enwikipedia-acc / waca

includes/Pages/RequestAction/PageCustomClose.php

<?php
/******************************************************************************
 * Wikipedia Account Creation Assistance tool                                 *
 * ACC Development Team. Please see team.json for a list of contributors.     *
 *                                                                            *
 * This is free and unencumbered software released into the public domain.    *
 * Please see LICENSE.md for the full licencing statement.                    *
 ******************************************************************************/

namespace Waca\Pages\RequestAction;

use Exception;
use Waca\Background\Task\BotCreationTask;
use Waca\Background\Task\UserCreationTask;
use Waca\DataObjects\EmailTemplate;
use Waca\DataObjects\JobQueue;
use Waca\DataObjects\Request;
use Waca\DataObjects\RequestQueue;
use Waca\DataObjects\User;
use Waca\Exceptions\AccessDeniedException;
use Waca\Exceptions\ApplicationLogicException;
use Waca\Exceptions\OptimisticLockFailedException;
use Waca\Fragments\RequestData;
use Waca\Helpers\Logger;
use Waca\Helpers\OAuthUserHelper;
use Waca\Helpers\PreferenceManager;
use Waca\PdoDatabase;
use Waca\RequestStatus;
use Waca\SessionAlert;
use Waca\WebRequest;

class PageCustomClose extends PageCloseRequest
{
    use RequestData;

    public const CREATE_OAUTH = 'created-oauth';
    public const CREATE_BOT = 'created-bot';

    protected function main()
    {
        $database = $this->getDatabase();

        $request = $this->getRequest($database);
        $currentUser = User::getCurrent($this->getDatabase());

        if ($request->getStatus() === RequestStatus::CLOSED) {
            throw new ApplicationLogicException('Request is already closed');
        }

        // Dual-mode page
        if (WebRequest::wasPosted()) {
            $this->validateCSRFToken();
            $success = $this->doCustomClose($currentUser, $request, $database);

            if ($success) {
                $this->redirect();
            }
        }
        else {
            $this->assignCSRFToken();
            $this->showCustomCloseForm($database, $request);
        }
    }

    /**
     * @param $database
     *
     * @return Request
     * @throws ApplicationLogicException
     */
    protected function getRequest(PdoDatabase $database)
    {
        $requestId = WebRequest::getInt('request');
        if ($requestId === null) {
            throw new ApplicationLogicException('Request ID not found');
        }

        /** @var Request $request */
        $request = Request::getById($requestId, $database);

        if ($request === false) {

The condition $request === false is always false.

            throw new ApplicationLogicException('Request not found');
        }

        return $request;
    }

    /**
     * @param PdoDatabase $database
     *
     * @return EmailTemplate|null
     */
    protected function getTemplate(PdoDatabase $database)
    {
        $templateId = WebRequest::getInt('template');
        if ($templateId === null) {
            return null;
        }

        /** @var EmailTemplate $template */
        $template = EmailTemplate::getById($templateId, $database);
        if ($template === false || !$template->getActive()) {
            return null;
        }

        return $template;
    }

    /**
     * @param $database
     * @param $request
     *
     * @throws Exception
     */
    protected function showCustomCloseForm(PdoDatabase $database, Request $request)
    {
        $this->setHtmlTitle("Custom close");

        $currentUser = User::getCurrent($database);
        $preferencesManager = PreferenceManager::getForCurrent($database);
        $config = $this->getSiteConfiguration();

        $allowedPrivateData = $this->isAllowedPrivateData($request, $currentUser);
        if (!$allowedPrivateData) {
            // we probably shouldn't be showing the user this form if they're not allowed to access private data...
            throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
        }

        $template = $this->getTemplate($database);

        // Preload data
        $this->assign('defaultAction', '');
        $this->assign('defaultQueue', null);
        $this->assign('preloadText', '');
        $this->assign('preloadTitle', '');

        if ($template !== null) {
            $this->assign('defaultAction', $template->getDefaultAction());
            $this->assign('defaultQueue', $template->getQueue());
            $this->assign('preloadText', $template->getText());
            $this->assign('preloadTitle', $template->getName());
        }

        // Static data
        $this->assign('requestQueues', $requestQueues = RequestQueue::getEnabledQueues($database));

        // request data
        $this->assign('requestId', $request->getIp());
        $this->assign('updateVersion', $request->getUpdateVersion());
        $this->setupBasicData($request, $config);
        $this->setupReservationDetails($request->getReserved(), $database, $currentUser);
        $this->setupPrivateData($request, $config);
        $this->setupRelatedRequests($request, $config, $database);

        // IP location
        $trustedIp = $this->getXffTrustProvider()->getTrustedClientIp($request->getIp(), $request->getForwardedIp());
        $this->assign('iplocation', $this->getLocationProvider()->getIpLocation($trustedIp));

        // Confirmations
        $this->assign('confirmEmailAlreadySent', $this->checkEmailAlreadySent($request));

        $this->assign('canSkipCcMailingList', $this->barrierTest('skipCcMailingList', $currentUser));

        $this->assign('allowWelcomeSkip', false);
        $this->assign('forceWelcomeSkip', false);

        $canOauthCreate = $this->barrierTest(PreferenceManager::CREATION_OAUTH, $currentUser, 'RequestCreation');
        $canBotCreate = $this->barrierTest(PreferenceManager::CREATION_BOT, $currentUser, 'RequestCreation');

        $oauth = new OAuthUserHelper($currentUser, $this->getDatabase(), $this->getOAuthProtocolHelper(), $config);

        $welcomeTemplate = $preferencesManager->getPreference(PreferenceManager::PREF_WELCOMETEMPLATE);
        if ($welcomeTemplate != 0) {

It seems like you are loosely comparing $welcomeTemplate of type mixed|null to 0; this is ambiguous as not only 0 == 0 is true, but null == 0 is true, too. Consider using a strict comparison ===.

            $this->assign('allowWelcomeSkip', true);

            if (!$oauth->canWelcome()) {
                $this->assign('forceWelcomeSkip', true);
            }
        }

        $this->assign('preferredCreationMode', (int)$preferencesManager->getPreference(PreferenceManager::PREF_CREATION_MODE));

        // disable options if there's a misconfiguration.
        $canOauthCreate &= $oauth->canCreateAccount();
        $canBotCreate &= $this->getSiteConfiguration()->getCreationBotPassword() !== null;

        $this->assign('canOauthCreate', $canOauthCreate);
        $this->assign('canBotCreate', $canBotCreate);

        // template
        $this->setTemplate('custom-close.tpl');
    }

    /**
     * @param User        $currentUser
     * @param Request     $request
     * @param PdoDatabase $database
     *
     * @throws ApplicationLogicException
     */
    protected function doCustomClose(User $currentUser, Request $request, PdoDatabase $database) : bool
    {
        $messageBody = WebRequest::postString('msgbody');
        if ($messageBody === null || trim($messageBody) === '') {
            throw new ApplicationLogicException('Message body cannot be blank');
        }

        $ccMailingList = true;
        if ($this->barrierTest('skipCcMailingList', $currentUser)) {
            $ccMailingList = WebRequest::postBoolean('ccMailingList');
        }

        if ($request->getStatus() === RequestStatus::CLOSED) {
            throw new ApplicationLogicException('Request is already closed');
        }

        if (!(WebRequest::postBoolean('confirmEmailAlreadySent'))
        ) {
            throw new ApplicationLogicException('Not all confirmations checked');
        }

        $action = WebRequest::postString('action');

        if ($action === EmailTemplate::ACTION_CREATED || $action === EmailTemplate::ACTION_NOT_CREATED) {

            if ($action === EmailTemplate::ACTION_CREATED) {
                if ($this->checkAccountCreated($request)) {
                    $this->assignCSRFToken();
                    $this->showCustomCloseForm($database, $request);

                    $this->assign("preloadText", $messageBody);
                    $this->assign('preloadAction', $action);
                    $this->assign('ccMailingList', $ccMailingList);
                    $this->assign('showNonExistentAccountWarning', true);
                    $this->assign('skipAutoWelcome', WebRequest::postBoolean('skipAutoWelcome'));

                    return false;
                }
            }

            // Close request
            $this->closeRequest($request, $database, $action, $messageBody);

            $this->processWelcome($action, null);

            // Send the mail after the save, since save can be rolled back
            $this->sendMail($request, $messageBody, $currentUser, $ccMailingList);

            return true;
        }

        if ($action === self::CREATE_OAUTH || $action === self::CREATE_BOT) {
            $this->processAutoCreation($currentUser, $action, $request, $messageBody, $ccMailingList);

            return true;
        }

        if ($action === 'mail') {
            $request->setReserved(null);
            $request->setUpdateVersion(WebRequest::postInt('updateversion'));
            $request->save();

            // Perform the notifications and stuff *after* we've successfully saved, since the save can throw an OLE
            // and be rolled back.

            // Send mail
            $this->sendMail($request, $messageBody, $currentUser, $ccMailingList);

            Logger::sentMail($database, $request, $messageBody);
            Logger::unreserve($database, $request);

            $this->getNotificationHelper()->sentMail($request);
            SessionAlert::success("Sent mail to Request {$request->getId()}");

            return true;
        }

        $targetQueue = RequestQueue::getByApiName($database, $action, 1);

It seems like $action can also be of type null; however, parameter $apiName of Waca\DataObjects\RequestQueue::getByApiName() does only seem to accept string, maybe add an additional type check?

        if ($targetQueue !== false) {
            // Defer to other state
            $this->deferRequest($request, $database, $targetQueue, $messageBody);

            // Send the mail after the save, since save can be rolled back
            $this->sendMail($request, $messageBody, $currentUser, $ccMailingList);

            return true;
        }

        throw new ApplicationLogicException('Unknown action for custom close.');
    }

    /**
     * @param Request     $request
     * @param PdoDatabase $database
     * @param string      $action
     * @param string      $messageBody
     *
     * @throws Exception
     * @throws OptimisticLockFailedException
     */
    protected function closeRequest(Request $request, PdoDatabase $database, $action, $messageBody)
    {
        $request->setStatus(RequestStatus::CLOSED);
        $request->setQueue(null);
        $request->setReserved(null);
        $request->setUpdateVersion(WebRequest::postInt('updateversion'));
        $request->save();

        // Perform the notifications and stuff *after* we've successfully saved, since the save can throw an OLE and
        // be rolled back.

        if ($action == EmailTemplate::ACTION_CREATED) {
            $logCloseType = 'custom-y';
            $notificationCloseType = "Custom, Created";
        }
        else {
            $logCloseType = 'custom-n';
            $notificationCloseType = "Custom, Not Created";
        }

        Logger::closeRequest($database, $request, $logCloseType, $messageBody);

$logCloseType of type string is incompatible with the type integer expected by parameter $target of Waca\Helpers\Logger::closeRequest().

        $this->getNotificationHelper()->requestClosed($request, $notificationCloseType);

        $requestName = htmlentities($request->getName(), ENT_COMPAT, 'UTF-8');
        SessionAlert::success("Request {$request->getId()} ({$requestName}) closed as {$notificationCloseType}.");
    }

    /**
     * @param Request      $request
     * @param PdoDatabase  $database
     * @param RequestQueue $targetQueue
     * @param string       $messageBody
     *
     * @throws OptimisticLockFailedException
     */
    protected function deferRequest(
        Request $request,
        PdoDatabase $database,
        RequestQueue $targetQueue,
        $messageBody
    ) {
        $request->setStatus(RequestStatus::OPEN);
        $request->setQueue($targetQueue->getId());
        $request->setReserved(null);
        $request->setUpdateVersion(WebRequest::postInt('updateversion'));
        $request->save();

        // Perform the notifications and stuff *after* we've successfully saved, since the save can throw an OLE
        // and be rolled back.

        $deferToLog = $targetQueue->getLogName();

The function Waca\DataObjects\RequestQueue::getLogName() has been deprecated.

        Logger::sentMail($database, $request, $messageBody);
        Logger::deferRequest($database, $request, $deferToLog);

        $this->getNotificationHelper()->requestDeferredWithMail($request);

        $deferTo = htmlentities($targetQueue->getDisplayName(), ENT_COMPAT, 'UTF-8');
        SessionAlert::success("Request {$request->getId()} deferred to $deferTo, sending an email.");
    }

    /**
     * @param User    $currentUser
     * @param string  $action
     * @param Request $request
     * @param string  $messageBody
     * @param bool    $ccMailingList
     *
     * @throws AccessDeniedException
     * @throws ApplicationLogicException
     * @throws OptimisticLockFailedException
     */
    protected function processAutoCreation(User $currentUser, string $action, Request $request, string $messageBody, bool $ccMailingList): void
    {
        $db = $this->getDatabase();
        $oauth = new OAuthUserHelper($currentUser, $db, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
        $canOauthCreate = $this->barrierTest(PreferenceManager::CREATION_OAUTH, $currentUser, 'RequestCreation');
        $canBotCreate = $this->barrierTest(PreferenceManager::CREATION_BOT, $currentUser, 'RequestCreation');
        $canOauthCreate &= $oauth->canCreateAccount();
        $canBotCreate &= $this->getSiteConfiguration()->getCreationBotPassword() !== null;

        $creationTaskClass = null;

        if ($action === self::CREATE_OAUTH) {
            if (!$canOauthCreate) {
                throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
            }

            $creationTaskClass = UserCreationTask::class;
        }

        if ($action === self::CREATE_BOT) {
            if (!$canBotCreate) {
                throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
            }

            $creationTaskClass = BotCreationTask::class;
        }

        if ($creationTaskClass === null) {
            throw new ApplicationLogicException('Cannot determine creation mode');
        }

        $request->setStatus(RequestStatus::JOBQUEUE);
        $request->setReserved(null);
        $request->save();

        $parameters = [
            'emailText' => $messageBody,
            'ccMailingList' => $ccMailingList
        ];

        $creationTask = new JobQueue();
        $creationTask->setDomain(1); // FIXME: domains!
        $creationTask->setTask($creationTaskClass);
        $creationTask->setRequest($request->getId());
        $creationTask->setTriggerUserId($currentUser->getId());
        $creationTask->setParameters(json_encode($parameters));
        $creationTask->setDatabase($db);
        $creationTask->save();

        $creationTaskId = $creationTask->getId();

        Logger::enqueuedJobQueue($db, $request);
        $this->getNotificationHelper()->requestCloseQueued($request, 'Custom, Created');

        SessionAlert::success("Request {$request->getId()} has been queued for autocreation");

        // forge this since it is actually a creation.
        $this->processWelcome(EmailTemplate::ACTION_CREATED, $creationTaskId);
    }
}