Mercurial > hg > vamp-website

annotate forum/Sources/Reminder.php @ 76:e3e11437ecea website

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add forum code
author Chris Cannam
date Sun, 07 Jul 2013 11:25:48 +0200
parents
children
rev   line source
Chris@76 1 <?php
Chris@76 2
Chris@76 3 /**
Chris@76 4 * Simple Machines Forum (SMF)
Chris@76 5 *
Chris@76 6 * @package SMF
Chris@76 7 * @author Simple Machines http://www.simplemachines.org
Chris@76 8 * @copyright 2011 Simple Machines
Chris@76 9 * @license http://www.simplemachines.org/about/smf/license.php BSD
Chris@76 10 *
Chris@76 11 * @version 2.0.4
Chris@76 12 */
Chris@76 13
Chris@76 14 if (!defined('SMF'))
Chris@76 15 die('Hacking attempt...');
Chris@76 16
Chris@76 17 /* This file deals with sending out reminders, and checking the secret answer
Chris@76 18 and question. It uses just a few functions to do this, which are:
Chris@76 19
Chris@76 20 void RemindMe()
Chris@76 21 - this is just the controlling delegator.
Chris@76 22 - uses the Profile language files and Reminder template.
Chris@76 23
Chris@76 24 void RemindMail()
Chris@76 25 // !!!
Chris@76 26
Chris@76 27 void setPassword()
Chris@76 28 // !!!
Chris@76 29
Chris@76 30 void setPassword2()
Chris@76 31 // !!!
Chris@76 32
Chris@76 33 void SecretAnswerInput()
Chris@76 34 // !!!
Chris@76 35
Chris@76 36 void SecretAnswer2()
Chris@76 37 // !!!
Chris@76 38 */
Chris@76 39
Chris@76 40 // Forgot 'yer password?
Chris@76 41 function RemindMe()
Chris@76 42 {
Chris@76 43 global $txt, $context;
Chris@76 44
Chris@76 45 loadLanguage('Profile');
Chris@76 46 loadTemplate('Reminder');
Chris@76 47
Chris@76 48 $context['page_title'] = $txt['authentication_reminder'];
Chris@76 49 $context['robot_no_index'] = true;
Chris@76 50
Chris@76 51 // Delegation can be useful sometimes.
Chris@76 52 $subActions = array(
Chris@76 53 'picktype' => 'RemindPick',
Chris@76 54 'secret2' => 'SecretAnswer2',
Chris@76 55 'setpassword' =>'setPassword',
Chris@76 56 'setpassword2' =>'setPassword2'
Chris@76 57 );
Chris@76 58
Chris@76 59 // Any subaction? If none, fall through to the main template, which will ask for one.
Chris@76 60 if (isset($_REQUEST['sa']) && isset($subActions[$_REQUEST['sa']]))
Chris@76 61 $subActions[$_REQUEST['sa']]();
Chris@76 62 }
Chris@76 63
Chris@76 64 // Pick a reminder type.
Chris@76 65 function RemindPick()
Chris@76 66 {
Chris@76 67 global $context, $txt, $scripturl, $sourcedir, $user_info, $webmaster_email, $smcFunc, $language, $modSettings;
Chris@76 68
Chris@76 69 checkSession();
Chris@76 70
Chris@76 71 // Coming with a known ID?
Chris@76 72 if (!empty($_REQUEST['uid']))
Chris@76 73 {
Chris@76 74 $where = 'id_member = {int:id_member}';
Chris@76 75 $where_params['id_member'] = (int) $_REQUEST['uid'];
Chris@76 76 }
Chris@76 77 elseif (isset($_POST['user']) && $_POST['user'] != '')
Chris@76 78 {
Chris@76 79 $where = 'member_name = {string:member_name}';
Chris@76 80 $where_params['member_name'] = $_POST['user'];
Chris@76 81 $where_params['email_address'] = $_POST['user'];
Chris@76 82 }
Chris@76 83
Chris@76 84 // You must enter a username/email address.
Chris@76 85 if (empty($where))
Chris@76 86 fatal_lang_error('username_no_exist', false);
Chris@76 87
Chris@76 88 // Find the user!
Chris@76 89 $request = $smcFunc['db_query']('', '
Chris@76 90 SELECT id_member, real_name, member_name, email_address, is_activated, validation_code, lngfile, openid_uri, secret_question
Chris@76 91 FROM {db_prefix}members
Chris@76 92 WHERE ' . $where . '
Chris@76 93 LIMIT 1',
Chris@76 94 array_merge($where_params, array(
Chris@76 95 ))
Chris@76 96 );
Chris@76 97 // Maybe email?
Chris@76 98 if ($smcFunc['db_num_rows']($request) == 0 && empty($_REQUEST['uid']))
Chris@76 99 {
Chris@76 100 $smcFunc['db_free_result']($request);
Chris@76 101
Chris@76 102 $request = $smcFunc['db_query']('', '
Chris@76 103 SELECT id_member, real_name, member_name, email_address, is_activated, validation_code, lngfile, openid_uri, secret_question
Chris@76 104 FROM {db_prefix}members
Chris@76 105 WHERE email_address = {string:email_address}
Chris@76 106 LIMIT 1',
Chris@76 107 array_merge($where_params, array(
Chris@76 108 ))
Chris@76 109 );
Chris@76 110 if ($smcFunc['db_num_rows']($request) == 0)
Chris@76 111 fatal_lang_error('no_user_with_email', false);
Chris@76 112 }
Chris@76 113
Chris@76 114 $row = $smcFunc['db_fetch_assoc']($request);
Chris@76 115 $smcFunc['db_free_result']($request);
Chris@76 116
Chris@76 117 $context['account_type'] = !empty($row['openid_uri']) ? 'openid' : 'password';
Chris@76 118
Chris@76 119 // If the user isn't activated/approved, give them some feedback on what to do next.
Chris@76 120 if ($row['is_activated'] != 1)
Chris@76 121 {
Chris@76 122 // Awaiting approval...
Chris@76 123 if (trim($row['validation_code']) == '')
Chris@76 124 fatal_error($txt['registration_not_approved'] . ' <a href="' . $scripturl . '?action=activate;user=' . $_POST['user'] . '">' . $txt['here'] . '</a>.', false);
Chris@76 125 else
Chris@76 126 fatal_error($txt['registration_not_activated'] . ' <a href="' . $scripturl . '?action=activate;user=' . $_POST['user'] . '">' . $txt['here'] . '</a>.', false);
Chris@76 127 }
Chris@76 128
Chris@76 129 // You can't get emailed if you have no email address.
Chris@76 130 $row['email_address'] = trim($row['email_address']);
Chris@76 131 if ($row['email_address'] == '')
Chris@76 132 fatal_error($txt['no_reminder_email'] . '<br />' . $txt['send_email'] . ' <a href="mailto:' . $webmaster_email . '">webmaster</a> ' . $txt['to_ask_password'] . '.');
Chris@76 133
Chris@76 134 // If they have no secret question then they can only get emailed the item, or they are requesting the email, send them an email.
Chris@76 135 if (empty($row['secret_question']) || (isset($_POST['reminder_type']) && $_POST['reminder_type'] == 'email'))
Chris@76 136 {
Chris@76 137 // Randomly generate a new password, with only alpha numeric characters that is a max length of 10 chars.
Chris@76 138 require_once($sourcedir . '/Subs-Members.php');
Chris@76 139 $password = generateValidationCode();
Chris@76 140
Chris@76 141 require_once($sourcedir . '/Subs-Post.php');
Chris@76 142 $replacements = array(
Chris@76 143 'REALNAME' => $row['real_name'],
Chris@76 144 'REMINDLINK' => $scripturl . '?action=reminder;sa=setpassword;u=' . $row['id_member'] . ';code=' . $password,
Chris@76 145 'IP' => $user_info['ip'],
Chris@76 146 'MEMBERNAME' => $row['member_name'],
Chris@76 147 'OPENID' => $row['openid_uri'],
Chris@76 148 );
Chris@76 149
Chris@76 150 $emaildata = loadEmailTemplate('forgot_' . $context['account_type'], $replacements, empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile']);
Chris@76 151 $context['description'] = $txt['reminder_' . (!empty($row['openid_uri']) ? 'openid_' : '') . 'sent'];
Chris@76 152
Chris@76 153 // If they were using OpenID simply email them their OpenID identity.
Chris@76 154 sendmail($row['email_address'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
Chris@76 155 if (empty($row['openid_uri']))
Chris@76 156 // Set the password in the database.
Chris@76 157 updateMemberData($row['id_member'], array('validation_code' => substr(md5($password), 0, 10)));
Chris@76 158
Chris@76 159 // Set up the template.
Chris@76 160 $context['sub_template'] = 'sent';
Chris@76 161
Chris@76 162 // Dont really.
Chris@76 163 return;
Chris@76 164 }
Chris@76 165 // Otherwise are ready to answer the question?
Chris@76 166 elseif (isset($_POST['reminder_type']) && $_POST['reminder_type'] == 'secret')
Chris@76 167 {
Chris@76 168 return SecretAnswerInput();
Chris@76 169 }
Chris@76 170
Chris@76 171 // No we're here setup the context for template number 2!
Chris@76 172 $context['sub_template'] = 'reminder_pick';
Chris@76 173 $context['current_member'] = array(
Chris@76 174 'id' => $row['id_member'],
Chris@76 175 'name' => $row['member_name'],
Chris@76 176 );
Chris@76 177 }
Chris@76 178
Chris@76 179 // Set your new password
Chris@76 180 function setPassword()
Chris@76 181 {
Chris@76 182 global $txt, $context;
Chris@76 183
Chris@76 184 loadLanguage('Login');
Chris@76 185
Chris@76 186 // You need a code!
Chris@76 187 if (!isset($_REQUEST['code']))
Chris@76 188 fatal_lang_error('no_access', false);
Chris@76 189
Chris@76 190 // Fill the context array.
Chris@76 191 $context += array(
Chris@76 192 'page_title' => $txt['reminder_set_password'],
Chris@76 193 'sub_template' => 'set_password',
Chris@76 194 'code' => $_REQUEST['code'],
Chris@76 195 'memID' => (int) $_REQUEST['u']
Chris@76 196 );
Chris@76 197 }
Chris@76 198
Chris@76 199 function setPassword2()
Chris@76 200 {
Chris@76 201 global $context, $txt, $modSettings, $smcFunc, $sourcedir;
Chris@76 202
Chris@76 203 checkSession();
Chris@76 204
Chris@76 205 if (empty($_POST['u']) || !isset($_POST['passwrd1']) || !isset($_POST['passwrd2']))
Chris@76 206 fatal_lang_error('no_access', false);
Chris@76 207
Chris@76 208 $_POST['u'] = (int) $_POST['u'];
Chris@76 209
Chris@76 210 if ($_POST['passwrd1'] != $_POST['passwrd2'])
Chris@76 211 fatal_lang_error('passwords_dont_match', false);
Chris@76 212
Chris@76 213 if ($_POST['passwrd1'] == '')
Chris@76 214 fatal_lang_error('no_password', false);
Chris@76 215
Chris@76 216 loadLanguage('Login');
Chris@76 217
Chris@76 218 // Get the code as it should be from the database.
Chris@76 219 $request = $smcFunc['db_query']('', '
Chris@76 220 SELECT validation_code, member_name, email_address, passwd_flood
Chris@76 221 FROM {db_prefix}members
Chris@76 222 WHERE id_member = {int:id_member}
Chris@76 223 AND is_activated = {int:is_activated}
Chris@76 224 AND validation_code != {string:blank_string}
Chris@76 225 LIMIT 1',
Chris@76 226 array(
Chris@76 227 'id_member' => $_POST['u'],
Chris@76 228 'is_activated' => 1,
Chris@76 229 'blank_string' => '',
Chris@76 230 )
Chris@76 231 );
Chris@76 232
Chris@76 233 // Does this user exist at all?
Chris@76 234 if ($smcFunc['db_num_rows']($request) == 0)
Chris@76 235 fatal_lang_error('invalid_userid', false);
Chris@76 236
Chris@76 237 list ($realCode, $username, $email, $flood_value) = $smcFunc['db_fetch_row']($request);
Chris@76 238 $smcFunc['db_free_result']($request);
Chris@76 239
Chris@76 240 // Is the password actually valid?
Chris@76 241 require_once($sourcedir . '/Subs-Auth.php');
Chris@76 242 $passwordError = validatePassword($_POST['passwrd1'], $username, array($email));
Chris@76 243
Chris@76 244 // What - it's not?
Chris@76 245 if ($passwordError != null)
Chris@76 246 fatal_lang_error('profile_error_password_' . $passwordError, false);
Chris@76 247
Chris@76 248 require_once($sourcedir . '/LogInOut.php');
Chris@76 249
Chris@76 250 // Quit if this code is not right.
Chris@76 251 if (empty($_POST['code']) || substr($realCode, 0, 10) !== substr(md5($_POST['code']), 0, 10))
Chris@76 252 {
Chris@76 253 // Stop brute force attacks like this.
Chris@76 254 validatePasswordFlood($_POST['u'], $flood_value, false);
Chris@76 255
Chris@76 256 fatal_error($txt['invalid_activation_code'], false);
Chris@76 257 }
Chris@76 258
Chris@76 259 // Just in case, flood control.
Chris@76 260 validatePasswordFlood($_POST['u'], $flood_value, true);
Chris@76 261
Chris@76 262 // User validated. Update the database!
Chris@76 263 updateMemberData($_POST['u'], array('validation_code' => '', 'passwd' => sha1(strtolower($username) . $_POST['passwrd1'])));
Chris@76 264
Chris@76 265 call_integration_hook('integrate_reset_pass', array($username, $username, $_POST['passwrd1']));
Chris@76 266
Chris@76 267 loadTemplate('Login');
Chris@76 268 $context += array(
Chris@76 269 'page_title' => $txt['reminder_password_set'],
Chris@76 270 'sub_template' => 'login',
Chris@76 271 'default_username' => $username,
Chris@76 272 'default_password' => $_POST['passwrd1'],
Chris@76 273 'never_expire' => false,
Chris@76 274 'description' => $txt['reminder_password_set']
Chris@76 275 );
Chris@76 276 }
Chris@76 277
Chris@76 278 // Get the secret answer.
Chris@76 279 function SecretAnswerInput()
Chris@76 280 {
Chris@76 281 global $txt, $context, $smcFunc;
Chris@76 282
Chris@76 283 checkSession();
Chris@76 284
Chris@76 285 // Strings for the register auto javascript clever stuffy wuffy.
Chris@76 286 loadLanguage('Login');
Chris@76 287
Chris@76 288 // Check they entered something...
Chris@76 289 if (empty($_REQUEST['uid']))
Chris@76 290 fatal_lang_error('username_no_exist', false);
Chris@76 291
Chris@76 292 // Get the stuff....
Chris@76 293 $request = $smcFunc['db_query']('', '
Chris@76 294 SELECT id_member, real_name, member_name, secret_question, openid_uri
Chris@76 295 FROM {db_prefix}members
Chris@76 296 WHERE id_member = {int:id_member}
Chris@76 297 LIMIT 1',
Chris@76 298 array(
Chris@76 299 'id_member' => (int) $_REQUEST['uid'],
Chris@76 300 )
Chris@76 301 );
Chris@76 302 if ($smcFunc['db_num_rows']($request) == 0)
Chris@76 303 fatal_lang_error('username_no_exist', false);
Chris@76 304
Chris@76 305 $row = $smcFunc['db_fetch_assoc']($request);
Chris@76 306 $smcFunc['db_free_result']($request);
Chris@76 307
Chris@76 308 $context['account_type'] = !empty($row['openid_uri']) ? 'openid' : 'password';
Chris@76 309
Chris@76 310 // If there is NO secret question - then throw an error.
Chris@76 311 if (trim($row['secret_question']) == '')
Chris@76 312 fatal_lang_error('registration_no_secret_question', false);
Chris@76 313
Chris@76 314 // Ask for the answer...
Chris@76 315 $context['remind_user'] = $row['id_member'];
Chris@76 316 $context['remind_type'] = '';
Chris@76 317 $context['secret_question'] = $row['secret_question'];
Chris@76 318
Chris@76 319 $context['sub_template'] = 'ask';
Chris@76 320 }
Chris@76 321
Chris@76 322 function SecretAnswer2()
Chris@76 323 {
Chris@76 324 global $txt, $context, $modSettings, $smcFunc, $sourcedir;
Chris@76 325
Chris@76 326 checkSession();
Chris@76 327
Chris@76 328 // Hacker? How did you get this far without an email or username?
Chris@76 329 if (empty($_REQUEST['uid']))
Chris@76 330 fatal_lang_error('username_no_exist', false);
Chris@76 331
Chris@76 332 loadLanguage('Login');
Chris@76 333
Chris@76 334 // Get the information from the database.
Chris@76 335 $request = $smcFunc['db_query']('', '
Chris@76 336 SELECT id_member, real_name, member_name, secret_answer, secret_question, openid_uri, email_address
Chris@76 337 FROM {db_prefix}members
Chris@76 338 WHERE id_member = {int:id_member}
Chris@76 339 LIMIT 1',
Chris@76 340 array(
Chris@76 341 'id_member' => $_REQUEST['uid'],
Chris@76 342 )
Chris@76 343 );
Chris@76 344 if ($smcFunc['db_num_rows']($request) == 0)
Chris@76 345 fatal_lang_error('username_no_exist', false);
Chris@76 346
Chris@76 347 $row = $smcFunc['db_fetch_assoc']($request);
Chris@76 348 $smcFunc['db_free_result']($request);
Chris@76 349
Chris@76 350 // Check if the secret answer is correct.
Chris@76 351 if ($row['secret_question'] == '' || $row['secret_answer'] == '' || md5($_POST['secret_answer']) != $row['secret_answer'])
Chris@76 352 {
Chris@76 353 log_error(sprintf($txt['reminder_error'], $row['member_name']), 'user');
Chris@76 354 fatal_lang_error('incorrect_answer', false);
Chris@76 355 }
Chris@76 356
Chris@76 357 // If it's OpenID this is where the music ends.
Chris@76 358 if (!empty($row['openid_uri']))
Chris@76 359 {
Chris@76 360 $context['sub_template'] = 'sent';
Chris@76 361 $context['description'] = sprintf($txt['reminder_openid_is'], $row['openid_uri']);
Chris@76 362 return;
Chris@76 363 }
Chris@76 364
Chris@76 365 // You can't use a blank one!
Chris@76 366 if (strlen(trim($_POST['passwrd1'])) === 0)
Chris@76 367 fatal_lang_error('no_password', false);
Chris@76 368
Chris@76 369 // They have to be the same too.
Chris@76 370 if ($_POST['passwrd1'] != $_POST['passwrd2'])
Chris@76 371 fatal_lang_error('passwords_dont_match', false);
Chris@76 372
Chris@76 373 // Make sure they have a strong enough password.
Chris@76 374 require_once($sourcedir . '/Subs-Auth.php');
Chris@76 375 $passwordError = validatePassword($_POST['passwrd1'], $row['member_name'], array($row['email_address']));
Chris@76 376
Chris@76 377 // Invalid?
Chris@76 378 if ($passwordError != null)
Chris@76 379 fatal_lang_error('profile_error_password_' . $passwordError, false);
Chris@76 380
Chris@76 381 // Alright, so long as 'yer sure.
Chris@76 382 updateMemberData($row['id_member'], array('passwd' => sha1(strtolower($row['member_name']) . $_POST['passwrd1'])));
Chris@76 383
Chris@76 384 call_integration_hook('integrate_reset_pass', array($row['member_name'], $row['member_name'], $_POST['passwrd1']));
Chris@76 385
Chris@76 386 // Tell them it went fine.
Chris@76 387 loadTemplate('Login');
Chris@76 388 $context += array(
Chris@76 389 'page_title' => $txt['reminder_password_set'],
Chris@76 390 'sub_template' => 'login',
Chris@76 391 'default_username' => $row['member_name'],
Chris@76 392 'default_password' => $_POST['passwrd1'],
Chris@76 393 'never_expire' => false,
Chris@76 394 'description' => $txt['reminder_password_set']
Chris@76 395 );
Chris@76 396 }
Chris@76 397
Chris@76 398 ?>