This repository has been archived on 2024-06-26. You can view files and clone it, but cannot push or open issues or pull requests.
sakura/main/authenticate.php

379 lines
15 KiB
PHP
Raw Normal View History

2015-04-06 21:23:54 +00:00
<?php
/*
* Sakura Authentication Page
*/
// Declare Namespace
namespace Sakura;
// Include components
require_once str_replace(basename(__DIR__), '', dirname(__FILE__)) .'_sakura/sakura.php';
2015-04-08 17:18:19 +00:00
// Page actions
if(isset($_REQUEST['mode'])) {
2015-04-08 17:18:19 +00:00
2015-04-17 22:51:53 +00:00
// Continue
$continue = true;
2015-04-08 17:18:19 +00:00
2015-04-19 13:00:32 +00:00
// Make sure we're not in activate mode since adding a timestamp and accessing the PHP session id is kind of hard when you're in an e-mail client
if(!isset($_REQUEST['mode']) || $_REQUEST['mode'] != 'activate') {
2015-04-08 19:27:51 +00:00
2015-04-19 13:00:32 +00:00
// Compare time and session so we know the link isn't forged
if(!isset($_REQUEST['time']) || $_REQUEST['time'] < time() - 1000) {
2015-04-19 13:00:32 +00:00
$renderData['page'] = [
'title' => 'Action failed',
'redirect' => '/authenticate',
2015-04-25 20:08:44 +00:00
'message' => 'Timestamps differ too much, refresh the page and try again.',
'success' => 0
2015-04-19 13:00:32 +00:00
];
2015-04-19 13:00:32 +00:00
// Prevent
$continue = false;
}
2015-04-17 22:51:53 +00:00
2015-04-19 13:00:32 +00:00
// Match session ids for the same reason
if(!isset($_REQUEST['session']) || $_REQUEST['session'] != session_id()) {
2015-04-17 22:51:53 +00:00
2015-04-19 13:00:32 +00:00
$renderData['page'] = [
'title' => 'Action failed',
'redirect' => '/authenticate',
2015-06-20 16:06:07 +00:00
'message' => 'Invalid session, please try again.',
'success' => 0
2015-04-19 13:00:32 +00:00
];
2015-04-17 22:51:53 +00:00
2015-04-19 13:00:32 +00:00
// Prevent
$continue = false;
}
2015-04-17 22:51:53 +00:00
}
2015-04-18 11:35:16 +00:00
// Login check
if(Users::checkLogin()) {
2015-04-25 20:08:44 +00:00
if(!in_array($_REQUEST['mode'], ['logout', 'legacypw'])) {
2015-04-18 11:35:16 +00:00
$continue = false;
2015-04-25 20:08:44 +00:00
// Add page specific things
$renderData['page'] = [
'title' => 'Authentication',
'redirect' => '/',
'message' => 'You are already authenticated. Redirecting...',
'success' => 1
];
}
2015-04-18 11:35:16 +00:00
}
2015-04-17 22:51:53 +00:00
if($continue) {
2015-04-21 14:23:28 +00:00
2015-04-17 22:51:53 +00:00
switch($_REQUEST['mode']) {
case 'logout':
// Attempt logout
$logout = Users::logout();
// Add page specific data
$renderData['page'] = [
'title' => 'Logout',
'redirect' => ($logout ? $_REQUEST['redirect'] : '/authenticate'),
2015-07-30 01:12:53 +00:00
'message' => $logout ? 'You are now logged out.' : 'An unknown error occurred.',
'success' => $logout ? 1 : 0
2015-04-17 22:51:53 +00:00
];
break;
2015-04-21 14:23:28 +00:00
case 'legacypw':
2015-04-25 20:08:44 +00:00
// Attempt change
$legacypass = Users::changeLegacy($_REQUEST['oldpw'], $_REQUEST['newpw'], $_REQUEST['verpw']);
// Array containing "human understandable" messages
$messages = [
'USER_NOT_LOGIN' => 'What are you doing, you\'re not even logged in. GO AWAY!',
'INCORRECT_PASSWORD' => 'The password you entered was invalid.',
2015-06-04 12:41:55 +00:00
'NOT_ALLOWED' => 'Your account does not have the required permissions to change your password.',
2015-04-25 20:08:44 +00:00
'NO_LOGIN' => 'Logging into this account is disabled.',
'PASS_TOO_SHIT' => 'Your password is too weak, try adding some special characters.',
'PASS_NOT_MATCH' => 'Passwords do not match.',
'SUCCESS' => 'Successfully changed your password, you may now continue.'
];
2015-04-21 14:23:28 +00:00
// Add page specific things
$renderData['page'] = [
2015-04-25 20:08:44 +00:00
'title' => 'Change Password',
'redirect' => '/',
'message' => $messages[$legacypass[1]],
'success' => $legacypass[0]
2015-04-21 14:23:28 +00:00
];
break;
case 'changepassword':
2015-04-25 20:08:44 +00:00
// Attempt change
$passforget = Users::resetPassword($_REQUEST['verk'], $_REQUEST['uid'], $_REQUEST['newpw'], $_REQUEST['verpw']);
// Array containing "human understandable" messages
$messages = [
'INVALID_VERK' => 'The verification key supplied was invalid!',
'INVALID_CODE' => 'Invalid verification key, if you think this is an error contact the administrator.',
'INVALID_USER' => 'The used verification key is not designated for this user.',
'VERK_TOO_SHIT' => 'Your verification code is too weak, try adding some special characters.',
'PASS_TOO_SHIT' => 'Your password is too weak, try adding some special characters.',
'PASS_NOT_MATCH' => 'Passwords do not match.',
'SUCCESS' => 'Successfully changed your password, you may now log in.'
];
2015-04-21 14:23:28 +00:00
// Add page specific things
$renderData['page'] = [
'title' => 'Forgot Password',
2015-04-25 20:08:44 +00:00
'redirect' => ($passforget[0] ? '/' : $_SERVER['PHP_SELF'] .'?pw=true&uid='. $_REQUEST['uid'] .'&verk='. $_REQUEST['verk']),
'message' => $messages[$passforget[1]],
'success' => $passforget[0]
2015-04-21 14:23:28 +00:00
];
break;
2015-04-19 13:00:32 +00:00
// Activating accounts
case 'activate':
// Attempt activation
$activate = Users::activateUser($_REQUEST['u'], true, $_REQUEST['k']);
// Array containing "human understandable" messages
$messages = [
'USER_NOT_EXIST' => 'The user you tried to activate does not exist.',
'USER_ALREADY_ACTIVE' => 'The user you tried to activate is already active.',
'INVALID_CODE' => 'Invalid activation code, if you think this is an error contact the administrator.',
2015-04-25 20:08:44 +00:00
'INVALID_USER' => 'The used activation code is not designated for this user.',
2015-04-19 13:00:32 +00:00
'SUCCESS' => 'Successfully activated your account, you may now log in.'
];
// Add page specific things
$renderData['page'] = [
'title' => 'Activate account',
'redirect' => '/authenticate',
'message' => $messages[$activate[1]],
'success' => $activate[0]
2015-04-19 13:00:32 +00:00
];
break;
// Resending the activation e-mail
case 'resendactivemail':
// Attempt send
2015-04-21 14:23:28 +00:00
$resend = Users::resendActivationMail($_REQUEST['username'], $_REQUEST['email']);
// Array containing "human understandable" messages
$messages = [
2015-04-24 19:31:09 +00:00
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
2015-04-24 17:48:56 +00:00
'USER_NOT_EXIST' => 'The user you tried to activate does not exist (confirm the username/email combination).',
2015-04-21 14:23:28 +00:00
'USER_ALREADY_ACTIVE' => 'The user you tried to activate is already active.',
'SUCCESS' => 'The activation e-mail has been sent to the address associated with your account.'
];
// Add page specific things
$renderData['page'] = [
'title' => 'Resend Activation',
'redirect' => '/authenticate',
'message' => $messages[$resend[1]],
'success' => $resend[0]
];
2015-04-19 13:00:32 +00:00
break;
2015-04-17 22:51:53 +00:00
// Login processing
case 'login':
// Attempt login
$login = Users::login($_REQUEST['username'], $_REQUEST['password'], isset($_REQUEST['remember']));
// Array containing "human understandable" messages
$messages = [
2015-04-24 19:31:09 +00:00
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
2015-04-17 22:51:53 +00:00
'USER_NOT_EXIST' => 'The user you tried to log into does not exist.',
'INCORRECT_PASSWORD' => 'The password you entered was invalid.',
2015-06-04 12:41:55 +00:00
'NOT_ALLOWED' => 'Your account does not have the required permissions to log in.',
2015-04-18 18:26:52 +00:00
'NO_LOGIN' => 'Logging into this account is disabled.',
2015-04-17 22:51:53 +00:00
'LEGACY_SUCCESS' => 'Login successful! Taking you to the password changing page...',
'LOGIN_SUCESS' => 'Login successful!'
];
// Add page specific things
$renderData['page'] = [
'title' => 'Login',
2015-04-25 20:08:44 +00:00
'redirect' => ($login[1] == 'LEGACY_SUCCESS' ? '/authenticate?legacy=true' : ($login[0] ? $_REQUEST['redirect'] : '/authenticate')),
'message' => $messages[$login[1]],
'success' => $login[0]
2015-04-17 22:51:53 +00:00
];
2015-04-08 19:27:51 +00:00
2015-04-17 22:51:53 +00:00
break;
2015-04-08 19:27:51 +00:00
2015-04-17 22:51:53 +00:00
// Registration processing
case 'register':
2015-04-08 19:27:51 +00:00
2015-04-19 13:00:32 +00:00
// Attempt registration
$register = Users::register(
$_REQUEST['username'],
$_REQUEST['password'],
$_REQUEST['confirmpassword'],
$_REQUEST['email'],
isset($_REQUEST['tos']),
(
Configuration::getConfig('recaptcha') ?
$_REQUEST['g-recaptcha-response'] :
null
),
(
Configuration::getConfig('require_registration_code') ?
$_REQUEST['registercode'] :
null
)
);
// Array containing "human understandable" messages
$messages = [
2015-04-24 19:31:09 +00:00
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
2015-04-19 13:00:32 +00:00
'DISABLED' => 'Registration is currently disabled.',
'INVALID_REG_KEY' => 'The given registration code was invalid.',
'TOS' => 'You are required to agree to the Terms of Service.',
'CAPTCHA_FAIL' => 'Captcha verification failed, please try again.',
'USER_EXISTS' => 'A user with this username already exists, if you lost your password try using the Lost Password form.',
'NAME_TOO_SHORT' => 'Your name must be at least 3 characters long.',
'NAME_TOO_LONG' => 'Your name can\'t be longer than 16 characters.',
2015-04-24 19:31:09 +00:00
'PASS_TOO_SHIT' => 'Your password is too weak, try adding some special characters.',
2015-04-19 13:00:32 +00:00
'PASS_NOT_MATCH' => 'Passwords do not match.',
'INVALID_EMAIL' => 'Your e-mail address is formatted incorrectly.',
'INVALID_MX' => 'No valid MX-Record found on the e-mail address you supplied.',
'EMAILSENT' => 'Your registration went through! An activation e-mail has been sent.',
'SUCCESS' => 'Your registration went through! Welcome to '. Configuration::getConfig('sitename') .'!'
];
2015-04-17 22:51:53 +00:00
// Add page specific things
$renderData['page'] = [
'title' => 'Register',
2015-04-19 13:00:32 +00:00
'redirect' => ($register[0] ? '/' : '/authenticate'),
'message' => $messages[$register[1]],
'success' => $register[0]
2015-04-17 22:51:53 +00:00
];
2015-04-08 19:27:51 +00:00
2015-04-17 22:51:53 +00:00
break;
2015-04-08 19:27:51 +00:00
2015-04-17 22:51:53 +00:00
// Unforgetting passwords
case 'forgotpassword':
2015-04-08 19:27:51 +00:00
2015-04-25 20:08:44 +00:00
// Attempt send
$passforgot = Users::sendPasswordForgot($_REQUEST['username'], $_REQUEST['email']);
// Array containing "human understandable" messages
$messages = [
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
'USER_NOT_EXIST' => 'The requested user does not exist (confirm the username/email combination).',
2015-06-04 12:41:55 +00:00
'NOT_ALLOWED' => 'Your account does not have the required permissions to change your password.',
2015-04-25 20:08:44 +00:00
'SUCCESS' => 'The password reset e-mail has been sent to the address associated with your account.'
];
2015-04-17 22:51:53 +00:00
// Add page specific things
$renderData['page'] = [
2015-04-25 20:08:44 +00:00
'title' => 'Lost Password',
'redirect' => '/authenticate',
'message' => $messages[$passforgot[1]],
'success' => $passforgot[0]
2015-04-17 22:51:53 +00:00
];
2015-04-08 17:18:19 +00:00
2015-04-17 22:51:53 +00:00
break;
2015-04-08 17:18:19 +00:00
2015-04-17 22:51:53 +00:00
}
2015-04-21 14:23:28 +00:00
2015-04-08 17:18:19 +00:00
}
// Print page contents or if the AJAX request is set only display the render data
print isset($_REQUEST['ajax']) ?
(
$renderData['page']['title']
. '|'
. $renderData['page']['message']
. '|'
. $renderData['page']['success']
. '|'
. $renderData['page']['redirect']
) :
Templates::render('errors/information.tpl', $renderData);
2015-04-08 19:27:51 +00:00
exit;
2015-04-08 17:18:19 +00:00
}
2015-04-06 21:23:54 +00:00
// Add page specific things
$renderData['page'] = [
2015-04-21 14:23:28 +00:00
'title' => 'Authentication'
2015-04-06 21:23:54 +00:00
];
$renderData['auth'] = [
'redirect' => isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/',
2015-04-06 21:23:54 +00:00
'blockRegister' => [
2015-04-18 18:26:52 +00:00
'do' => false
2015-04-06 21:23:54 +00:00
]
2015-04-06 21:23:54 +00:00
];
2015-04-25 20:08:44 +00:00
// Check if the user is already logged in
if(Users::checkLogin()) {
// If password forgot things are set display password forget thing
if(isset($_REQUEST['legacy']) && $_REQUEST['legacy'] && Users::getUser(Session::$userId)['password_algo'] == 'legacy') {
$renderData['page']['title'] = 'Changing Password';
$renderData['auth']['changingPass'] = true;
print Templates::render('main/legacypasswordchange.tpl', $renderData);
exit;
}
// Add page specific things
$renderData['page'] = [
'title' => 'Authentication',
'redirect' => '/',
'message' => 'You are already logged in, log out to access this page.'
];
print Templates::render('errors/information.tpl', $renderData);
exit;
}
2015-04-18 18:26:52 +00:00
// Check if a user has already registered from the current IP address
if(count($regUserIP = Users::getUsersByIP(Main::getRemoteIP()))) {
$renderData['auth']['blockRegister'] = [
'do' => true,
'username' => $regUserIP[array_rand($regUserIP)]['username']
];
}
2015-04-21 14:23:28 +00:00
// If password forgot things are set display password forget thing
if(isset($_REQUEST['pw']) && $_REQUEST['pw']) {
2015-04-25 20:08:44 +00:00
$renderData['page']['title'] = 'Resetting Password';
2015-04-21 14:23:28 +00:00
$renderData['auth']['changingPass'] = true;
2015-04-25 20:08:44 +00:00
$renderData['auth']['userId'] = $_REQUEST['uid'];
2015-04-21 14:23:28 +00:00
if(isset($_REQUEST['key']))
$renderData['auth']['forgotKey'] = $_REQUEST['key'];
print Templates::render('main/forgotpassword.tpl', $renderData);
exit;
}
2015-04-06 21:23:54 +00:00
// Print page contents
2015-04-06 21:57:17 +00:00
print Templates::render('main/authenticate.tpl', $renderData);