mdaniels5757 / waca

includes/DataObjects/Request.php

Indentation +326 added lines, -326 removed lines

@@ -21,30 +21,30 @@ 
  */
 class Request extends DataObject
 {
-    private $email;
-    private $ip;
-    private $name;
-    /** @var string|null */
-    private $status = "Open";
-    private $date;
-    private $emailsent = 0;
-    private $emailconfirm;
-    /** @var int|null */
-    private $reserved = null;
-    private $useragent;
-    private $forwardedip;
-    private $hasComments = false;
-    private $hasCommentsResolved = false;
-
-    /**
-     * @throws Exception
-     * @throws OptimisticLockFailedException
-     */
-    public function save()
-    {
-        if ($this->isNew()) {
-            // insert
-            $statement = $this->dbObject->prepare(<<<SQL
+	private $email;
+	private $ip;
+	private $name;
+	/** @var string|null */
+	private $status = "Open";
+	private $date;
+	private $emailsent = 0;
+	private $emailconfirm;
+	/** @var int|null */
+	private $reserved = null;
+	private $useragent;
+	private $forwardedip;
+	private $hasComments = false;
+	private $hasCommentsResolved = false;
+
+	/**
+	 * @throws Exception
+	 * @throws OptimisticLockFailedException
+	 */
+	public function save()
+	{
+		if ($this->isNew()) {
+			// insert
+			$statement = $this->dbObject->prepare(<<<SQL
 INSERT INTO `request` (
 	email, ip, name, status, date, emailsent,
 	emailconfirm, reserved, useragent, forwardedip
@@ -53,27 +53,27 @@ 
 	:emailconfirm, :reserved, :useragent, :forwardedip
 );
 SQL
-            );
-            $statement->bindValue(':email', $this->email);
-            $statement->bindValue(':ip', $this->ip);
-            $statement->bindValue(':name', $this->name);
-            $statement->bindValue(':status', $this->status);
-            $statement->bindValue(':emailsent', $this->emailsent);
-            $statement->bindValue(':emailconfirm', $this->emailconfirm);
-            $statement->bindValue(':reserved', $this->reserved);
-            $statement->bindValue(':useragent', $this->useragent);
-            $statement->bindValue(':forwardedip', $this->forwardedip);
-
-            if ($statement->execute()) {
-                $this->id = (int)$this->dbObject->lastInsertId();
-            }
-            else {
-                throw new Exception($statement->errorInfo());
-            }
-        }
-        else {
-            // update
-            $statement = $this->dbObject->prepare(<<<SQL
+			);
+			$statement->bindValue(':email', $this->email);
+			$statement->bindValue(':ip', $this->ip);
+			$statement->bindValue(':name', $this->name);
+			$statement->bindValue(':status', $this->status);
+			$statement->bindValue(':emailsent', $this->emailsent);
+			$statement->bindValue(':emailconfirm', $this->emailconfirm);
+			$statement->bindValue(':reserved', $this->reserved);
+			$statement->bindValue(':useragent', $this->useragent);
+			$statement->bindValue(':forwardedip', $this->forwardedip);
+
+			if ($statement->execute()) {
+				$this->id = (int)$this->dbObject->lastInsertId();
+			}
+			else {
+				throw new Exception($statement->errorInfo());
+			}
+		}
+		else {
+			// update
+			$statement = $this->dbObject->prepare(<<<SQL
 UPDATE `request` SET
 	status = :status,
 	emailsent = :emailsent,
@@ -82,147 +82,147 @@ 
 	updateversion = updateversion + 1
 WHERE id = :id AND updateversion = :updateversion;
 SQL
-            );
-
-            $statement->bindValue(':id', $this->id);
-            $statement->bindValue(':updateversion', $this->updateversion);
-
-            $statement->bindValue(':status', $this->status);
-            $statement->bindValue(':emailsent', $this->emailsent);
-            $statement->bindValue(':emailconfirm', $this->emailconfirm);
-            $statement->bindValue(':reserved', $this->reserved);
-
-            if (!$statement->execute()) {
-                throw new Exception($statement->errorInfo());
-            }
-
-            if ($statement->rowCount() !== 1) {
-                throw new OptimisticLockFailedException();
-            }
-
-            $this->updateversion++;
-        }
-    }
-
-    /**
-     * @return string
-     */
-    public function getIp()
-    {
-        return $this->ip;
-    }
-
-    /**
-     * @param string $ip
-     */
-    public function setIp($ip)
-    {
-        $this->ip = $ip;
-    }
-
-    /**
-     * @return string
-     */
-    public function getName()
-    {
-        return $this->name;
-    }
-
-    /**
-     * @param string $name
-     */
-    public function setName($name)
-    {
-        $this->name = $name;
-    }
-
-    /**
-     * @return string
-     */
-    public function getStatus()
-    {
-        return $this->status;
-    }
-
-    /**
-     * @param string $status
-     */
-    public function setStatus($status)
-    {
-        $this->status = $status;
-    }
-
-    /**
-     * Returns the time the request was first submitted
-     *
-     * @return DateTimeImmutable
-     */
-    public function getDate()
-    {
-        return new DateTimeImmutable($this->date);
-    }
-
-    /**
-     * @return bool
-     */
-    public function getEmailSent()
-    {
-        return $this->emailsent == "1";
-    }
-
-    /**
-     * @param bool $emailSent
-     */
-    public function setEmailSent($emailSent)
-    {
-        $this->emailsent = $emailSent ? 1 : 0;
-    }
-
-    /**
-     * @return int|null
-     */
-    public function getReserved()
-    {
-        return $this->reserved;
-    }
-
-    /**
-     * @param int|null $reserved
-     */
-    public function setReserved($reserved)
-    {
-        $this->reserved = $reserved;
-    }
-
-    /**
-     * @return string
-     */
-    public function getUserAgent()
-    {
-        return $this->useragent;
-    }
-
-    /**
-     * @param string $useragent
-     */
-    public function setUserAgent($useragent)
-    {
-        $this->useragent = $useragent;
-    }
-
-    /**
-     * @return string|null
-     */
-    public function getForwardedIp()
-    {
-        return $this->forwardedip;
-    }
-
-    /**
-     * @param string|null $forwardedip
-     */
-    public function setForwardedIp($forwardedip)
-    {
+			);
+
+			$statement->bindValue(':id', $this->id);
+			$statement->bindValue(':updateversion', $this->updateversion);
+
+			$statement->bindValue(':status', $this->status);
+			$statement->bindValue(':emailsent', $this->emailsent);
+			$statement->bindValue(':emailconfirm', $this->emailconfirm);
+			$statement->bindValue(':reserved', $this->reserved);
+
+			if (!$statement->execute()) {
+				throw new Exception($statement->errorInfo());
+			}
+
+			if ($statement->rowCount() !== 1) {
+				throw new OptimisticLockFailedException();
+			}
+
+			$this->updateversion++;
+		}
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getIp()
+	{
+		return $this->ip;
+	}
+
+	/**
+	 * @param string $ip
+	 */
+	public function setIp($ip)
+	{
+		$this->ip = $ip;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getName()
+	{
+		return $this->name;
+	}
+
+	/**
+	 * @param string $name
+	 */
+	public function setName($name)
+	{
+		$this->name = $name;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getStatus()
+	{
+		return $this->status;
+	}
+
+	/**
+	 * @param string $status
+	 */
+	public function setStatus($status)
+	{
+		$this->status = $status;
+	}
+
+	/**
+	 * Returns the time the request was first submitted
+	 *
+	 * @return DateTimeImmutable
+	 */
+	public function getDate()
+	{
+		return new DateTimeImmutable($this->date);
+	}
+
+	/**
+	 * @return bool
+	 */
+	public function getEmailSent()
+	{
+		return $this->emailsent == "1";
+	}
+
+	/**
+	 * @param bool $emailSent
+	 */
+	public function setEmailSent($emailSent)
+	{
+		$this->emailsent = $emailSent ? 1 : 0;
+	}
+
+	/**
+	 * @return int|null
+	 */
+	public function getReserved()
+	{
+		return $this->reserved;
+	}
+
+	/**
+	 * @param int|null $reserved
+	 */
+	public function setReserved($reserved)
+	{
+		$this->reserved = $reserved;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getUserAgent()
+	{
+		return $this->useragent;
+	}
+
+	/**
+	 * @param string $useragent
+	 */
+	public function setUserAgent($useragent)
+	{
+		$this->useragent = $useragent;
+	}
+
+	/**
+	 * @return string|null
+	 */
+	public function getForwardedIp()
+	{
+		return $this->forwardedip;
+	}
+
+	/**
+	 * @param string|null $forwardedip
+	 */
+	public function setForwardedIp($forwardedip)
+	{
 		// Verify that the XFF chain only contains valid IP addresses, and silently discard anything that isn't.
 
 		$xff = explode(',', $forwardedip);
@@ -236,76 +236,76 @@ 
 		}
 
 		$this->forwardedip = implode(", ", $valid);
-    }
-
-    /**
-     * @return bool
-     */
-    public function hasComments()
-    {
-        if ($this->hasCommentsResolved) {
-            return $this->hasComments;
-        }
-
-        $commentsQuery = $this->dbObject->prepare("SELECT COUNT(*) AS num FROM comment WHERE request = :id;");
-        $commentsQuery->bindValue(":id", $this->id);
-
-        $commentsQuery->execute();
-
-        $this->hasComments = ($commentsQuery->fetchColumn() != 0);
-        $this->hasCommentsResolved = true;
-
-        return $this->hasComments;
-    }
-
-    /**
-     * @return string
-     */
-    public function getEmailConfirm()
-    {
-        return $this->emailconfirm;
-    }
-
-    /**
-     * @param string $emailconfirm
-     */
-    public function setEmailConfirm($emailconfirm)
-    {
-        $this->emailconfirm = $emailconfirm;
-    }
-
-    public function generateEmailConfirmationHash()
-    {
-        $this->emailconfirm = bin2hex(openssl_random_pseudo_bytes(16));
-    }
-
-    /**
-     * @return string|null
-     */
-    public function getEmail()
-    {
-        return $this->email;
-    }
-
-    /**
-     * @param string|null $email
-     */
-    public function setEmail($email)
-    {
-        $this->email = $email;
-    }
-
-    /**
-     * @return string
-     * @throws Exception
-     */
-    public function getClosureReason()
-    {
-        if ($this->status != 'Closed') {
-            throw new Exception("Can't get closure reason for open request.");
-        }
-
-        $statement = $this->dbObject->prepare(<<<SQL
+	}
+
+	/**
+	 * @return bool
+	 */
+	public function hasComments()
+	{
+		if ($this->hasCommentsResolved) {
+			return $this->hasComments;
+		}
+
+		$commentsQuery = $this->dbObject->prepare("SELECT COUNT(*) AS num FROM comment WHERE request = :id;");
+		$commentsQuery->bindValue(":id", $this->id);
+
+		$commentsQuery->execute();
+
+		$this->hasComments = ($commentsQuery->fetchColumn() != 0);
+		$this->hasCommentsResolved = true;
+
+		return $this->hasComments;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getEmailConfirm()
+	{
+		return $this->emailconfirm;
+	}
+
+	/**
+	 * @param string $emailconfirm
+	 */
+	public function setEmailConfirm($emailconfirm)
+	{
+		$this->emailconfirm = $emailconfirm;
+	}
+
+	public function generateEmailConfirmationHash()
+	{
+		$this->emailconfirm = bin2hex(openssl_random_pseudo_bytes(16));
+	}
+
+	/**
+	 * @return string|null
+	 */
+	public function getEmail()
+	{
+		return $this->email;
+	}
+
+	/**
+	 * @param string|null $email
+	 */
+	public function setEmail($email)
+	{
+		$this->email = $email;
+	}
+
+	/**
+	 * @return string
+	 * @throws Exception
+	 */
+	public function getClosureReason()
+	{
+		if ($this->status != 'Closed') {
+			throw new Exception("Can't get closure reason for open request.");
+		}
+
+		$statement = $this->dbObject->prepare(<<<SQL
 SELECT closes.mail_desc
 FROM log
 INNER JOIN closes ON log.action = closes.closes
@@ -315,25 +315,25 @@ 
 ORDER BY log.timestamp DESC
 LIMIT 1;
 SQL
-        );
-
-        $statement->bindValue(":requestId", $this->id);
-        $statement->execute();
-        $reason = $statement->fetchColumn();
-
-        return $reason;
-    }
-
-    /**
-     * Gets a value indicating whether the request was closed as created or not.
-     */
-    public function getWasCreated()
-    {
-        if ($this->status != 'Closed') {
-            throw new Exception("Can't get closure reason for open request.");
-        }
+		);
+
+		$statement->bindValue(":requestId", $this->id);
+		$statement->execute();
+		$reason = $statement->fetchColumn();
+
+		return $reason;
+	}
+
+	/**
+	 * Gets a value indicating whether the request was closed as created or not.
+	 */
+	public function getWasCreated()
+	{
+		if ($this->status != 'Closed') {
+			throw new Exception("Can't get closure reason for open request.");
+		}
 
-        $statement = $this->dbObject->prepare(<<<SQL
+		$statement = $this->dbObject->prepare(<<<SQL
 SELECT emailtemplate.oncreated, log.action
 FROM log
 LEFT JOIN emailtemplate ON CONCAT('Closed ', emailtemplate.id) = log.action
@@ -343,60 +343,60 @@ 
 ORDER BY log.timestamp DESC
 LIMIT 1;
 SQL
-        );
-
-        $statement->bindValue(":requestId", $this->id);
-        $statement->execute();
-        $onCreated = $statement->fetchColumn(0);
-        $logAction = $statement->fetchColumn(1);
-        $statement->closeCursor();
-
-        if ($onCreated === null) {
-            return $logAction === "Closed custom-y";
-        }
-
-        return (bool)$onCreated;
-    }
-
-    /**
-     * @return DateTime
-     */
-    public function getClosureDate()
-    {
-        $logQuery = $this->dbObject->prepare(<<<SQL
+		);
+
+		$statement->bindValue(":requestId", $this->id);
+		$statement->execute();
+		$onCreated = $statement->fetchColumn(0);
+		$logAction = $statement->fetchColumn(1);
+		$statement->closeCursor();
+
+		if ($onCreated === null) {
+			return $logAction === "Closed custom-y";
+		}
+
+		return (bool)$onCreated;
+	}
+
+	/**
+	 * @return DateTime
+	 */
+	public function getClosureDate()
+	{
+		$logQuery = $this->dbObject->prepare(<<<SQL
 SELECT timestamp FROM log
 WHERE objectid = :request AND objecttype = 'Request' AND action LIKE 'Closed%'
 ORDER BY timestamp DESC LIMIT 1;
 SQL
-        );
-        $logQuery->bindValue(":request", $this->getId());
-        $logQuery->execute();
-        $logTime = $logQuery->fetchColumn();
-        $logQuery->closeCursor();
-
-        return new DateTime($logTime);
-    }
-
-    /**
-     * Returns a hash based on data within this request which can be generated easily from the data to be used to reveal
-     * data to unauthorised* users.
-     *
-     * *:Not tool admins, check users, or the reserving user.
-     *
-     * @return string
-     *
-     * @todo future work to make invalidation better. Possibly move to the database and invalidate on relevant events?
-     *       Maybe depend on the last logged action timestamp?
-     */
-    public function getRevealHash()
-    {
-        $data = $this->id         // unique per request
-            . '|' . $this->ip           // }
-            . '|' . $this->forwardedip  // } private data not known to those without access
-            . '|' . $this->useragent    // }
-            . '|' . $this->email        // }
-            . '|' . $this->status;      // to rudimentarily invalidate the token on status change
-
-        return hash('sha256', $data);
-    }
+		);
+		$logQuery->bindValue(":request", $this->getId());
+		$logQuery->execute();
+		$logTime = $logQuery->fetchColumn();
+		$logQuery->closeCursor();
+
+		return new DateTime($logTime);
+	}
+
+	/**
+	 * Returns a hash based on data within this request which can be generated easily from the data to be used to reveal
+	 * data to unauthorised* users.
+	 *
+	 * *:Not tool admins, check users, or the reserving user.
+	 *
+	 * @return string
+	 *
+	 * @todo future work to make invalidation better. Possibly move to the database and invalidate on relevant events?
+	 *       Maybe depend on the last logged action timestamp?
+	 */
+	public function getRevealHash()
+	{
+		$data = $this->id         // unique per request
+			. '|' . $this->ip           // }
+			. '|' . $this->forwardedip  // } private data not known to those without access
+			. '|' . $this->useragent    // }
+			. '|' . $this->email        // }
+			. '|' . $this->status;      // to rudimentarily invalidate the token on status change
+
+		return hash('sha256', $data);
+	}
 }

includes/DataObjects/Comment.php

Indentation +157 added lines, -157 removed lines

@@ -20,171 +20,171 @@
  */
 class Comment extends DataObject
 {
-    private $time;
-    private $user;
-    private $comment;
-    private $visibility = "user";
-    private $request;
-
-    /**
-     * Retrieves all comments for a request, optionally filtered
-     *
-     * @param integer     $id      Request ID to search by
-     * @param PdoDatabase $database
-     * @param bool        $showAll True to show all comments, False to show only unprotected comments, and protected
-     *                             comments visible to $userId
-     * @param null|int    $userId  User to filter by
-     *
-     * @return Comment[]
-     */
-    public static function getForRequest($id, PdoDatabase $database, $showAll = false, $userId = null)
-    {
-        if ($showAll) {
-            $statement = $database->prepare('SELECT * FROM comment WHERE request = :target;');
-        }
-        else {
-            $statement = $database->prepare(<<<SQL
+	private $time;
+	private $user;
+	private $comment;
+	private $visibility = "user";
+	private $request;
+
+	/**
+	 * Retrieves all comments for a request, optionally filtered
+	 *
+	 * @param integer     $id      Request ID to search by
+	 * @param PdoDatabase $database
+	 * @param bool        $showAll True to show all comments, False to show only unprotected comments, and protected
+	 *                             comments visible to $userId
+	 * @param null|int    $userId  User to filter by
+	 *
+	 * @return Comment[]
+	 */
+	public static function getForRequest($id, PdoDatabase $database, $showAll = false, $userId = null)
+	{
+		if ($showAll) {
+			$statement = $database->prepare('SELECT * FROM comment WHERE request = :target;');
+		}
+		else {
+			$statement = $database->prepare(<<<SQL
 SELECT * FROM comment
 WHERE request = :target AND (visibility = 'user' OR visibility = 'requester' OR user = :userid);
 SQL
-            );
-            $statement->bindValue(':userid', $userId);
-        }
-
-        $statement->bindValue(':target', $id);
-
-        $statement->execute();
-
-        $result = array();
-        /** @var Comment $v */
-        foreach ($statement->fetchAll(PDO::FETCH_CLASS, get_called_class()) as $v) {
-            $v->setDatabase($database);
-            $result[] = $v;
-        }
-
-        return $result;
-    }
-
-    /**
-     * @throws Exception
-     */
-    public function save()
-    {
-        if ($this->isNew()) {
-            // insert
-            $statement = $this->dbObject->prepare(<<<SQL
+			);
+			$statement->bindValue(':userid', $userId);
+		}
+
+		$statement->bindValue(':target', $id);
+
+		$statement->execute();
+
+		$result = array();
+		/** @var Comment $v */
+		foreach ($statement->fetchAll(PDO::FETCH_CLASS, get_called_class()) as $v) {
+			$v->setDatabase($database);
+			$result[] = $v;
+		}
+
+		return $result;
+	}
+
+	/**
+	 * @throws Exception
+	 */
+	public function save()
+	{
+		if ($this->isNew()) {
+			// insert
+			$statement = $this->dbObject->prepare(<<<SQL
 INSERT INTO comment ( time, user, comment, visibility, request )
 VALUES ( CURRENT_TIMESTAMP(), :user, :comment, :visibility, :request );
 SQL
-            );
-            $statement->bindValue(":user", $this->user);
-            $statement->bindValue(":comment", $this->comment);
-            $statement->bindValue(":visibility", $this->visibility);
-            $statement->bindValue(":request", $this->request);
-
-            if ($statement->execute()) {
-                $this->id = (int)$this->dbObject->lastInsertId();
-            }
-            else {
-                throw new Exception($statement->errorInfo());
-            }
-        }
-        else {
-            // update
-            $statement = $this->dbObject->prepare(<<<SQL
+			);
+			$statement->bindValue(":user", $this->user);
+			$statement->bindValue(":comment", $this->comment);
+			$statement->bindValue(":visibility", $this->visibility);
+			$statement->bindValue(":request", $this->request);
+
+			if ($statement->execute()) {
+				$this->id = (int)$this->dbObject->lastInsertId();
+			}
+			else {
+				throw new Exception($statement->errorInfo());
+			}
+		}
+		else {
+			// update
+			$statement = $this->dbObject->prepare(<<<SQL
 UPDATE comment
 SET comment = :comment, visibility = :visibility, updateversion = updateversion + 1
 WHERE id = :id AND updateversion = :updateversion;
 SQL
-            );
-
-            $statement->bindValue(':id', $this->id);
-            $statement->bindValue(':updateversion', $this->updateversion);
-
-            $statement->bindValue(':comment', $this->comment);
-            $statement->bindValue(':visibility', $this->visibility);
-
-            if (!$statement->execute()) {
-                throw new Exception($statement->errorInfo());
-            }
-
-            if ($statement->rowCount() !== 1) {
-                throw new OptimisticLockFailedException();
-            }
-
-            $this->updateversion++;
-        }
-    }
-
-    /**
-     * @return DateTimeImmutable
-     */
-    public function getTime()
-    {
-        return new DateTimeImmutable($this->time);
-    }
-
-    /**
-     * @return int
-     */
-    public function getUser()
-    {
-        return $this->user;
-    }
-
-    /**
-     * @param int $user
-     */
-    public function setUser($user)
-    {
-        $this->user = $user;
-    }
-
-    /**
-     * @return string
-     */
-    public function getComment()
-    {
-        return $this->comment;
-    }
-
-    /**
-     * @param string $comment
-     */
-    public function setComment($comment)
-    {
-        $this->comment = $comment;
-    }
-
-    /**
-     * @return string
-     */
-    public function getVisibility()
-    {
-        return $this->visibility;
-    }
-
-    /**
-     * @param string $visibility
-     */
-    public function setVisibility($visibility)
-    {
-        $this->visibility = $visibility;
-    }
-
-    /**
-     * @return int
-     */
-    public function getRequest()
-    {
-        return $this->request;
-    }
-
-    /**
-     * @param int $request
-     */
-    public function setRequest($request)
-    {
-        $this->request = $request;
-    }
+			);
+
+			$statement->bindValue(':id', $this->id);
+			$statement->bindValue(':updateversion', $this->updateversion);
+
+			$statement->bindValue(':comment', $this->comment);
+			$statement->bindValue(':visibility', $this->visibility);
+
+			if (!$statement->execute()) {
+				throw new Exception($statement->errorInfo());
+			}
+
+			if ($statement->rowCount() !== 1) {
+				throw new OptimisticLockFailedException();
+			}
+
+			$this->updateversion++;
+		}
+	}
+
+	/**
+	 * @return DateTimeImmutable
+	 */
+	public function getTime()
+	{
+		return new DateTimeImmutable($this->time);
+	}
+
+	/**
+	 * @return int
+	 */
+	public function getUser()
+	{
+		return $this->user;
+	}
+
+	/**
+	 * @param int $user
+	 */
+	public function setUser($user)
+	{
+		$this->user = $user;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getComment()
+	{
+		return $this->comment;
+	}
+
+	/**
+	 * @param string $comment
+	 */
+	public function setComment($comment)
+	{
+		$this->comment = $comment;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getVisibility()
+	{
+		return $this->visibility;
+	}
+
+	/**
+	 * @param string $visibility
+	 */
+	public function setVisibility($visibility)
+	{
+		$this->visibility = $visibility;
+	}
+
+	/**
+	 * @return int
+	 */
+	public function getRequest()
+	{
+		return $this->request;
+	}
+
+	/**
+	 * @param int $request
+	 */
+	public function setRequest($request)
+	{
+		$this->request = $request;
+	}
 }

Braces +3 added lines, -6 removed lines

@@ -41,8 +41,7 @@ 
     {
         if ($showAll) {
             $statement = $database->prepare('SELECT * FROM comment WHERE request = :target;');
-        }
-        else {
+        } else {
             $statement = $database->prepare(<<<SQL
 SELECT * FROM comment
 WHERE request = :target AND (visibility = 'user' OR visibility = 'requester' OR user = :userid);
@@ -84,12 +83,10 @@ 
 
             if ($statement->execute()) {
                 $this->id = (int)$this->dbObject->lastInsertId();
-            }
-            else {
+            } else {
                 throw new Exception($statement->errorInfo());
             }
-        }
-        else {
+        } else {
             // update
             $statement = $this->dbObject->prepare(<<<SQL
 UPDATE comment

includes/Pages/Request/PageRequestAccount.php

Indentation +184 added lines, -184 removed lines

@@ -21,188 +21,188 @@
 
 class PageRequestAccount extends PublicInterfacePageBase
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     * @return void
-     * @throws OptimisticLockFailedException
-     * @throws Exception
-     */
-    protected function main()
-    {
-        // dual mode page
-        if (WebRequest::wasPosted()) {
-            $request = $this->createNewRequest();
-            $comment = $this->createComment();
-
-            $validationErrors = $this->validateRequest($request);
-
-            if (count($validationErrors) > 0) {
-                foreach ($validationErrors as $validationError) {
-                    SessionAlert::error($validationError->getErrorMessage());
-                }
-
-                // Preserve the data after an error
-                WebRequest::setSessionContext('accountReq',
-                    array(
-                        'username' => WebRequest::postString('name'),
-                        'email'    => WebRequest::postEmail('email'),
-                        'comments' => WebRequest::postString('comments'),
-                    )
-                );
-
-                // Validation error, bomb out early.
-                $this->redirect();
-
-                return;
-            }
-
-            // actually save the request to the database
-            if ($this->getSiteConfiguration()->getEmailConfirmationEnabled()) {
-                $this->saveAsEmailConfirmation($request, $comment);
-            }
-            else {
-                $this->saveWithoutEmailConfirmation($request, $comment);
-            }
-        }
-        else {
-            // set the form values from the session context
-            $context = WebRequest::getSessionContext('accountReq');
-            if ($context !== null && is_array($context)) {
-                $this->assign('username', $context['username']);
-                $this->assign('email', $context['email']);
-                $this->assign('comments', $context['comments']);
-            }
-
-            // Clear it for a refresh
-            WebRequest::setSessionContext('accountReq', null);
-
-            $this->setTemplate('request/request-form.tpl');
-        }
-    }
-
-    /**
-     * @return Request
-     */
-    protected function createNewRequest()
-    {
-        $request = new Request();
-        $request->setDatabase($this->getDatabase());
-
-        $request->setName(WebRequest::postString('name'));
-        $request->setEmail(WebRequest::postEmail('email'));
-
-        $request->setIp(WebRequest::remoteAddress());
-        $request->setForwardedIp(WebRequest::forwardedAddress());
-
-        $request->setUserAgent(WebRequest::userAgent());
-
-        return $request;
-    }
-
-    /**
-     * @return Comment|null
-     */
-    private function createComment()
-    {
-        $commentText = WebRequest::postString('comments');
-        if ($commentText === null || trim($commentText) === '') {
-            return null;
-        }
-
-        $comment = new Comment();
-        $comment->setDatabase($this->getDatabase());
-
-        $comment->setVisibility('requester');
-        $comment->setUser(null);
-        $comment->setComment($commentText);
-
-        return $comment;
-    }
-
-    /**
-     * @param Request $request
-     *
-     * @return ValidationError[]
-     */
-    protected function validateRequest($request)
-    {
-        $validationHelper = new RequestValidationHelper(
-            new BanHelper($this->getDatabase()),
-            $request,
-            WebRequest::postEmail('emailconfirm'),
-            $this->getDatabase(),
-            $this->getAntiSpoofProvider(),
-            $this->getXffTrustProvider(),
-            $this->getHttpHelper(),
-            $this->getSiteConfiguration()->getMediawikiWebServiceEndpoint(),
-            $this->getSiteConfiguration()->getTitleBlacklistEnabled(),
-            $this->getTorExitProvider());
-
-        // These are arrays of ValidationError.
-        $nameValidation = $validationHelper->validateName();
-        $emailValidation = $validationHelper->validateEmail();
-        $otherValidation = $validationHelper->validateOther();
-
-        $validationErrors = array_merge($nameValidation, $emailValidation, $otherValidation);
-
-        return $validationErrors;
-    }
-
-    /**
-     * @param Request      $request
-     *
-     * @param Comment|null $comment
-     *
-     * @throws OptimisticLockFailedException
-     * @throws Exception
-     */
-    protected function saveAsEmailConfirmation(Request $request, $comment)
-    {
-        $request->generateEmailConfirmationHash();
-        $request->save();
-
-        if ($comment !== null) {
-            $comment->setRequest($request->getId());
-            $comment->save();
-        }
-
-        $trustedIp = $this->getXffTrustProvider()->getTrustedClientIp(
-            $request->getIp(),
-            $request->getForwardedIp());
-
-        $this->assign("ip", $trustedIp);
-        $this->assign("id", $request->getId());
-        $this->assign("hash", $request->getEmailConfirm());
-
-        // Sends the confirmation email to the user.
-        $this->getEmailHelper()->sendMail(
-            $request->getEmail(),
-            "[ACC #{$request->getId()}] English Wikipedia Account Request",
-            $this->fetchTemplate('request/confirmation-mail.tpl'));
-
-        $this->redirect('emailConfirmationRequired');
-    }
-
-    /**
-     * @param Request      $request
-     *
-     * @param Comment|null $comment
-     *
-     * @throws OptimisticLockFailedException
-     * @throws Exception
-     */
-    protected function saveWithoutEmailConfirmation(Request $request, $comment)
-    {
-        $request->setEmailConfirm(0); // fixme Since it can't be null
-        $request->save();
-
-        if ($comment !== null) {
-            $comment->setRequest($request->getId());
-            $comment->save();
-        }
-
-        $this->getNotificationHelper()->requestReceived($request);
-
-        $this->redirect('requestSubmitted');
-    }
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 * @return void
+	 * @throws OptimisticLockFailedException
+	 * @throws Exception
+	 */
+	protected function main()
+	{
+		// dual mode page
+		if (WebRequest::wasPosted()) {
+			$request = $this->createNewRequest();
+			$comment = $this->createComment();
+
+			$validationErrors = $this->validateRequest($request);
+
+			if (count($validationErrors) > 0) {
+				foreach ($validationErrors as $validationError) {
+					SessionAlert::error($validationError->getErrorMessage());
+				}
+
+				// Preserve the data after an error
+				WebRequest::setSessionContext('accountReq',
+					array(
+						'username' => WebRequest::postString('name'),
+						'email'    => WebRequest::postEmail('email'),
+						'comments' => WebRequest::postString('comments'),
+					)
+				);
+
+				// Validation error, bomb out early.
+				$this->redirect();
+
+				return;
+			}
+
+			// actually save the request to the database
+			if ($this->getSiteConfiguration()->getEmailConfirmationEnabled()) {
+				$this->saveAsEmailConfirmation($request, $comment);
+			}
+			else {
+				$this->saveWithoutEmailConfirmation($request, $comment);
+			}
+		}
+		else {
+			// set the form values from the session context
+			$context = WebRequest::getSessionContext('accountReq');
+			if ($context !== null && is_array($context)) {
+				$this->assign('username', $context['username']);
+				$this->assign('email', $context['email']);
+				$this->assign('comments', $context['comments']);
+			}
+
+			// Clear it for a refresh
+			WebRequest::setSessionContext('accountReq', null);
+
+			$this->setTemplate('request/request-form.tpl');
+		}
+	}
+
+	/**
+	 * @return Request
+	 */
+	protected function createNewRequest()
+	{
+		$request = new Request();
+		$request->setDatabase($this->getDatabase());
+
+		$request->setName(WebRequest::postString('name'));
+		$request->setEmail(WebRequest::postEmail('email'));
+
+		$request->setIp(WebRequest::remoteAddress());
+		$request->setForwardedIp(WebRequest::forwardedAddress());
+
+		$request->setUserAgent(WebRequest::userAgent());
+
+		return $request;
+	}
+
+	/**
+	 * @return Comment|null
+	 */
+	private function createComment()
+	{
+		$commentText = WebRequest::postString('comments');
+		if ($commentText === null || trim($commentText) === '') {
+			return null;
+		}
+
+		$comment = new Comment();
+		$comment->setDatabase($this->getDatabase());
+
+		$comment->setVisibility('requester');
+		$comment->setUser(null);
+		$comment->setComment($commentText);
+
+		return $comment;
+	}
+
+	/**
+	 * @param Request $request
+	 *
+	 * @return ValidationError[]
+	 */
+	protected function validateRequest($request)
+	{
+		$validationHelper = new RequestValidationHelper(
+			new BanHelper($this->getDatabase()),
+			$request,
+			WebRequest::postEmail('emailconfirm'),
+			$this->getDatabase(),
+			$this->getAntiSpoofProvider(),
+			$this->getXffTrustProvider(),
+			$this->getHttpHelper(),
+			$this->getSiteConfiguration()->getMediawikiWebServiceEndpoint(),
+			$this->getSiteConfiguration()->getTitleBlacklistEnabled(),
+			$this->getTorExitProvider());
+
+		// These are arrays of ValidationError.
+		$nameValidation = $validationHelper->validateName();
+		$emailValidation = $validationHelper->validateEmail();
+		$otherValidation = $validationHelper->validateOther();
+
+		$validationErrors = array_merge($nameValidation, $emailValidation, $otherValidation);
+
+		return $validationErrors;
+	}
+
+	/**
+	 * @param Request      $request
+	 *
+	 * @param Comment|null $comment
+	 *
+	 * @throws OptimisticLockFailedException
+	 * @throws Exception
+	 */
+	protected function saveAsEmailConfirmation(Request $request, $comment)
+	{
+		$request->generateEmailConfirmationHash();
+		$request->save();
+
+		if ($comment !== null) {
+			$comment->setRequest($request->getId());
+			$comment->save();
+		}
+
+		$trustedIp = $this->getXffTrustProvider()->getTrustedClientIp(
+			$request->getIp(),
+			$request->getForwardedIp());
+
+		$this->assign("ip", $trustedIp);
+		$this->assign("id", $request->getId());
+		$this->assign("hash", $request->getEmailConfirm());
+
+		// Sends the confirmation email to the user.
+		$this->getEmailHelper()->sendMail(
+			$request->getEmail(),
+			"[ACC #{$request->getId()}] English Wikipedia Account Request",
+			$this->fetchTemplate('request/confirmation-mail.tpl'));
+
+		$this->redirect('emailConfirmationRequired');
+	}
+
+	/**
+	 * @param Request      $request
+	 *
+	 * @param Comment|null $comment
+	 *
+	 * @throws OptimisticLockFailedException
+	 * @throws Exception
+	 */
+	protected function saveWithoutEmailConfirmation(Request $request, $comment)
+	{
+		$request->setEmailConfirm(0); // fixme Since it can't be null
+		$request->save();
+
+		if ($comment !== null) {
+			$comment->setRequest($request->getId());
+			$comment->save();
+		}
+
+		$this->getNotificationHelper()->requestReceived($request);
+
+		$this->redirect('requestSubmitted');
+	}
 }
\ No newline at end of file

Braces +2 added lines, -4 removed lines

@@ -59,12 +59,10 @@
             // actually save the request to the database
             if ($this->getSiteConfiguration()->getEmailConfirmationEnabled()) {
                 $this->saveAsEmailConfirmation($request, $comment);
-            }
-            else {
+            } else {
                 $this->saveWithoutEmailConfirmation($request, $comment);
             }
-        }
-        else {
+        } else {
             // set the form values from the session context
             $context = WebRequest::getSessionContext('accountReq');
             if ($context !== null && is_array($context)) {

includes/ConsoleTasks/OldRequestCleanupTask.php

Indentation +8 added lines, -8 removed lines

@@ -12,9 +12,9 @@ 
 
 class OldRequestCleanupTask extends ConsoleTaskBase
 {
-    public function execute()
-    {
-        $statement = $this->getDatabase()->prepare(<<<SQL
+	public function execute()
+	{
+		$statement = $this->getDatabase()->prepare(<<<SQL
             DELETE FROM request
             WHERE
                 request.date < DATE_SUB(CURRENT_TIMESTAMP(), INTERVAL :expiry DAY)
@@ -22,10 +22,10 @@ 
                 AND request.emailconfirm != ''
                 AND NOT exists (SELECT 1 FROM comment c WHERE c.request = request.id)
 SQL
-        );
+		);
 
-        $expiryTime = $this->getSiteConfiguration()->getEmailConfirmationExpiryDays();
-        $statement->bindValue(':expiry', $expiryTime);
-        $statement->execute();
-    }
+		$expiryTime = $this->getSiteConfiguration()->getEmailConfirmationExpiryDays();
+		$statement->bindValue(':expiry', $expiryTime);
+		$statement->execute();
+	}
 }
\ No newline at end of file

includes/ConsoleTasks/RefreshOAuthDataTask.php

Indentation +40 added lines, -40 removed lines

@@ -18,53 +18,53 @@
 
 class RefreshOAuthDataTask extends ConsoleTaskBase
 {
-    public function execute()
-    {
-        $database = $this->getDatabase();
+	public function execute()
+	{
+		$database = $this->getDatabase();
 
-        $idList = $database
-            ->query('SELECT user FROM oauthtoken WHERE type = \'access\' AND expiry IS NULL')
-            ->fetchAll(PDO::FETCH_COLUMN);
+		$idList = $database
+			->query('SELECT user FROM oauthtoken WHERE type = \'access\' AND expiry IS NULL')
+			->fetchAll(PDO::FETCH_COLUMN);
 
-        if (count($idList) > 0) {
-            /** @var User[] $users */
-            $users = UserSearchHelper::get($database)->inIds($idList)->fetch();
+		if (count($idList) > 0) {
+			/** @var User[] $users */
+			$users = UserSearchHelper::get($database)->inIds($idList)->fetch();
 
-            $expiredStatement = $database
-                ->prepare('UPDATE oauthtoken SET expiry = CURRENT_TIMESTAMP() WHERE user = :u AND type = \'access\'');
+			$expiredStatement = $database
+				->prepare('UPDATE oauthtoken SET expiry = CURRENT_TIMESTAMP() WHERE user = :u AND type = \'access\'');
 
-            foreach ($users as $u) {
-                try {
-                    $database->beginTransaction();
+			foreach ($users as $u) {
+				try {
+					$database->beginTransaction();
 
-                    $oauth = new OAuthUserHelper($u, $database, $this->getOAuthProtocolHelper(),
-                        $this->getSiteConfiguration());
+					$oauth = new OAuthUserHelper($u, $database, $this->getOAuthProtocolHelper(),
+						$this->getSiteConfiguration());
 
-                    try {
-                        $oauth->refreshIdentity();
-                    }
-                    catch (OAuthException $ex) {
-                        $expiredStatement->execute(array(':u' => $u->getId()));
-                    }
+					try {
+						$oauth->refreshIdentity();
+					}
+					catch (OAuthException $ex) {
+						$expiredStatement->execute(array(':u' => $u->getId()));
+					}
 
-                    $database->commit();
-                }
-                catch (Exception $ex) {
-                    $database->rollBack();
+					$database->commit();
+				}
+				catch (Exception $ex) {
+					$database->rollBack();
 
-                    printf("\n\nFailed updating OAuth data for %s\n", $u->getUsername());
-                    printf($ex->getMessage());
-                }
-                finally {
-                    if ($database->hasActiveTransaction()) {
-                        $database->rollBack();
-                    }
-                }
-            }
-        }
+					printf("\n\nFailed updating OAuth data for %s\n", $u->getUsername());
+					printf($ex->getMessage());
+				}
+				finally {
+					if ($database->hasActiveTransaction()) {
+						$database->rollBack();
+					}
+				}
+			}
+		}
 
-        $database->beginTransaction();
-        $database->exec('DELETE FROM oauthtoken WHERE expiry IS NOT NULL AND expiry < NOW() AND type = \'request\'');
-        $database->commit();
-    }
+		$database->beginTransaction();
+		$database->exec('DELETE FROM oauthtoken WHERE expiry IS NOT NULL AND expiry < NOW() AND type = \'request\'');
+		$database->commit();
+	}
 }
\ No newline at end of file

includes/Providers/XffTrustProvider.php

Indentation +152 added lines, -152 removed lines

@@ -22,156 +22,156 @@
  */
 class XffTrustProvider implements IXffTrustProvider
 {
-    /**
-     * Array of IP addresses which are TRUSTED proxies
-     * @var string[]
-     */
-    private $trustedCache;
-    /**
-     * Array of IP addresses which are UNTRUSTED proxies
-     * @var string[]
-     */
-    private $untrustedCache = array();
-    /** @var PDOStatement */
-    private $trustedQuery;
-    /**
-     * @var PdoDatabase
-     */
-    private $database;
-
-    /**
-     * Creates a new instance of the trust provider
-     *
-     * @param string[]    $squidIpList List of IP addresses to pre-approve
-     * @param PdoDatabase $database
-     */
-    public function __construct($squidIpList, PdoDatabase $database)
-    {
-        $this->trustedCache = $squidIpList;
-        $this->database = $database;
-    }
-
-    /**
-     * Returns a value if the IP address is a trusted proxy
-     *
-     * @param string $ip
-     *
-     * @return bool
-     */
-    public function isTrusted($ip)
-    {
-        if (in_array($ip, $this->trustedCache)) {
-            return true;
-        }
-
-        if (in_array($ip, $this->untrustedCache)) {
-            return false;
-        }
-
-        if ($this->trustedQuery === null) {
-            $query = "SELECT COUNT(id) FROM xfftrustcache WHERE ip = :ip;";
-            $this->trustedQuery = $this->database->prepare($query);
-        }
-
-        $this->trustedQuery->execute(array(":ip" => $ip));
-        $result = $this->trustedQuery->fetchColumn();
-        $this->trustedQuery->closeCursor();
-
-        if ($result == 0) {
-            $this->untrustedCache[] = $ip;
-
-            return false;
-        }
-
-        if ($result >= 1) {
-            $this->trustedCache[] = $ip;
-
-            return true;
-        }
-
-        // something weird has happened if we've got here.
-        // default to untrusted.
-        return false;
-    }
-
-    /**
-     * Gets the last trusted IP in the proxy chain.
-     *
-     * @param string $ip      The IP address from REMOTE_ADDR
-     * @param string $proxyIp The contents of the XFF header.
-     *
-     * @return string Trusted source IP address
-     */
-    public function getTrustedClientIp($ip, $proxyIp)
-    {
-        $clientIpAddress = $ip;
-        if ($proxyIp) {
-            $ipList = explode(",", $proxyIp);
-            $ipList[] = $clientIpAddress;
-            $ipList = array_reverse($ipList);
-
-            foreach ($ipList as $ipNumber => $ipAddress) {
-                if ($this->isTrusted(trim($ipAddress)) && $ipNumber < (count($ipList) - 1)) {
-                    continue;
-                }
-
-                $clientIpAddress = $ipAddress;
-                break;
-            }
-        }
-
-        return trim($clientIpAddress);
-    }
-
-    /**
-     * Takes an array( "low" => "high" ) values, and returns true if $needle is in at least one of them.
-     *
-     * @param array  $haystack
-     * @param string $ip
-     *
-     * @return bool
-     */
-    public function ipInRange($haystack, $ip)
-    {
-        $needle = ip2long($ip);
-
-        foreach ($haystack as $low => $high) {
-            if (ip2long($low) <= $needle && ip2long($high) >= $needle) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    /**
-     * Explodes a CIDR range into an array of addresses
-     *
-     * @param string $range A CIDR-format range
-     *
-     * @return array An array containing every IP address in the range
-     */
-    public function explodeCidr($range)
-    {
-        $cidrData = explode('/', $range);
-
-        if (!isset($cidrData[1])) {
-            return array($range);
-        }
-
-        $blow = (
-            str_pad(decbin(ip2long($cidrData[0])), 32, "0", STR_PAD_LEFT) &
-            str_pad(str_pad("", $cidrData[1], "1"), 32, "0")
-        );
-        $bhigh = ($blow | str_pad(str_pad("", $cidrData[1], "0"), 32, "1"));
-
-        $list = array();
-
-        $bindecBHigh = bindec($bhigh);
-        for ($x = bindec($blow); $x <= $bindecBHigh; $x++) {
-            $list[] = long2ip($x);
-        }
-
-        return $list;
-    }
+	/**
+	 * Array of IP addresses which are TRUSTED proxies
+	 * @var string[]
+	 */
+	private $trustedCache;
+	/**
+	 * Array of IP addresses which are UNTRUSTED proxies
+	 * @var string[]
+	 */
+	private $untrustedCache = array();
+	/** @var PDOStatement */
+	private $trustedQuery;
+	/**
+	 * @var PdoDatabase
+	 */
+	private $database;
+
+	/**
+	 * Creates a new instance of the trust provider
+	 *
+	 * @param string[]    $squidIpList List of IP addresses to pre-approve
+	 * @param PdoDatabase $database
+	 */
+	public function __construct($squidIpList, PdoDatabase $database)
+	{
+		$this->trustedCache = $squidIpList;
+		$this->database = $database;
+	}
+
+	/**
+	 * Returns a value if the IP address is a trusted proxy
+	 *
+	 * @param string $ip
+	 *
+	 * @return bool
+	 */
+	public function isTrusted($ip)
+	{
+		if (in_array($ip, $this->trustedCache)) {
+			return true;
+		}
+
+		if (in_array($ip, $this->untrustedCache)) {
+			return false;
+		}
+
+		if ($this->trustedQuery === null) {
+			$query = "SELECT COUNT(id) FROM xfftrustcache WHERE ip = :ip;";
+			$this->trustedQuery = $this->database->prepare($query);
+		}
+
+		$this->trustedQuery->execute(array(":ip" => $ip));
+		$result = $this->trustedQuery->fetchColumn();
+		$this->trustedQuery->closeCursor();
+
+		if ($result == 0) {
+			$this->untrustedCache[] = $ip;
+
+			return false;
+		}
+
+		if ($result >= 1) {
+			$this->trustedCache[] = $ip;
+
+			return true;
+		}
+
+		// something weird has happened if we've got here.
+		// default to untrusted.
+		return false;
+	}
+
+	/**
+	 * Gets the last trusted IP in the proxy chain.
+	 *
+	 * @param string $ip      The IP address from REMOTE_ADDR
+	 * @param string $proxyIp The contents of the XFF header.
+	 *
+	 * @return string Trusted source IP address
+	 */
+	public function getTrustedClientIp($ip, $proxyIp)
+	{
+		$clientIpAddress = $ip;
+		if ($proxyIp) {
+			$ipList = explode(",", $proxyIp);
+			$ipList[] = $clientIpAddress;
+			$ipList = array_reverse($ipList);
+
+			foreach ($ipList as $ipNumber => $ipAddress) {
+				if ($this->isTrusted(trim($ipAddress)) && $ipNumber < (count($ipList) - 1)) {
+					continue;
+				}
+
+				$clientIpAddress = $ipAddress;
+				break;
+			}
+		}
+
+		return trim($clientIpAddress);
+	}
+
+	/**
+	 * Takes an array( "low" => "high" ) values, and returns true if $needle is in at least one of them.
+	 *
+	 * @param array  $haystack
+	 * @param string $ip
+	 *
+	 * @return bool
+	 */
+	public function ipInRange($haystack, $ip)
+	{
+		$needle = ip2long($ip);
+
+		foreach ($haystack as $low => $high) {
+			if (ip2long($low) <= $needle && ip2long($high) >= $needle) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Explodes a CIDR range into an array of addresses
+	 *
+	 * @param string $range A CIDR-format range
+	 *
+	 * @return array An array containing every IP address in the range
+	 */
+	public function explodeCidr($range)
+	{
+		$cidrData = explode('/', $range);
+
+		if (!isset($cidrData[1])) {
+			return array($range);
+		}
+
+		$blow = (
+			str_pad(decbin(ip2long($cidrData[0])), 32, "0", STR_PAD_LEFT) &
+			str_pad(str_pad("", $cidrData[1], "1"), 32, "0")
+		);
+		$bhigh = ($blow | str_pad(str_pad("", $cidrData[1], "0"), 32, "1"));
+
+		$list = array();
+
+		$bindecBHigh = bindec($bhigh);
+		for ($x = bindec($blow); $x <= $bindecBHigh; $x++) {
+			$list[] = long2ip($x);
+		}
+
+		return $list;
+	}
 }

includes/Security/CredentialProviders/PasswordCredentialProvider.php

Indentation +109 added lines, -109 removed lines

@@ -19,123 +19,123 @@
 
 class PasswordCredentialProvider extends CredentialProviderBase
 {
-    const PASSWORD_COST = 10;
-    const PASSWORD_ALGO = PASSWORD_BCRYPT;
-
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
-    {
-        parent::__construct($database, $configuration, 'password');
-    }
-
-    public function authenticate(User $user, $data)
-    {
-        $storedData = $this->getCredentialData($user->getId());
-        if($storedData === null)
-        {
-            // No available credential matching these parameters
-            return false;
-        }
-
-        if($storedData->getVersion() !== 2) {
-            // Non-2 versions are not supported.
-            return false;
-        }
-
-        if (!password_verify($data, $storedData->getData())) {
-            return false;
-        }
-
-        if (password_needs_rehash($storedData->getData(), self::PASSWORD_ALGO,
-            array('cost' => self::PASSWORD_COST))) {
-            try {
-                $this->reallySetCredential($user, $storedData->getFactor(), $data);
-            }
-            catch (OptimisticLockFailedException $e) {
-                // optimistic lock failed, but no biggie. We'll catch it on the next login.
-            }
-        }
-
-        $strengthTester = new Zxcvbn();
-        $strength = $strengthTester->passwordStrength($data, [$user->getUsername(), $user->getOnWikiName(), $user->getEmail()]);
-
-        /*  0 means the password is extremely guessable (within 10^3 guesses), dictionary words like 'password' or 'mother' score a 0
+	const PASSWORD_COST = 10;
+	const PASSWORD_ALGO = PASSWORD_BCRYPT;
+
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
+	{
+		parent::__construct($database, $configuration, 'password');
+	}
+
+	public function authenticate(User $user, $data)
+	{
+		$storedData = $this->getCredentialData($user->getId());
+		if($storedData === null)
+		{
+			// No available credential matching these parameters
+			return false;
+		}
+
+		if($storedData->getVersion() !== 2) {
+			// Non-2 versions are not supported.
+			return false;
+		}
+
+		if (!password_verify($data, $storedData->getData())) {
+			return false;
+		}
+
+		if (password_needs_rehash($storedData->getData(), self::PASSWORD_ALGO,
+			array('cost' => self::PASSWORD_COST))) {
+			try {
+				$this->reallySetCredential($user, $storedData->getFactor(), $data);
+			}
+			catch (OptimisticLockFailedException $e) {
+				// optimistic lock failed, but no biggie. We'll catch it on the next login.
+			}
+		}
+
+		$strengthTester = new Zxcvbn();
+		$strength = $strengthTester->passwordStrength($data, [$user->getUsername(), $user->getOnWikiName(), $user->getEmail()]);
+
+		/*  0 means the password is extremely guessable (within 10^3 guesses), dictionary words like 'password' or 'mother' score a 0
             1 is still very guessable (guesses < 10^6), an extra character on a dictionary word can score a 1
             2 is somewhat guessable (guesses < 10^8), provides some protection from unthrottled online attacks
             3 is safely unguessable (guesses < 10^10), offers moderate protection from offline slow-hash scenario
             4 is very unguessable (guesses >= 10^10) and provides strong protection from offline slow-hash scenario         */
 
-        if ($strength['score'] <= 1 || CommonPasswords::isCommon($data) || mb_strlen($data) < 8) {
-            // prevent login for extremely weak passwords
-            // at this point the user has authenticated via password, so they *know* it's weak.
-            SessionAlert::error('Your password is too weak to permit login. Please choose the "forgotten your password" option below and set a new one.', null);
-            return false;
-        }
-
-        return true;
-    }
-
-    /**
-     * @param User   $user
-     * @param int    $factor
-     * @param string $password
-     *
-     * @throws OptimisticLockFailedException
-     */
-    private function reallySetCredential(User $user, int $factor, string $password) : void {
-        $storedData = $this->getCredentialData($user->getId());
-
-        if ($storedData === null) {
-            $storedData = $this->createNewCredential($user);
-        }
-
-        $storedData->setData(password_hash($password, self::PASSWORD_ALGO, array('cost' => self::PASSWORD_COST)));
-        $storedData->setFactor($factor);
-        $storedData->setVersion(2);
-
-        $storedData->save();
-    }
-
-    /**
-     * @param User   $user
-     * @param int    $factor
-     * @param string $password
-     *
-     * @throws ApplicationLogicException
-     * @throws OptimisticLockFailedException
-     */
-    public function setCredential(User $user, $factor, $password)
-    {
-        if (CommonPasswords::isCommon($password)) {
-            throw new ApplicationLogicException("Your new password is listed in the top 100,000 passwords. Please choose a stronger one.", null);
-        }
-
-        $strengthTester = new Zxcvbn();
-        $strength = $strengthTester->passwordStrength($password, [$user->getUsername(), $user->getOnWikiName(), $user->getEmail()]);
-
-        /*  0 means the password is extremely guessable (within 10^3 guesses), dictionary words like 'password' or 'mother' score a 0
+		if ($strength['score'] <= 1 || CommonPasswords::isCommon($data) || mb_strlen($data) < 8) {
+			// prevent login for extremely weak passwords
+			// at this point the user has authenticated via password, so they *know* it's weak.
+			SessionAlert::error('Your password is too weak to permit login. Please choose the "forgotten your password" option below and set a new one.', null);
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * @param User   $user
+	 * @param int    $factor
+	 * @param string $password
+	 *
+	 * @throws OptimisticLockFailedException
+	 */
+	private function reallySetCredential(User $user, int $factor, string $password) : void {
+		$storedData = $this->getCredentialData($user->getId());
+
+		if ($storedData === null) {
+			$storedData = $this->createNewCredential($user);
+		}
+
+		$storedData->setData(password_hash($password, self::PASSWORD_ALGO, array('cost' => self::PASSWORD_COST)));
+		$storedData->setFactor($factor);
+		$storedData->setVersion(2);
+
+		$storedData->save();
+	}
+
+	/**
+	 * @param User   $user
+	 * @param int    $factor
+	 * @param string $password
+	 *
+	 * @throws ApplicationLogicException
+	 * @throws OptimisticLockFailedException
+	 */
+	public function setCredential(User $user, $factor, $password)
+	{
+		if (CommonPasswords::isCommon($password)) {
+			throw new ApplicationLogicException("Your new password is listed in the top 100,000 passwords. Please choose a stronger one.", null);
+		}
+
+		$strengthTester = new Zxcvbn();
+		$strength = $strengthTester->passwordStrength($password, [$user->getUsername(), $user->getOnWikiName(), $user->getEmail()]);
+
+		/*  0 means the password is extremely guessable (within 10^3 guesses), dictionary words like 'password' or 'mother' score a 0
             1 is still very guessable (guesses < 10^6), an extra character on a dictionary word can score a 1
             2 is somewhat guessable (guesses < 10^8), provides some protection from unthrottled online attacks
             3 is safely unguessable (guesses < 10^10), offers moderate protection from offline slow-hash scenario
             4 is very unguessable (guesses >= 10^10) and provides strong protection from offline slow-hash scenario         */
 
-        if ($strength['score'] <= 2 || mb_strlen($password) < 8) {
-            throw new ApplicationLogicException("Your new password is too weak. Please choose a stronger one.", null);
-        }
-
-        if ($strength['score'] <= 3) {
-            SessionAlert::warning("Your new password is not as strong as it could be. Consider replacing it with a stronger password.", null);
-        }
-
-        $this->reallySetCredential($user, $factor, $password);
-    }
-
-    /**
-     * @param User $user
-     *
-     * @throws ApplicationLogicException
-     */
-    public function deleteCredential(User $user)
-    {
-        throw new ApplicationLogicException('Deletion of password credential is not allowed.');
-    }
+		if ($strength['score'] <= 2 || mb_strlen($password) < 8) {
+			throw new ApplicationLogicException("Your new password is too weak. Please choose a stronger one.", null);
+		}
+
+		if ($strength['score'] <= 3) {
+			SessionAlert::warning("Your new password is not as strong as it could be. Consider replacing it with a stronger password.", null);
+		}
+
+		$this->reallySetCredential($user, $factor, $password);
+	}
+
+	/**
+	 * @param User $user
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	public function deleteCredential(User $user)
+	{
+		throw new ApplicationLogicException('Deletion of password credential is not allowed.');
+	}
 }

includes/Security/RoleConfiguration.php

Indentation +361 added lines, -361 removed lines

@@ -47,392 +47,392 @@
 
 class RoleConfiguration
 {
-    const ACCESS_ALLOW = 1;
-    const ACCESS_DENY = -1;
-    const ACCESS_DEFAULT = 0;
-    const MAIN = 'main';
-    const ALL = '*';
-    /**
-     * A map of roles to rights
-     *
-     * For example:
-     *
-     * array(
-     *   'myrole' => array(
-     *       PageMyPage::class => array(
-     *           'edit' => self::ACCESS_ALLOW,
-     *           'create' => self::ACCESS_DENY,
-     *       )
-     *   )
-     * )
-     *
-     * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
-     * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
-     * be the expected result:
-     *
-     * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
-     * - (A,-,-) = A
-     * - (D,-,-) = D
-     * - (A,D,-) = D (deny takes precedence over allow)
-     * - (A,A,A) = A (repetition has no effect)
-     *
-     * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
-     *
-     * @var array
-     */
-    private $roleConfig = array(
-        'public'            => array(
-            /*
+	const ACCESS_ALLOW = 1;
+	const ACCESS_DENY = -1;
+	const ACCESS_DEFAULT = 0;
+	const MAIN = 'main';
+	const ALL = '*';
+	/**
+	 * A map of roles to rights
+	 *
+	 * For example:
+	 *
+	 * array(
+	 *   'myrole' => array(
+	 *       PageMyPage::class => array(
+	 *           'edit' => self::ACCESS_ALLOW,
+	 *           'create' => self::ACCESS_DENY,
+	 *       )
+	 *   )
+	 * )
+	 *
+	 * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
+	 * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
+	 * be the expected result:
+	 *
+	 * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
+	 * - (A,-,-) = A
+	 * - (D,-,-) = D
+	 * - (A,D,-) = D (deny takes precedence over allow)
+	 * - (A,A,A) = A (repetition has no effect)
+	 *
+	 * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
+	 *
+	 * @var array
+	 */
+	private $roleConfig = array(
+		'public'            => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED *OUT* USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'   => array(
-                'publicStats',
-            ),
-            PageTeam::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageXffDemo::class        => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-            )
-        ),
-        'loggedIn'          => array(
-            /*
+			'_childRoles'   => array(
+				'publicStats',
+			),
+			PageTeam::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageXffDemo::class        => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+			)
+		),
+		'loggedIn'          => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED IN USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'             => array(
-                'public',
-            ),
-            PagePreferences::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'refreshOAuth' => self::ACCESS_ALLOW,
-            ),
-            PageChangePassword::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageMultiFactor::class    => array(
-                self::MAIN          => self::ACCESS_ALLOW,
-                'scratch'           => self::ACCESS_ALLOW,
-                'enableYubikeyOtp'  => self::ACCESS_ALLOW,
-                'disableYubikeyOtp' => self::ACCESS_ALLOW,
-                'enableTotp'        => self::ACCESS_ALLOW,
-                'disableTotp'       => self::ACCESS_ALLOW,
-            ),
-            PageOAuth::class          => array(
-                'attach' => self::ACCESS_ALLOW,
-                'detach' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'user'              => array(
-            '_description'                       => 'A standard tool user.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'internalStats',
-            ),
-            PageMain::class                      => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBan::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageEmailManagement::class           => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageExpandedRequestList::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageLog::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSearch::class                    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'select'   => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageViewRequest::class               => array(
-                self::MAIN       => self::ACCESS_ALLOW,
-                'seeAllRequests' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'                        => array(
-                'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
-                'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
-                'seeRelatedRequests'         => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageComment::class                   => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCloseRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCreateRequest::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDeferRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDropRequest::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageReservation::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSendToUser::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class          => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-                'all'      => self::ACCESS_ALLOW,
-            ),
-            'RequestCreation'                    => array(
-                User::CREATION_MANUAL => self::ACCESS_ALLOW,
-            ),
-            'GlobalInfo'                         => array(
-                'viewSiteNotice' => self::ACCESS_ALLOW,
-                'viewOnlineUsers' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'admin'             => array(
-            '_description'                       => 'A tool administrator.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageEmailManagement::class           => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'create' => self::ACCESS_ALLOW,
-            ),
-            PageSiteNotice::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageUserManagement::class            => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'approve'   => self::ACCESS_ALLOW,
-                'decline'   => self::ACCESS_ALLOW,
-                'rename'    => self::ACCESS_ALLOW,
-                'editUser'  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'delete' => self::ACCESS_ALLOW,
-                'add'    => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                'acknowledge' => self::ACCESS_ALLOW,
-                'requeue'     => self::ACCESS_ALLOW,
-            ),
-        ),
-        'checkuser'         => array(
-            '_description'            => 'A user with CheckUser access',
-            '_editableBy'             => array('checkuser', 'toolRoot'),
-            '_childRoles'             => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageUserManagement::class => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'             => array(
-                'seeUserAgentData' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'toolRoot'          => array(
-            '_description' => 'A user with shell access to the servers running the tool',
-            '_editableBy'  => array('toolRoot'),
-            '_childRoles'  => array(
-                'admin',
-            ),
-            PageMultiFactor::class => array(
-                'enableU2F'         => self::ACCESS_ALLOW,
-                'disableU2F'        => self::ACCESS_ALLOW,
-            )
-        ),
-        'botCreation'       => array(
-            '_description'    => 'A user allowed to use the bot to perform account creations',
-            '_editableBy'     => array('admin', 'toolRoot'),
-            '_childRoles'     => array(),
-            'RequestCreation' => array(
-                User::CREATION_BOT => self::ACCESS_ALLOW,
-            ),
-        ),
-        'oauthCreation'       => array(
-            '_description'    => 'A user allowed to use the OAuth to perform account creations',
-            '_editableBy'     => array('admin', 'toolRoot'),
-            '_childRoles'     => array(),
-            'RequestCreation'                    => array(
-                User::CREATION_OAUTH  => self::ACCESS_ALLOW,
-            ),
-        ),
+			'_childRoles'             => array(
+				'public',
+			),
+			PagePreferences::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'refreshOAuth' => self::ACCESS_ALLOW,
+			),
+			PageChangePassword::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageMultiFactor::class    => array(
+				self::MAIN          => self::ACCESS_ALLOW,
+				'scratch'           => self::ACCESS_ALLOW,
+				'enableYubikeyOtp'  => self::ACCESS_ALLOW,
+				'disableYubikeyOtp' => self::ACCESS_ALLOW,
+				'enableTotp'        => self::ACCESS_ALLOW,
+				'disableTotp'       => self::ACCESS_ALLOW,
+			),
+			PageOAuth::class          => array(
+				'attach' => self::ACCESS_ALLOW,
+				'detach' => self::ACCESS_ALLOW,
+			),
+		),
+		'user'              => array(
+			'_description'                       => 'A standard tool user.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'internalStats',
+			),
+			PageMain::class                      => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBan::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageEmailManagement::class           => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageExpandedRequestList::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageLog::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSearch::class                    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'select'   => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageViewRequest::class               => array(
+				self::MAIN       => self::ACCESS_ALLOW,
+				'seeAllRequests' => self::ACCESS_ALLOW,
+			),
+			'RequestData'                        => array(
+				'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
+				'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
+				'seeRelatedRequests'         => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageComment::class                   => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCloseRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCreateRequest::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDeferRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDropRequest::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageReservation::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSendToUser::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class          => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+				'all'      => self::ACCESS_ALLOW,
+			),
+			'RequestCreation'                    => array(
+				User::CREATION_MANUAL => self::ACCESS_ALLOW,
+			),
+			'GlobalInfo'                         => array(
+				'viewSiteNotice' => self::ACCESS_ALLOW,
+				'viewOnlineUsers' => self::ACCESS_ALLOW,
+			),
+		),
+		'admin'             => array(
+			'_description'                       => 'A tool administrator.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageEmailManagement::class           => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'create' => self::ACCESS_ALLOW,
+			),
+			PageSiteNotice::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageUserManagement::class            => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'approve'   => self::ACCESS_ALLOW,
+				'decline'   => self::ACCESS_ALLOW,
+				'rename'    => self::ACCESS_ALLOW,
+				'editUser'  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'delete' => self::ACCESS_ALLOW,
+				'add'    => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				'acknowledge' => self::ACCESS_ALLOW,
+				'requeue'     => self::ACCESS_ALLOW,
+			),
+		),
+		'checkuser'         => array(
+			'_description'            => 'A user with CheckUser access',
+			'_editableBy'             => array('checkuser', 'toolRoot'),
+			'_childRoles'             => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageUserManagement::class => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			'RequestData'             => array(
+				'seeUserAgentData' => self::ACCESS_ALLOW,
+			),
+		),
+		'toolRoot'          => array(
+			'_description' => 'A user with shell access to the servers running the tool',
+			'_editableBy'  => array('toolRoot'),
+			'_childRoles'  => array(
+				'admin',
+			),
+			PageMultiFactor::class => array(
+				'enableU2F'         => self::ACCESS_ALLOW,
+				'disableU2F'        => self::ACCESS_ALLOW,
+			)
+		),
+		'botCreation'       => array(
+			'_description'    => 'A user allowed to use the bot to perform account creations',
+			'_editableBy'     => array('admin', 'toolRoot'),
+			'_childRoles'     => array(),
+			'RequestCreation' => array(
+				User::CREATION_BOT => self::ACCESS_ALLOW,
+			),
+		),
+		'oauthCreation'       => array(
+			'_description'    => 'A user allowed to use the OAuth to perform account creations',
+			'_editableBy'     => array('admin', 'toolRoot'),
+			'_childRoles'     => array(),
+			'RequestCreation'                    => array(
+				User::CREATION_OAUTH  => self::ACCESS_ALLOW,
+			),
+		),
 
 
-        // Child roles go below this point
-        'publicStats'       => array(
-            '_hidden'               => true,
-            StatsUsers::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'detail'   => self::ACCESS_ALLOW,
-            ),
-            StatsTopCreators::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'internalStats'     => array(
-            '_hidden'                    => true,
-            StatsMain::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsFastCloses::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsInactiveUsers::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsMonthlyStats::class     => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsReservedRequests::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsTemplateStats::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'requestAdminTools' => array(
-            '_hidden'                   => true,
-            PageBan::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'set'      => self::ACCESS_ALLOW,
-                'remove'   => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class      => array(
-                'editOthers' => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class => array(
-                'force' => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class      => array(
-                'skipCcMailingList' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'               => array(
-                'reopenOldRequest'      => self::ACCESS_ALLOW,
-                'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
-                'alwaysSeeHash'         => self::ACCESS_ALLOW,
-                'seeRestrictedComments' => self::ACCESS_ALLOW,
-            ),
-        ),
-    );
-    /** @var array
-     * List of roles which are *exempt* from the identification requirements
-     *
-     * Think twice about adding roles to this list.
-     *
-     * @category Security-Critical
-     */
-    private $identificationExempt = array('public', 'loggedIn');
+		// Child roles go below this point
+		'publicStats'       => array(
+			'_hidden'               => true,
+			StatsUsers::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'detail'   => self::ACCESS_ALLOW,
+			),
+			StatsTopCreators::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'internalStats'     => array(
+			'_hidden'                    => true,
+			StatsMain::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsFastCloses::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsInactiveUsers::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsMonthlyStats::class     => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsReservedRequests::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsTemplateStats::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'requestAdminTools' => array(
+			'_hidden'                   => true,
+			PageBan::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'set'      => self::ACCESS_ALLOW,
+				'remove'   => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class      => array(
+				'editOthers' => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class => array(
+				'force' => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class      => array(
+				'skipCcMailingList' => self::ACCESS_ALLOW,
+			),
+			'RequestData'               => array(
+				'reopenOldRequest'      => self::ACCESS_ALLOW,
+				'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
+				'alwaysSeeHash'         => self::ACCESS_ALLOW,
+				'seeRestrictedComments' => self::ACCESS_ALLOW,
+			),
+		),
+	);
+	/** @var array
+	 * List of roles which are *exempt* from the identification requirements
+	 *
+	 * Think twice about adding roles to this list.
+	 *
+	 * @category Security-Critical
+	 */
+	private $identificationExempt = array('public', 'loggedIn');
 
-    /**
-     * RoleConfiguration constructor.
-     *
-     * @param array $roleConfig           Set to non-null to override the default configuration.
-     * @param array $identificationExempt Set to non-null to override the default configuration.
-     */
-    public function __construct(array $roleConfig = null, array $identificationExempt = null)
-    {
-        if ($roleConfig !== null) {
-            $this->roleConfig = $roleConfig;
-        }
+	/**
+	 * RoleConfiguration constructor.
+	 *
+	 * @param array $roleConfig           Set to non-null to override the default configuration.
+	 * @param array $identificationExempt Set to non-null to override the default configuration.
+	 */
+	public function __construct(array $roleConfig = null, array $identificationExempt = null)
+	{
+		if ($roleConfig !== null) {
+			$this->roleConfig = $roleConfig;
+		}
 
-        if ($identificationExempt !== null) {
-            $this->identificationExempt = $identificationExempt;
-        }
-    }
+		if ($identificationExempt !== null) {
+			$this->identificationExempt = $identificationExempt;
+		}
+	}
 
-    /**
-     * @param array $roles The roles to check
-     *
-     * @return array
-     */
-    public function getApplicableRoles(array $roles)
-    {
-        $available = array();
+	/**
+	 * @param array $roles The roles to check
+	 *
+	 * @return array
+	 */
+	public function getApplicableRoles(array $roles)
+	{
+		$available = array();
 
-        foreach ($roles as $role) {
-            if (!isset($this->roleConfig[$role])) {
-                // wat
-                continue;
-            }
+		foreach ($roles as $role) {
+			if (!isset($this->roleConfig[$role])) {
+				// wat
+				continue;
+			}
 
-            $available[$role] = $this->roleConfig[$role];
+			$available[$role] = $this->roleConfig[$role];
 
-            if (isset($available[$role]['_childRoles'])) {
-                $childRoles = $this->getApplicableRoles($available[$role]['_childRoles']);
-                $available = array_merge($available, $childRoles);
+			if (isset($available[$role]['_childRoles'])) {
+				$childRoles = $this->getApplicableRoles($available[$role]['_childRoles']);
+				$available = array_merge($available, $childRoles);
 
-                unset($available[$role]['_childRoles']);
-            }
+				unset($available[$role]['_childRoles']);
+			}
 
-            foreach (array('_hidden', '_editableBy', '_description') as $item) {
-                if (isset($available[$role][$item])) {
-                    unset($available[$role][$item]);
-                }
-            }
-        }
+			foreach (array('_hidden', '_editableBy', '_description') as $item) {
+				if (isset($available[$role][$item])) {
+					unset($available[$role][$item]);
+				}
+			}
+		}
 
-        return $available;
-    }
+		return $available;
+	}
 
-    public function getAvailableRoles()
-    {
-        $possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
+	public function getAvailableRoles()
+	{
+		$possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
 
-        $actual = array();
+		$actual = array();
 
-        foreach ($possible as $role) {
-            if (!isset($this->roleConfig[$role]['_hidden'])) {
-                $actual[$role] = array(
-                    'description' => $this->roleConfig[$role]['_description'],
-                    'editableBy'  => $this->roleConfig[$role]['_editableBy'],
-                );
-            }
-        }
+		foreach ($possible as $role) {
+			if (!isset($this->roleConfig[$role]['_hidden'])) {
+				$actual[$role] = array(
+					'description' => $this->roleConfig[$role]['_description'],
+					'editableBy'  => $this->roleConfig[$role]['_editableBy'],
+				);
+			}
+		}
 
-        return $actual;
-    }
+		return $actual;
+	}
 
-    /**
-     * @param string $role
-     *
-     * @return bool
-     */
-    public function roleNeedsIdentification($role)
-    {
-        if (in_array($role, $this->identificationExempt)) {
-            return false;
-        }
+	/**
+	 * @param string $role
+	 *
+	 * @return bool
+	 */
+	public function roleNeedsIdentification($role)
+	{
+		if (in_array($role, $this->identificationExempt)) {
+			return false;
+		}
 
-        return true;
-    }
+		return true;
+	}
 }

includes/Pages/UserAuth/MultiFactor/PageMultiFactor.php

Indentation +389 added lines, -389 removed lines

@@ -27,249 +27,249 @@ 
 
 class PageMultiFactor extends InternalPageBase
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     * @return void
-     */
-    protected function main()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $yubikeyOtpCredentialProvider = new YubikeyOtpCredentialProvider($database, $this->getSiteConfiguration(),
-            $this->getHttpHelper());
-        $this->assign('yubikeyOtpIdentity', $yubikeyOtpCredentialProvider->getYubikeyData($currentUser->getId()));
-        $this->assign('yubikeyOtpEnrolled', $yubikeyOtpCredentialProvider->userIsEnrolled($currentUser->getId()));
-
-        $totpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
-        $this->assign('totpEnrolled', $totpCredentialProvider->userIsEnrolled($currentUser->getId()));
-
-        $u2fCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
-        $this->assign('u2fEnrolled', $u2fCredentialProvider->userIsEnrolled($currentUser->getId()));
-
-        $scratchCredentialProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
-        $this->assign('scratchEnrolled', $scratchCredentialProvider->userIsEnrolled($currentUser->getId()));
-        $this->assign('scratchRemaining', $scratchCredentialProvider->getRemaining($currentUser->getId()));
-
-        $this->assign('allowedTotp', $this->barrierTest('enableTotp', $currentUser));
-        $this->assign('allowedYubikey', $this->barrierTest('enableYubikeyOtp', $currentUser));
-        $this->assign('allowedU2f', $this->barrierTest('enableU2F', $currentUser));
-
-        $this->setTemplate('mfa/mfa.tpl');
-    }
-
-    protected function enableYubikeyOtp()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $otpCredentialProvider = new YubikeyOtpCredentialProvider($database,
-            $this->getSiteConfiguration(), $this->getHttpHelper());
-
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-
-            $passwordCredentialProvider = new PasswordCredentialProvider($database,
-                $this->getSiteConfiguration());
-
-            $password = WebRequest::postString('password');
-            $otp = WebRequest::postString('otp');
-
-            $result = $passwordCredentialProvider->authenticate($currentUser, $password);
-
-            if ($result) {
-                try {
-                    $otpCredentialProvider->setCredential($currentUser, 2, $otp);
-                    SessionAlert::success('Enabled YubiKey OTP.');
-
-                    $scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
-                    if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
-                        $scratchProvider->setCredential($currentUser, 2, null);
-                        $tokens = $scratchProvider->getTokens();
-                        $this->assign('tokens', $tokens);
-                        $this->setTemplate('mfa/regenScratchTokens.tpl');
-                        return;
-                    }
-                }
-                catch (ApplicationLogicException $ex) {
-                    SessionAlert::error('Error enabling YubiKey OTP: ' . $ex->getMessage());
-                }
-
-                $this->redirect('multiFactor');
-            }
-            else {
-                SessionAlert::error('Error enabling YubiKey OTP - invalid credentials.');
-                $this->redirect('multiFactor');
-            }
-        }
-        else {
-            if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
-                // user is not enrolled, we shouldn't have got here.
-                throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
-            }
-
-            $this->assignCSRFToken();
-            $this->setTemplate('mfa/enableYubikey.tpl');
-        }
-    }
-
-    protected function disableYubikeyOtp()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $otpCredentialProvider = new YubikeyOtpCredentialProvider($database,
-            $this->getSiteConfiguration(), $this->getHttpHelper());
-
-        $factorType = 'YubiKey OTP';
-
-        $this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
-    }
-
-    protected function enableTotp()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $otpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
-
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-
-            // used for routing only, not security
-            $stage = WebRequest::postString('stage');
-
-            if ($stage === "auth") {
-                $password = WebRequest::postString('password');
-
-                $passwordCredentialProvider = new PasswordCredentialProvider($database,
-                    $this->getSiteConfiguration());
-                $result = $passwordCredentialProvider->authenticate($currentUser, $password);
-
-                if ($result) {
-                    $otpCredentialProvider->setCredential($currentUser, 2, null);
-
-                    $provisioningUrl = $otpCredentialProvider->getProvisioningUrl($currentUser);
-
-                    $renderer = new ImageRenderer(
-                        new RendererStyle(256),
-                        new SvgImageBackEnd()
-                    );
-
-                    $writer = new Writer($renderer);
-                    $svg = $writer->writeString($provisioningUrl);
-
-                    $this->assign('svg', $svg);
-                    $this->assign('secret', $otpCredentialProvider->getSecret($currentUser));
-
-                    $this->assignCSRFToken();
-                    $this->setTemplate('mfa/enableTotpEnroll.tpl');
-
-                    return;
-                }
-                else {
-                    SessionAlert::error('Error enabling TOTP - invalid credentials.');
-                    $this->redirect('multiFactor');
-
-                    return;
-                }
-            }
-
-            if ($stage === "enroll") {
-                // we *must* have a defined credential already here,
-                if ($otpCredentialProvider->isPartiallyEnrolled($currentUser)) {
-                    $otp = WebRequest::postString('otp');
-                    $result = $otpCredentialProvider->verifyEnable($currentUser, $otp);
-
-                    if ($result) {
-                        SessionAlert::success('Enabled TOTP.');
-
-                        $scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
-                        if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
-                            $scratchProvider->setCredential($currentUser, 2, null);
-                            $tokens = $scratchProvider->getTokens();
-                            $this->assign('tokens', $tokens);
-                            $this->setTemplate('mfa/regenScratchTokens.tpl');
-                            return;
-                        }
-                    }
-                    else {
-                        $otpCredentialProvider->deleteCredential($currentUser);
-                        SessionAlert::error('Error enabling TOTP: invalid token provided');
-                    }
-
-
-                    $this->redirect('multiFactor');
-                    return;
-                }
-                else {
-                    SessionAlert::error('Error enabling TOTP - no enrollment found or enrollment expired.');
-                    $this->redirect('multiFactor');
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 * @return void
+	 */
+	protected function main()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$yubikeyOtpCredentialProvider = new YubikeyOtpCredentialProvider($database, $this->getSiteConfiguration(),
+			$this->getHttpHelper());
+		$this->assign('yubikeyOtpIdentity', $yubikeyOtpCredentialProvider->getYubikeyData($currentUser->getId()));
+		$this->assign('yubikeyOtpEnrolled', $yubikeyOtpCredentialProvider->userIsEnrolled($currentUser->getId()));
+
+		$totpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
+		$this->assign('totpEnrolled', $totpCredentialProvider->userIsEnrolled($currentUser->getId()));
+
+		$u2fCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
+		$this->assign('u2fEnrolled', $u2fCredentialProvider->userIsEnrolled($currentUser->getId()));
+
+		$scratchCredentialProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
+		$this->assign('scratchEnrolled', $scratchCredentialProvider->userIsEnrolled($currentUser->getId()));
+		$this->assign('scratchRemaining', $scratchCredentialProvider->getRemaining($currentUser->getId()));
+
+		$this->assign('allowedTotp', $this->barrierTest('enableTotp', $currentUser));
+		$this->assign('allowedYubikey', $this->barrierTest('enableYubikeyOtp', $currentUser));
+		$this->assign('allowedU2f', $this->barrierTest('enableU2F', $currentUser));
+
+		$this->setTemplate('mfa/mfa.tpl');
+	}
+
+	protected function enableYubikeyOtp()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$otpCredentialProvider = new YubikeyOtpCredentialProvider($database,
+			$this->getSiteConfiguration(), $this->getHttpHelper());
+
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+
+			$passwordCredentialProvider = new PasswordCredentialProvider($database,
+				$this->getSiteConfiguration());
+
+			$password = WebRequest::postString('password');
+			$otp = WebRequest::postString('otp');
+
+			$result = $passwordCredentialProvider->authenticate($currentUser, $password);
+
+			if ($result) {
+				try {
+					$otpCredentialProvider->setCredential($currentUser, 2, $otp);
+					SessionAlert::success('Enabled YubiKey OTP.');
+
+					$scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
+					if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
+						$scratchProvider->setCredential($currentUser, 2, null);
+						$tokens = $scratchProvider->getTokens();
+						$this->assign('tokens', $tokens);
+						$this->setTemplate('mfa/regenScratchTokens.tpl');
+						return;
+					}
+				}
+				catch (ApplicationLogicException $ex) {
+					SessionAlert::error('Error enabling YubiKey OTP: ' . $ex->getMessage());
+				}
+
+				$this->redirect('multiFactor');
+			}
+			else {
+				SessionAlert::error('Error enabling YubiKey OTP - invalid credentials.');
+				$this->redirect('multiFactor');
+			}
+		}
+		else {
+			if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
+				// user is not enrolled, we shouldn't have got here.
+				throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
+			}
+
+			$this->assignCSRFToken();
+			$this->setTemplate('mfa/enableYubikey.tpl');
+		}
+	}
+
+	protected function disableYubikeyOtp()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$otpCredentialProvider = new YubikeyOtpCredentialProvider($database,
+			$this->getSiteConfiguration(), $this->getHttpHelper());
+
+		$factorType = 'YubiKey OTP';
+
+		$this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
+	}
 
-                    return;
-                }
-            }
+	protected function enableTotp()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$otpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
+
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+
+			// used for routing only, not security
+			$stage = WebRequest::postString('stage');
+
+			if ($stage === "auth") {
+				$password = WebRequest::postString('password');
+
+				$passwordCredentialProvider = new PasswordCredentialProvider($database,
+					$this->getSiteConfiguration());
+				$result = $passwordCredentialProvider->authenticate($currentUser, $password);
+
+				if ($result) {
+					$otpCredentialProvider->setCredential($currentUser, 2, null);
+
+					$provisioningUrl = $otpCredentialProvider->getProvisioningUrl($currentUser);
+
+					$renderer = new ImageRenderer(
+						new RendererStyle(256),
+						new SvgImageBackEnd()
+					);
+
+					$writer = new Writer($renderer);
+					$svg = $writer->writeString($provisioningUrl);
+
+					$this->assign('svg', $svg);
+					$this->assign('secret', $otpCredentialProvider->getSecret($currentUser));
+
+					$this->assignCSRFToken();
+					$this->setTemplate('mfa/enableTotpEnroll.tpl');
+
+					return;
+				}
+				else {
+					SessionAlert::error('Error enabling TOTP - invalid credentials.');
+					$this->redirect('multiFactor');
+
+					return;
+				}
+			}
+
+			if ($stage === "enroll") {
+				// we *must* have a defined credential already here,
+				if ($otpCredentialProvider->isPartiallyEnrolled($currentUser)) {
+					$otp = WebRequest::postString('otp');
+					$result = $otpCredentialProvider->verifyEnable($currentUser, $otp);
+
+					if ($result) {
+						SessionAlert::success('Enabled TOTP.');
+
+						$scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
+						if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
+							$scratchProvider->setCredential($currentUser, 2, null);
+							$tokens = $scratchProvider->getTokens();
+							$this->assign('tokens', $tokens);
+							$this->setTemplate('mfa/regenScratchTokens.tpl');
+							return;
+						}
+					}
+					else {
+						$otpCredentialProvider->deleteCredential($currentUser);
+						SessionAlert::error('Error enabling TOTP: invalid token provided');
+					}
+
+
+					$this->redirect('multiFactor');
+					return;
+				}
+				else {
+					SessionAlert::error('Error enabling TOTP - no enrollment found or enrollment expired.');
+					$this->redirect('multiFactor');
+
+					return;
+				}
+			}
+
+			// urgh, dunno what happened, but it's not something expected.
+			throw new ApplicationLogicException();
+		}
+		else {
+			if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
+				// user is not enrolled, we shouldn't have got here.
+				throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
+			}
+
+			$this->assignCSRFToken();
+
+			$this->assign('alertmessage', 'To enable your multi-factor credentials, please prove you are who you say you are by providing the information below.');
+			$this->assign('alertheader', 'Provide credentials');
+			$this->assign('continueText', 'Verify password');
+			$this->setTemplate('mfa/enableAuth.tpl');
+		}
+	}
+
+	protected function disableTotp()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$otpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
+
+		$factorType = 'TOTP';
 
-            // urgh, dunno what happened, but it's not something expected.
-            throw new ApplicationLogicException();
-        }
-        else {
-            if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
-                // user is not enrolled, we shouldn't have got here.
-                throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
-            }
+		$this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
+	}
 
-            $this->assignCSRFToken();
+	protected function enableU2F() {
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
 
-            $this->assign('alertmessage', 'To enable your multi-factor credentials, please prove you are who you say you are by providing the information below.');
-            $this->assign('alertheader', 'Provide credentials');
-            $this->assign('continueText', 'Verify password');
-            $this->setTemplate('mfa/enableAuth.tpl');
-        }
-    }
+		$otpCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
 
-    protected function disableTotp()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
 
-        $otpCredentialProvider = new TotpCredentialProvider($database, $this->getSiteConfiguration());
+			// used for routing only, not security
+			$stage = WebRequest::postString('stage');
 
-        $factorType = 'TOTP';
+			if ($stage === "auth") {
+				$password = WebRequest::postString('password');
 
-        $this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
-    }
+				$passwordCredentialProvider = new PasswordCredentialProvider($database,
+					$this->getSiteConfiguration());
+				$result = $passwordCredentialProvider->authenticate($currentUser, $password);
 
-    protected function enableU2F() {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
+				if ($result) {
+					$otpCredentialProvider->setCredential($currentUser, 2, null);
+					$this->assignCSRFToken();
 
-        $otpCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
+					list($data, $reqs) = $otpCredentialProvider->getRegistrationData();
 
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
+					$u2fRequest =json_encode($data);
+					$u2fSigns = json_encode($reqs);
 
-            // used for routing only, not security
-            $stage = WebRequest::postString('stage');
-
-            if ($stage === "auth") {
-                $password = WebRequest::postString('password');
-
-                $passwordCredentialProvider = new PasswordCredentialProvider($database,
-                    $this->getSiteConfiguration());
-                $result = $passwordCredentialProvider->authenticate($currentUser, $password);
-
-                if ($result) {
-                    $otpCredentialProvider->setCredential($currentUser, 2, null);
-                    $this->assignCSRFToken();
-
-                    list($data, $reqs) = $otpCredentialProvider->getRegistrationData();
-
-                    $u2fRequest =json_encode($data);
-                    $u2fSigns = json_encode($reqs);
-
-                    $this->addJs('/vendor/yubico/u2flib-server/examples/assets/u2f-api.js');
-                    $this->setTailScript($this->getCspManager()->getNonce(), <<<JS
+					$this->addJs('/vendor/yubico/u2flib-server/examples/assets/u2f-api.js');
+					$this->setTailScript($this->getCspManager()->getNonce(), <<<JS
 var request = ${u2fRequest};
 var signs = ${u2fSigns};
 
@@ -288,162 +288,162 @@ 
 	form.submit();
 });
 JS
-                    );
-
-                    $this->setTemplate('mfa/enableU2FEnroll.tpl');
-
-                    return;
-                }
-                else {
-                    SessionAlert::error('Error enabling TOTP - invalid credentials.');
-                    $this->redirect('multiFactor');
-
-                    return;
-                }
-            }
-
-            if ($stage === "enroll") {
-                // we *must* have a defined credential already here,
-                if ($otpCredentialProvider->isPartiallyEnrolled($currentUser)) {
-
-                    $request = json_decode(WebRequest::postString('u2fRequest'));
-                    $u2fData = json_decode(WebRequest::postString('u2fData'));
-
-                    $otpCredentialProvider->enable($currentUser, $request, $u2fData);
-
-                    SessionAlert::success('Enabled U2F.');
-
-                    $scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
-                    if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
-                        $scratchProvider->setCredential($currentUser, 2, null);
-                        $tokens = $scratchProvider->getTokens();
-                        $this->assign('tokens', $tokens);
-                        $this->setTemplate('mfa/regenScratchTokens.tpl');
-                        return;
-                    }
-
-                    $this->redirect('multiFactor');
-                    return;
-                }
-                else {
-                    SessionAlert::error('Error enabling TOTP - no enrollment found or enrollment expired.');
-                    $this->redirect('multiFactor');
-
-                    return;
-                }
-            }
-
-            // urgh, dunno what happened, but it's not something expected.
-            throw new ApplicationLogicException();
-        }
-        else {
-            if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
-                // user is not enrolled, we shouldn't have got here.
-                throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
-            }
-
-            $this->assignCSRFToken();
-
-            $this->assign('alertmessage', 'To enable your multi-factor credentials, please prove you are who you say you are by providing the information below.');
-            $this->assign('alertheader', 'Provide credentials');
-            $this->assign('continueText', 'Verify password');
-            $this->setTemplate('mfa/enableAuth.tpl');
-        }
-    }
-
-    protected function disableU2F() {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $otpCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
-
-        $factorType = 'U2F';
-
-        $this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
-    }
-
-    protected function scratch()
-    {
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-
-            $passwordCredentialProvider = new PasswordCredentialProvider($database,
-                $this->getSiteConfiguration());
-
-            $otpCredentialProvider = new ScratchTokenCredentialProvider($database,
-                $this->getSiteConfiguration());
-
-            $password = WebRequest::postString('password');
-
-            $result = $passwordCredentialProvider->authenticate($currentUser, $password);
-
-            if ($result) {
-                $otpCredentialProvider->setCredential($currentUser, 2, null);
-                $tokens = $otpCredentialProvider->getTokens();
-                $this->assign('tokens', $tokens);
-                $this->setTemplate('mfa/regenScratchTokens.tpl');
-            }
-            else {
-                SessionAlert::error('Error refreshing scratch tokens - invalid credentials.');
-                $this->redirect('multiFactor');
-            }
-        }
-        else {
-            $this->assignCSRFToken();
-
-            $this->assign('alertmessage', 'To regenerate your emergency scratch tokens, please prove you are who you say you are by providing the information below. Note that continuing will invalidate all remaining scratch tokens, and provide a set of new ones.');
-            $this->assign('alertheader', 'Re-generate scratch tokens');
-            $this->assign('continueText', 'Regenerate Scratch Tokens');
-
-            $this->setTemplate('mfa/enableAuth.tpl');
-        }
-    }
-
-    /**
-     * @param PdoDatabase         $database
-     * @param User                $currentUser
-     * @param ICredentialProvider $otpCredentialProvider
-     * @param string              $factorType
-     *
-     * @throws ApplicationLogicException
-     */
-    private function deleteCredential(
-        PdoDatabase $database,
-        User $currentUser,
-        ICredentialProvider $otpCredentialProvider,
-        $factorType
-    ) {
-        if (WebRequest::wasPosted()) {
-            $passwordCredentialProvider = new PasswordCredentialProvider($database,
-                $this->getSiteConfiguration());
-
-            $this->validateCSRFToken();
-
-            $password = WebRequest::postString('password');
-            $result = $passwordCredentialProvider->authenticate($currentUser, $password);
-
-            if ($result) {
-                $otpCredentialProvider->deleteCredential($currentUser);
-                SessionAlert::success('Disabled ' . $factorType . '.');
-                $this->redirect('multiFactor');
-            }
-            else {
-                SessionAlert::error('Error disabling ' . $factorType . ' - invalid credentials.');
-                $this->redirect('multiFactor');
-            }
-        }
-        else {
-            if (!$otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
-                // user is not enrolled, we shouldn't have got here.
-                throw new ApplicationLogicException('User is not enrolled in the selected MFA mechanism');
-            }
-
-            $this->assignCSRFToken();
-            $this->assign('otpType', $factorType);
-            $this->setTemplate('mfa/disableOtp.tpl');
-        }
-    }
+					);
+
+					$this->setTemplate('mfa/enableU2FEnroll.tpl');
+
+					return;
+				}
+				else {
+					SessionAlert::error('Error enabling TOTP - invalid credentials.');
+					$this->redirect('multiFactor');
+
+					return;
+				}
+			}
+
+			if ($stage === "enroll") {
+				// we *must* have a defined credential already here,
+				if ($otpCredentialProvider->isPartiallyEnrolled($currentUser)) {
+
+					$request = json_decode(WebRequest::postString('u2fRequest'));
+					$u2fData = json_decode(WebRequest::postString('u2fData'));
+
+					$otpCredentialProvider->enable($currentUser, $request, $u2fData);
+
+					SessionAlert::success('Enabled U2F.');
+
+					$scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
+					if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
+						$scratchProvider->setCredential($currentUser, 2, null);
+						$tokens = $scratchProvider->getTokens();
+						$this->assign('tokens', $tokens);
+						$this->setTemplate('mfa/regenScratchTokens.tpl');
+						return;
+					}
+
+					$this->redirect('multiFactor');
+					return;
+				}
+				else {
+					SessionAlert::error('Error enabling TOTP - no enrollment found or enrollment expired.');
+					$this->redirect('multiFactor');
+
+					return;
+				}
+			}
+
+			// urgh, dunno what happened, but it's not something expected.
+			throw new ApplicationLogicException();
+		}
+		else {
+			if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
+				// user is not enrolled, we shouldn't have got here.
+				throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
+			}
+
+			$this->assignCSRFToken();
+
+			$this->assign('alertmessage', 'To enable your multi-factor credentials, please prove you are who you say you are by providing the information below.');
+			$this->assign('alertheader', 'Provide credentials');
+			$this->assign('continueText', 'Verify password');
+			$this->setTemplate('mfa/enableAuth.tpl');
+		}
+	}
+
+	protected function disableU2F() {
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$otpCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());
+
+		$factorType = 'U2F';
+
+		$this->deleteCredential($database, $currentUser, $otpCredentialProvider, $factorType);
+	}
+
+	protected function scratch()
+	{
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+
+			$passwordCredentialProvider = new PasswordCredentialProvider($database,
+				$this->getSiteConfiguration());
+
+			$otpCredentialProvider = new ScratchTokenCredentialProvider($database,
+				$this->getSiteConfiguration());
+
+			$password = WebRequest::postString('password');
+
+			$result = $passwordCredentialProvider->authenticate($currentUser, $password);
+
+			if ($result) {
+				$otpCredentialProvider->setCredential($currentUser, 2, null);
+				$tokens = $otpCredentialProvider->getTokens();
+				$this->assign('tokens', $tokens);
+				$this->setTemplate('mfa/regenScratchTokens.tpl');
+			}
+			else {
+				SessionAlert::error('Error refreshing scratch tokens - invalid credentials.');
+				$this->redirect('multiFactor');
+			}
+		}
+		else {
+			$this->assignCSRFToken();
+
+			$this->assign('alertmessage', 'To regenerate your emergency scratch tokens, please prove you are who you say you are by providing the information below. Note that continuing will invalidate all remaining scratch tokens, and provide a set of new ones.');
+			$this->assign('alertheader', 'Re-generate scratch tokens');
+			$this->assign('continueText', 'Regenerate Scratch Tokens');
+
+			$this->setTemplate('mfa/enableAuth.tpl');
+		}
+	}
+
+	/**
+	 * @param PdoDatabase         $database
+	 * @param User                $currentUser
+	 * @param ICredentialProvider $otpCredentialProvider
+	 * @param string              $factorType
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	private function deleteCredential(
+		PdoDatabase $database,
+		User $currentUser,
+		ICredentialProvider $otpCredentialProvider,
+		$factorType
+	) {
+		if (WebRequest::wasPosted()) {
+			$passwordCredentialProvider = new PasswordCredentialProvider($database,
+				$this->getSiteConfiguration());
+
+			$this->validateCSRFToken();
+
+			$password = WebRequest::postString('password');
+			$result = $passwordCredentialProvider->authenticate($currentUser, $password);
+
+			if ($result) {
+				$otpCredentialProvider->deleteCredential($currentUser);
+				SessionAlert::success('Disabled ' . $factorType . '.');
+				$this->redirect('multiFactor');
+			}
+			else {
+				SessionAlert::error('Error disabling ' . $factorType . ' - invalid credentials.');
+				$this->redirect('multiFactor');
+			}
+		}
+		else {
+			if (!$otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
+				// user is not enrolled, we shouldn't have got here.
+				throw new ApplicationLogicException('User is not enrolled in the selected MFA mechanism');
+			}
+
+			$this->assignCSRFToken();
+			$this->assign('otpType', $factorType);
+			$this->setTemplate('mfa/disableOtp.tpl');
+		}
+	}
 }