You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
203 lines
7.5 KiB
203 lines
7.5 KiB
<?php |
|
|
|
class FreshRSS_users_Controller extends Minz_ActionController { |
|
|
|
const BCRYPT_COST = 9; //Will also have to be computed client side on mobile devices, so do not use a too high cost |
|
|
|
public function firstAction() { |
|
if (!$this->view->loginOk) { |
|
Minz_Error::error( |
|
403, |
|
array('error' => array(Minz_Translate::t('access_denied'))) |
|
); |
|
} |
|
} |
|
|
|
public function authAction() { |
|
if (Minz_Request::isPost()) { |
|
$ok = true; |
|
|
|
$passwordPlain = Minz_Request::param('passwordPlain', '', true); |
|
if ($passwordPlain != '') { |
|
Minz_Request::_param('passwordPlain'); //Discard plain-text password ASAP |
|
$_POST['passwordPlain'] = ''; |
|
if (!function_exists('password_hash')) { |
|
include_once(LIB_PATH . '/password_compat.php'); |
|
} |
|
$passwordHash = password_hash($passwordPlain, PASSWORD_BCRYPT, array('cost' => self::BCRYPT_COST)); |
|
$passwordPlain = ''; |
|
$passwordHash = preg_replace('/^\$2[xy]\$/', '\$2a\$', $passwordHash); //Compatibility with bcrypt.js |
|
$ok &= ($passwordHash != ''); |
|
$this->view->conf->_passwordHash($passwordHash); |
|
} |
|
Minz_Session::_param('passwordHash', $this->view->conf->passwordHash); |
|
|
|
$passwordPlain = Minz_Request::param('apiPasswordPlain', '', true); |
|
if ($passwordPlain != '') { |
|
if (!function_exists('password_hash')) { |
|
include_once(LIB_PATH . '/password_compat.php'); |
|
} |
|
$passwordHash = password_hash($passwordPlain, PASSWORD_BCRYPT, array('cost' => self::BCRYPT_COST)); |
|
$passwordPlain = ''; |
|
$passwordHash = preg_replace('/^\$2[xy]\$/', '\$2a\$', $passwordHash); //Compatibility with bcrypt.js |
|
$ok &= ($passwordHash != ''); |
|
$this->view->conf->_apiPasswordHash($passwordHash); |
|
} |
|
|
|
if (Minz_Configuration::isAdmin(Minz_Session::param('currentUser', '_'))) { |
|
$this->view->conf->_mail_login(Minz_Request::param('mail_login', '', true)); |
|
} |
|
$email = $this->view->conf->mail_login; |
|
Minz_Session::_param('mail', $email); |
|
|
|
$ok &= $this->view->conf->save(); |
|
|
|
if ($email != '') { |
|
$personaFile = DATA_PATH . '/persona/' . $email . '.txt'; |
|
@unlink($personaFile); |
|
$ok &= (file_put_contents($personaFile, Minz_Session::param('currentUser', '_')) !== false); |
|
} |
|
|
|
if (Minz_Configuration::isAdmin(Minz_Session::param('currentUser', '_'))) { |
|
$current_token = $this->view->conf->token; |
|
$token = Minz_Request::param('token', $current_token); |
|
$this->view->conf->_token($token); |
|
$ok &= $this->view->conf->save(); |
|
|
|
$anon = Minz_Request::param('anon_access', false); |
|
$anon = ((bool)$anon) && ($anon !== 'no'); |
|
$anon_refresh = Minz_Request::param('anon_refresh', false); |
|
$anon_refresh = ((bool)$anon_refresh) && ($anon_refresh !== 'no'); |
|
$auth_type = Minz_Request::param('auth_type', 'none'); |
|
$unsafe_autologin = Minz_Request::param('unsafe_autologin', false); |
|
$api_enabled = Minz_Request::param('api_enabled', false); |
|
if ($anon != Minz_Configuration::allowAnonymous() || |
|
$auth_type != Minz_Configuration::authType() || |
|
$anon_refresh != Minz_Configuration::allowAnonymousRefresh() || |
|
$unsafe_autologin != Minz_Configuration::unsafeAutologinEnabled() || |
|
$api_enabled != Minz_Configuration::apiEnabled()) { |
|
|
|
Minz_Configuration::_authType($auth_type); |
|
Minz_Configuration::_allowAnonymous($anon); |
|
Minz_Configuration::_allowAnonymousRefresh($anon_refresh); |
|
Minz_Configuration::_enableAutologin($unsafe_autologin); |
|
Minz_Configuration::_enableApi($api_enabled); |
|
$ok &= Minz_Configuration::writeFile(); |
|
} |
|
} |
|
|
|
invalidateHttpCache(); |
|
|
|
$notif = array( |
|
'type' => $ok ? 'good' : 'bad', |
|
'content' => Minz_Translate::t($ok ? 'configuration_updated' : 'error_occurred') |
|
); |
|
Minz_Session::_param('notification', $notif); |
|
} |
|
Minz_Request::forward(array('c' => 'configure', 'a' => 'users'), true); |
|
} |
|
|
|
public function createAction() { |
|
if (Minz_Request::isPost() && Minz_Configuration::isAdmin(Minz_Session::param('currentUser', '_'))) { |
|
$db = Minz_Configuration::dataBase(); |
|
require_once(APP_PATH . '/SQL/install.sql.' . $db['type'] . '.php'); |
|
|
|
$new_user_language = Minz_Request::param('new_user_language', $this->view->conf->language); |
|
if (!in_array($new_user_language, $this->view->conf->availableLanguages())) { |
|
$new_user_language = $this->view->conf->language; |
|
} |
|
|
|
$new_user_name = Minz_Request::param('new_user_name'); |
|
$ok = ($new_user_name != '') && ctype_alnum($new_user_name); |
|
|
|
if ($ok) { |
|
$ok &= (strcasecmp($new_user_name, Minz_Configuration::defaultUser()) !== 0); //It is forbidden to alter the default user |
|
|
|
$ok &= !in_array(strtoupper($new_user_name), array_map('strtoupper', listUsers())); //Not an existing user, case-insensitive |
|
|
|
$configPath = DATA_PATH . '/' . $new_user_name . '_user.php'; |
|
$ok &= !file_exists($configPath); |
|
} |
|
if ($ok) { |
|
|
|
$passwordPlain = Minz_Request::param('new_user_passwordPlain', '', true); |
|
$passwordHash = ''; |
|
if ($passwordPlain != '') { |
|
Minz_Request::_param('new_user_passwordPlain'); //Discard plain-text password ASAP |
|
$_POST['new_user_passwordPlain'] = ''; |
|
if (!function_exists('password_hash')) { |
|
include_once(LIB_PATH . '/password_compat.php'); |
|
} |
|
$passwordHash = password_hash($passwordPlain, PASSWORD_BCRYPT, array('cost' => self::BCRYPT_COST)); |
|
$passwordPlain = ''; |
|
$passwordHash = preg_replace('/^\$2[xy]\$/', '\$2a\$', $passwordHash); //Compatibility with bcrypt.js |
|
$ok &= ($passwordHash != ''); |
|
} |
|
if (empty($passwordHash)) { |
|
$passwordHash = ''; |
|
} |
|
|
|
$new_user_email = filter_var($_POST['new_user_email'], FILTER_VALIDATE_EMAIL); |
|
if (empty($new_user_email)) { |
|
$new_user_email = ''; |
|
} else { |
|
$personaFile = DATA_PATH . '/persona/' . $new_user_email . '.txt'; |
|
@unlink($personaFile); |
|
$ok &= (file_put_contents($personaFile, $new_user_name) !== false); |
|
} |
|
} |
|
if ($ok) { |
|
$config_array = array( |
|
'language' => $new_user_language, |
|
'passwordHash' => $passwordHash, |
|
'mail_login' => $new_user_email, |
|
); |
|
$ok &= (file_put_contents($configPath, "<?php\n return " . var_export($config_array, true) . ';') !== false); |
|
} |
|
if ($ok) { |
|
$userDAO = new FreshRSS_UserDAO(); |
|
$ok &= $userDAO->createUser($new_user_name); |
|
} |
|
invalidateHttpCache(); |
|
|
|
$notif = array( |
|
'type' => $ok ? 'good' : 'bad', |
|
'content' => Minz_Translate::t($ok ? 'user_created' : 'error_occurred', $new_user_name) |
|
); |
|
Minz_Session::_param('notification', $notif); |
|
} |
|
Minz_Request::forward(array('c' => 'configure', 'a' => 'users'), true); |
|
} |
|
|
|
public function deleteAction() { |
|
if (Minz_Request::isPost() && Minz_Configuration::isAdmin(Minz_Session::param('currentUser', '_'))) { |
|
$db = Minz_Configuration::dataBase(); |
|
require_once(APP_PATH . '/SQL/install.sql.' . $db['type'] . '.php'); |
|
|
|
$username = Minz_Request::param('username'); |
|
$ok = ctype_alnum($username); |
|
|
|
if ($ok) { |
|
$ok &= (strcasecmp($username, Minz_Configuration::defaultUser()) !== 0); //It is forbidden to delete the default user |
|
} |
|
if ($ok) { |
|
$configPath = DATA_PATH . '/' . $username . '_user.php'; |
|
$ok &= file_exists($configPath); |
|
} |
|
if ($ok) { |
|
$userDAO = new FreshRSS_UserDAO(); |
|
$ok &= $userDAO->deleteUser($username); |
|
$ok &= unlink($configPath); |
|
//TODO: delete Persona file |
|
} |
|
invalidateHttpCache(); |
|
|
|
$notif = array( |
|
'type' => $ok ? 'good' : 'bad', |
|
'content' => Minz_Translate::t($ok ? 'user_deleted' : 'error_occurred', $username) |
|
); |
|
Minz_Session::_param('notification', $notif); |
|
} |
|
Minz_Request::forward(array('c' => 'configure', 'a' => 'users'), true); |
|
} |
|
}
|
|
|