAlert::error($ex->getMessage());
+				$this->redirect('forgotPassword', 'reset', array('si' => $si, 'id' => $id));
+
+				return;
+			}
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->assign('user', $user);
+			$this->setTemplate('forgot-password/forgotpwreset.tpl');
+		}
+	}
+
+	/**
+	 * Gets the user resetting their password from the database, or throwing an exception if that is not possible.
+	 *
+	 * @param integer     $id       The ID of the user to retrieve
+	 * @param PdoDatabase $database The database object to use
+	 * @param string      $si       The reset hash provided
+	 *
+	 * @return User
+	 * @throws ApplicationLogicException
+	 */
+	private function getResettingUser($id, $database, $si)
+	{
+		$user = User::getById($id, $database);
+
+		if ($user === false ||  $user->isCommunityUser()) {
+			throw new ApplicationLogicException("Password reset failed. Please try again.");
+		}
+
+		$statement = $database->prepare("SELECT * FROM credential WHERE type = 'reset' AND user = :user;");
+		$statement->execute([':user' => $user->getId()]);
+
+		/** @var Credential $credential */
+		$credential = $statement->fetchObject(Credential::class);
+
+		$statement->closeCursor();
+
+		if ($credential === false) {
+			throw new ApplicationLogicException("Password reset failed. Please try again.");
+		}
+
+		$credential->setDatabase($database);
+
+		$encryptionHelper = new EncryptionHelper($this->getSiteConfiguration());
+		if ($encryptionHelper->decryptData($credential->getData()) != $si) {
+			throw new ApplicationLogicException("Password reset failed. Please try again.");
+		}
+
+		if ($credential->getTimeout() < new DateTimeImmutable()) {
+			$credential->delete();
+			throw new ApplicationLogicException("Password reset token expired. Please try again.");
+		}
+
+		return $user;
+	}
+
+	/**
+	 * Performs the setting of the new password
+	 *
+	 * @param User $user The user to set the password for
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	private function doReset(User $user)
+	{
+		$pw = WebRequest::postString('pw');
+		$pw2 = WebRequest::postString('pw2');
+
+		if ($pw !== $pw2) {
+			throw new ApplicationLogicException('Passwords do not match!');
+		}
+
+		$passwordCredentialProvider = new PasswordCredentialProvider($user->getDatabase(), $this->getSiteConfiguration());
+		$passwordCredentialProvider->setCredential($user, 1, $pw);
+
+		SessionAlert::success('You may now log in!');
+		$this->redirect('login');
+	}
+
+	protected function isProtectedPage()
+	{
+		return false;
+	}
+
+	/**
+	 * @param $user
+	 */
+	private function cleanExistingTokens($user): void
+	{
+		// clean out existing reset tokens
+		$statement = $this->getDatabase()->prepare("SELECT * FROM credential WHERE type = 'reset' AND user = :user;");
+		$statement->execute([':user' => $user->getId()]);
+		$existing = $statement->fetchAll(PdoDatabase::FETCH_CLASS, Credential::class);
+
+		foreach ($existing as $c) {
+			$c->setDatabase($this->getDatabase());
+			$c->delete();
+		}
+	}
 }

includes/Pages/PageLog.php

Indentation +58 added lines, -58 removed lines

@@ -18,62 +18,62 @@
 
 class PageLog extends PagedInternalPageBase
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     */
-    protected function main()
-    {
-        $this->setHtmlTitle('Logs');
-
-        $filterUser = WebRequest::getString('filterUser');
-        $filterAction = WebRequest::getString('filterAction');
-        $filterObjectType = WebRequest::getString('filterObjectType');
-        $filterObjectId = WebRequest::getInt('filterObjectId');
-
-        $database = $this->getDatabase();
-
-        if (!array_key_exists($filterObjectType, LogHelper::getObjectTypes())) {
-            $filterObjectType = null;
-        }
-
-        $this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
-
-        $logSearch = LogSearchHelper::get($database);
-
-        if ($filterUser !== null) {
-            $userObj = User::getByUsername($filterUser, $database);
-            if ($userObj !== false) {
-                $logSearch->byUser($userObj->getId());
-            } else {
-                $logSearch->byUser(-1);
-            }
-        }
-        if ($filterAction !== null) {
-            $logSearch->byAction($filterAction);
-        }
-        if ($filterObjectType !== null) {
-            $logSearch->byObjectType($filterObjectType);
-        }
-        if ($filterObjectId !== null) {
-            $logSearch->byObjectId($filterObjectId);
-        }
-
-        $this->setSearchHelper($logSearch);
-        $this->setupLimits();
-
-        /** @var Log[] $logs */
-        $logs = $logSearch->getRecordCount($count)->fetch();
-
-        list($users, $logData) = LogHelper::prepareLogsForTemplate($logs, $database, $this->getSiteConfiguration());
-
-        $this->setupPageData($count, array('filterUser' => $filterUser, 'filterAction' => $filterAction, 'filterObjectType' => $filterObjectType, 'filterObjectId' => $filterObjectId));
-
-        $this->assign("logs", $logData);
-        $this->assign("users", $users);
-
-        $this->assign('allLogActions', LogHelper::getLogActions($this->getDatabase()));
-        $this->assign('allObjectTypes', LogHelper::getObjectTypes());
-
-        $this->setTemplate("logs/main.tpl");
-    }
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 */
+	protected function main()
+	{
+		$this->setHtmlTitle('Logs');
+
+		$filterUser = WebRequest::getString('filterUser');
+		$filterAction = WebRequest::getString('filterAction');
+		$filterObjectType = WebRequest::getString('filterObjectType');
+		$filterObjectId = WebRequest::getInt('filterObjectId');
+
+		$database = $this->getDatabase();
+
+		if (!array_key_exists($filterObjectType, LogHelper::getObjectTypes())) {
+			$filterObjectType = null;
+		}
+
+		$this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
+
+		$logSearch = LogSearchHelper::get($database);
+
+		if ($filterUser !== null) {
+			$userObj = User::getByUsername($filterUser, $database);
+			if ($userObj !== false) {
+				$logSearch->byUser($userObj->getId());
+			} else {
+				$logSearch->byUser(-1);
+			}
+		}
+		if ($filterAction !== null) {
+			$logSearch->byAction($filterAction);
+		}
+		if ($filterObjectType !== null) {
+			$logSearch->byObjectType($filterObjectType);
+		}
+		if ($filterObjectId !== null) {
+			$logSearch->byObjectId($filterObjectId);
+		}
+
+		$this->setSearchHelper($logSearch);
+		$this->setupLimits();
+
+		/** @var Log[] $logs */
+		$logs = $logSearch->getRecordCount($count)->fetch();
+
+		list($users, $logData) = LogHelper::prepareLogsForTemplate($logs, $database, $this->getSiteConfiguration());
+
+		$this->setupPageData($count, array('filterUser' => $filterUser, 'filterAction' => $filterAction, 'filterObjectType' => $filterObjectType, 'filterObjectId' => $filterObjectId));
+
+		$this->assign("logs", $logData);
+		$this->assign("users", $users);
+
+		$this->assign('allLogActions', LogHelper::getLogActions($this->getDatabase()));
+		$this->assign('allObjectTypes', LogHelper::getObjectTypes());
+
+		$this->setTemplate("logs/main.tpl");
+	}
 }

Braces +2 added lines, -1 removed lines

@@ -44,7 +44,8 @@
             $userObj = User::getByUsername($filterUser, $database);
             if ($userObj !== false) {
                 $logSearch->byUser($userObj->getId());
-            } else {
+            }
+            else {
                 $logSearch->byUser(-1);
             }
         }

includes/Tasks/JsonApiPageBase.php

Indentation +53 added lines, -53 removed lines

@@ -14,68 +14,68 @@
 
 abstract class JsonApiPageBase extends ApiPageBase implements IJsonApiAction
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     *
-     * @return void
-     * @throws ApiException
-     */
-    final protected function main()
-    {
-        if (headers_sent()) {
-            throw new ApiException('Headers have already been sent - this indicates a bug in the application!');
-        }
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 *
+	 * @return void
+	 * @throws ApiException
+	 */
+	final protected function main()
+	{
+		if (headers_sent()) {
+			throw new ApiException('Headers have already been sent - this indicates a bug in the application!');
+		}
 
-        // javascript access control
-        $httpOrigin = WebRequest::origin();
+		// javascript access control
+		$httpOrigin = WebRequest::origin();
 
-        if ($httpOrigin !== null) {
-            $CORSallowed = $this->getSiteConfiguration()->getCrossOriginResourceSharingHosts();
+		if ($httpOrigin !== null) {
+			$CORSallowed = $this->getSiteConfiguration()->getCrossOriginResourceSharingHosts();
 
-            if (in_array($httpOrigin, $CORSallowed)) {
-                header("Access-Control-Allow-Origin: " . $httpOrigin);
-            }
-        }
+			if (in_array($httpOrigin, $CORSallowed)) {
+				header("Access-Control-Allow-Origin: " . $httpOrigin);
+			}
+		}
 
-        $responseData = $this->runApiPage();
+		$responseData = $this->runApiPage();
 
-        ob_end_clean();
-        print($responseData);
-        ob_start();
-    }
+		ob_end_clean();
+		print($responseData);
+		ob_start();
+	}
 
-    /**
-     * Method that runs API action
-     *
-     * @return object|array The modified API document
-     */
-    public abstract function executeApiAction();
+	/**
+	 * Method that runs API action
+	 *
+	 * @return object|array The modified API document
+	 */
+	public abstract function executeApiAction();
 
-    /**
-     * @return string
-     */
-    final public function runApiPage()
-    {
+	/**
+	 * @return string
+	 */
+	final public function runApiPage()
+	{
 
-        try {
-            $apiDocument = $this->executeApiAction();
-        }
-        catch (ApiException $ex) {
-            $apiDocument = [
-                'error' => $ex->getMessage(),
-            ];
-        }
+		try {
+			$apiDocument = $this->executeApiAction();
+		}
+		catch (ApiException $ex) {
+			$apiDocument = [
+				'error' => $ex->getMessage(),
+			];
+		}
 
-        $data = json_encode($apiDocument, JSON_UNESCAPED_UNICODE);
+		$data = json_encode($apiDocument, JSON_UNESCAPED_UNICODE);
 
-        $targetVar = WebRequest::getString('targetVariable');
-        if ($targetVar !== null && preg_match('/^[a-z]+$/', $targetVar)) {
-            $data = $targetVar . ' = ' . $data . ';';
-            header("Content-Type: text/javascript");
-        } else {
-            header("Content-Type: application/json");
-        }
+		$targetVar = WebRequest::getString('targetVariable');
+		if ($targetVar !== null && preg_match('/^[a-z]+$/', $targetVar)) {
+			$data = $targetVar . ' = ' . $data . ';';
+			header("Content-Type: text/javascript");
+		} else {
+			header("Content-Type: application/json");
+		}
 
-        return $data;
-    }
+		return $data;
+	}
 }

Spacing +2 added lines, -2 removed lines

@@ -33,7 +33,7 @@ 
             $CORSallowed = $this->getSiteConfiguration()->getCrossOriginResourceSharingHosts();
 
             if (in_array($httpOrigin, $CORSallowed)) {
-                header("Access-Control-Allow-Origin: " . $httpOrigin);
+                header("Access-Control-Allow-Origin: ".$httpOrigin);
             }
         }
 
@@ -70,7 +70,7 @@ 
 
         $targetVar = WebRequest::getString('targetVariable');
         if ($targetVar !== null && preg_match('/^[a-z]+$/', $targetVar)) {
-            $data = $targetVar . ' = ' . $data . ';';
+            $data = $targetVar.' = '.$data.';';
             header("Content-Type: text/javascript");
         } else {
             header("Content-Type: application/json");

Braces +2 added lines, -1 removed lines

@@ -72,7 +72,8 @@
         if ($targetVar !== null && preg_match('/^[a-z]+$/', $targetVar)) {
             $data = $targetVar . ' = ' . $data . ';';
             header("Content-Type: text/javascript");
-        } else {
+        }
+        else {
             header("Content-Type: application/json");
         }
 

includes/Pages/UserAuth/Login/PageU2FLogin.php

Indentation +22 added lines, -22 removed lines

@@ -14,20 +14,20 @@ 
 
 class PageU2FLogin extends LoginCredentialPageBase
 {
-    protected function providerSpecificSetup()
-    {
-        $this->assign('showSignIn', false);
-        $this->setTemplate('login/u2f.tpl');
+	protected function providerSpecificSetup()
+	{
+		$this->assign('showSignIn', false);
+		$this->setTemplate('login/u2f.tpl');
 
-        if ($this->partialUser === null) {
-            throw new ApplicationLogicException("U2F cannot be first-stage authentication");
-        }
+		if ($this->partialUser === null) {
+			throw new ApplicationLogicException("U2F cannot be first-stage authentication");
+		}
 
-        $u2f = new U2FCredentialProvider($this->getDatabase(), $this->getSiteConfiguration());
-        $authData = json_encode($u2f->getAuthenticationData($this->partialUser));
+		$u2f = new U2FCredentialProvider($this->getDatabase(), $this->getSiteConfiguration());
+		$authData = json_encode($u2f->getAuthenticationData($this->partialUser));
 
-        $this->addJs('/vendor/yubico/u2flib-server/examples/assets/u2f-api.js');
-        $this->setTailScript($this->getCspManager()->getNonce(), <<<JS
+		$this->addJs('/vendor/yubico/u2flib-server/examples/assets/u2f-api.js');
+		$this->setTailScript($this->getCspManager()->getNonce(), <<<JS
 var request = {$authData};
 u2f.sign(request, function(data) {
     document.getElementById('authenticate').value=JSON.stringify(data);
@@ -35,19 +35,19 @@ 
     document.getElementById('loginForm').submit();
 });
 JS
-        );
+		);
 
-    }
+	}
 
-    protected function getProviderCredentials()
-    {
-        $authenticate = WebRequest::postString("authenticate");
-        $request = WebRequest::postString("request");
+	protected function getProviderCredentials()
+	{
+		$authenticate = WebRequest::postString("authenticate");
+		$request = WebRequest::postString("request");
 
-        if ($authenticate === null || $authenticate === "" || $request === null || $request === "") {
-              throw new ApplicationLogicException("No authentication specified");
-        }
+		if ($authenticate === null || $authenticate === "" || $request === null || $request === "") {
+			  throw new ApplicationLogicException("No authentication specified");
+		}
 
-        return array(json_decode($authenticate), json_decode($request), 'u2f');
-    }
+		return array(json_decode($authenticate), json_decode($request), 'u2f');
+	}
 }