This repository has been archived on 2024-06-26. You can view files and clone it, but cannot push or open issues or pull requests.
sakura/libraries/Controllers/Settings/AccountController.php

334 lines
12 KiB
PHP
Raw Normal View History

<?php
/**
* Holds the account section controller.
*
* @package Sakura
*/
namespace Sakura\Controllers\Settings;
2016-04-03 21:29:46 +00:00
use Sakura\ActiveUser;
use Sakura\Config;
use Sakura\DB;
use Sakura\Hashing;
use Sakura\Perms\Site;
use Sakura\Router;
use Sakura\Template;
/**
* Account settings.
*
* @package Sakura
* @author Julian van de Groep <me@flash.moe>
*/
class AccountController extends Controller
{
public function email()
{
2016-04-03 21:29:46 +00:00
// Check permission
if (!ActiveUser::$user->permission(Site::CHANGE_EMAIL)) {
$message = "You aren't allowed to change your e-mail address.";
$redirect = Router::route('settings.general.home');
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
$session = $_POST['session'] ?? null;
$email = $_POST['email'] ?? null;
if ($session && $email) {
$redirect = Router::route('settings.account.email');
// Check if the CSRF session matches
if ($session !== session_id()) {
$message = "Your session expired!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Validate e-mail address
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$message = "The e-mail address you supplied is invalid!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check the MX record of the email
if (!check_mx_record($email)) {
$message = 'No valid MX-Record found on the e-mail address you supplied.';
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
// Check if the e-mail has already been used
$emailCheck = DB::table('users')
->where('email', $email)
->count();
if ($emailCheck) {
$message = 'Someone already used this e-mail!';
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
ActiveUser::$user->setMail($email);
$message = 'Changed your e-mail address!';
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
return Template::render('settings/account/email');
}
public function username()
{
2016-04-03 21:29:46 +00:00
// Check permission
if (!ActiveUser::$user->permission(Site::CHANGE_USERNAME)) {
$message = "You aren't allowed to change your username.";
$redirect = Router::route('settings.general.home');
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
$session = $_POST['session'] ?? null;
$username = $_POST['username'] ?? null;
if ($session && $username) {
$redirect = Router::route('settings.account.username');
$username_clean = clean_string($username, true);
// Check if the CSRF session matches
if ($session !== session_id()) {
$message = "Your session expired!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check if the username is too short
if (strlen($username_clean) < Config::get('username_min_length')) {
$message = "This username is too short!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check if the username is too long
if (strlen($username_clean) > Config::get('username_max_length')) {
$message = "This username is too long!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check if this username hasn't been used in the last amount of days set in the config
$getOld = DB::table('username_history')
->where('username_old_clean', $username_clean)
->where('change_time', '>', (Config::get('old_username_reserve') * 24 * 60 * 60))
->orderBy('change_id', 'desc')
->get();
// Check if anything was returned
if ($getOld && $getOld[0]->user_id != ActiveUser::$user->id) {
$message = "The username you tried to use is reserved, try again later!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check if the username is already in use
$getInUse = DB::table('users')
->where('username_clean', $username_clean)
->get();
// Check if anything was returned
if ($getInUse) {
$message = "Someone is already using this name!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
ActiveUser::$user->setUsername($username, $username_clean);
$message = "Changed your username!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
return Template::render('settings/account/username');
}
public function title()
{
2016-04-03 21:29:46 +00:00
// Check permission
if (!ActiveUser::$user->permission(Site::CHANGE_USERTITLE)) {
$message = "You aren't allowed to change your title.";
$redirect = Router::route('settings.general.home');
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
$session = $_POST['session'] ?? null;
$title = $_POST['title'] ?? null;
if ($session && $title !== null) {
$redirect = Router::route('settings.account.title');
// Check if the CSRF session matches
if ($session !== session_id()) {
$message = "Your session expired!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
if (strlen($title) > 64) {
$message = "This title is too long!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
if ($title === ActiveUser::$user->title) {
$message = "This is already your title!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Update database
DB::table('users')
->where('user_id', ActiveUser::$user->id)
->update([
'user_title' => $title,
]);
$message = "Changed your title!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
return Template::render('settings/account/title');
}
public function password()
{
2016-04-03 21:29:46 +00:00
// Check permission
if (!ActiveUser::$user->permission(Site::CHANGE_PASSWORD)) {
$message = "You aren't allowed to change your password.";
$redirect = Router::route('settings.general.home');
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
$session = $_POST['session'] ?? null;
$current = $_POST['current'] ?? null;
$password = $_POST['password'] ?? null;
if ($session && $current && $password) {
$redirect = Router::route('settings.account.password');
// Check if the CSRF session matches
if ($session !== session_id()) {
$message = "Your session expired!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check current password
if (!Hashing::validatePassword($current, [
ActiveUser::$user->passwordAlgo,
ActiveUser::$user->passwordIter,
ActiveUser::$user->passwordSalt,
ActiveUser::$user->passwordHash,
])) {
$message = "Your password was invalid!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check password entropy
if (password_entropy($password) < Config::get('min_entropy')) {
$message = "Your password isn't strong enough!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
ActiveUser::$user->setPassword($password);
$message = "Changed your password!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
return Template::render('settings/account/password');
}
public function ranks()
{
2016-04-03 21:29:46 +00:00
// Check permission
if (!ActiveUser::$user->permission(Site::ALTER_RANKS)) {
$message = "You aren't allowed to manage your ranks.";
$redirect = Router::route('settings.general.home');
Template::vars(compact('message', 'redirect'));
return Template::render('global/information');
}
$session = $_POST['session'] ?? null;
$rank = $_POST['rank'] ?? null;
$mode = $_POST['mode'] ?? null;
$locked = [
Config::get('deactive_rank_id'),
Config::get('default_rank_id'),
Config::get('premium_rank_id'),
Config::get('restricted_rank_id'),
];
if ($session && $rank && $mode) {
$redirect = Router::route('settings.account.ranks');
// Check if the CSRF session matches
if ($session !== session_id()) {
$message = "Your session expired!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
// Check if user has this rank
if (!ActiveUser::$user->hasRanks([$rank])) {
$message = "You aren't a part of this rank!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
if ($mode == 'remove') {
if (in_array($rank, $locked)) {
$message = "You aren't allowed to remove this rank from your account!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
ActiveUser::$user->removeRanks([$rank]);
$message = "Removed the rank from your account!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
ActiveUser::$user->setMainRank($rank);
$message = "Changed your main rank!";
Template::vars(compact('redirect', 'message'));
return Template::render('global/information');
}
Template::vars(compact('locked'));
return Template::render('settings/account/ranks');
}
}